How to Find Files by Timestamp Using the Linux find Command

Unix File Timestamps

Every file on a Unix‑like system stores three timestamps:

mtime – time of last content modification.

atime – time of last file access (read, execute, etc.).

ctime – time of last status change (metadata such as permissions, ownership, or link count).

Traditional Unix file systems do not record a creation time.

Inspecting Timestamps with stat

Use stat <path> to display all three timestamps for a given file. Example: stat linuxmi.cpp The output contains lines similar to:

Access: 2021-05-16 07:55:12.000000000 +0800
Modify: 2021-05-15 22:30:45.000000000 +0800
Change: 2021-05-15 22:30:45.000000000 +0800

Finding Files by Timestamp with find

The find utility provides the -newerXY test, where: X selects the reference timestamp of the file being examined: a (atime), c (ctime), or m (mtime). Y determines how the reference is supplied. The most common form is t, meaning the next argument is a literal timestamp string.

General syntax:

find <directory> -newer<a|c|m>t '<YYYY-MM-DD HH:MM:SS>'

The timestamp must be quoted (single quotes are safest) to prevent the shell from interpreting spaces.

Example Commands

Find files accessed after 2021‑05‑16 07:55: find . -newerat '2021-05-16 07:55' Find files whose status changed after that moment: find . -newerct '2021-05-16 07:55' Find files modified after that moment: find . -newermt '2021-05-16 07:55' These commands search the current directory (recursively) and list only the entries whose selected timestamp is newer than the supplied value.

Using a Reference File Instead of a Literal Timestamp

Instead of providing a timestamp string, you can supply a reference file. Omit the trailing t and give the path to the file whose timestamp will be used: find . -neweram reference.txt This finds files whose access time ( a) is newer than the access time of reference.txt.

Verifying Results

After find returns a list, run stat on the reported files to confirm their timestamps:

stat linuxmi.cpp linuxmi.com.cpp

Key Points

The three Unix timestamps are mtime, atime, and ctime; creation time is not stored. stat displays these timestamps for any file. find -newerXY enables precise selection based on any of the three timestamps.

Timestamp strings must follow the format YYYY-MM-DD HH:MM:SS and be quoted.

A reference file can replace the literal timestamp by omitting the t suffix.