How can I select and move files that were written in a specified time interval, such as 1530 to 1730 local time on a recent date?

Background: I use Linux Fedora 12, and I have made my first, and long overdue, back up of my home directory to an external hard drive preparatory to upgrading to the latest Fedora release, on a new computer, using rsync. Unfortunately, although I did a lot of dry runs to check that it would work correctly, I misunderstood the destination file specification and now have all my backed up files (60000 files in 32Gb) mixed in with the original disk contents instead of in their own separate directory. So I would like to select all the files saved during the hour that the backup took, and move them to another directory.

  • Was the backup done in such a way that all file modification times were changed? Normally, rsync would preserve original modification times, making it impossible to find the right files in this way. – grebneke Feb 5 '14 at 19:33
  • @grebneke, in this case, you can use the ctime, though not on directories. – Stéphane Chazelas Feb 5 '14 at 19:48
  • @StephaneChazelas - great, it's worth a try. I checked some of my own rsync backups and ctime actually seems to be correct also for directories. – grebneke Feb 5 '14 at 20:09
  • @grebneke, the ctime will be updated for directories that were already there but have been added new files – Stéphane Chazelas Feb 5 '14 at 20:10
  • @StephaneChazelas - I checked some directories that haven't been touched for years, including their content, and the ctime for the directories is exactly when they were recently rsynced. I never overwrite backups but write new ones with --hard-links to previous versions. Any way, it's the best suggestion to try for OP. – grebneke Feb 5 '14 at 20:13

As suggested by Stephane Chazelas, you could use find and check for ctime.

Assuming the backup was initiated 200 minutes ago, and terminated 100 minutes ago, this will find anything with a ctime in that interval:

find -cmin -200 -cmin +100

Do your dry-runs and if it looks good, construct your restauration based on that.


A general starting point for moving your files could look like (remove echo to mv for real):

find source --mindepth 1 -cmin -200 -cmin +100 -exec echo mv -v "{}" target \;

where --mindepth 1 helps avoid source itself being moved (in that case you could just mv source target), and "{}" makes mv work for pathnames containing spaces. That should cover normal cases, unless you have pathnames containing newlines or other unusual characters.

You might prefer moving directories first, to avoid warnings from find when it can't search in subdirectories it just moved. -type d:

find source -type d --mindepth 1 -cmin -200 -cmin +100 -exec echo mv -v "{}" target \;

As always: dry-run (echo) first to simulate what would happen. Here is a similar discussion from Stack Overflow

  • Thank you @grebneke and all for replying so promptly. Ok, that find works well, so please now how do I incorporate it into a mv command, or other way of moving the files and directories? – Harry Weston Feb 5 '14 at 22:51
  • @HarryWeston - added some general guidelines on moving the data – grebneke Feb 6 '14 at 7:55

As @grebneke suggested, following command with help to move files

find . ! -path . -cmin -200  -cmin +100 -exec echo mv -v {} /tmp/  \;

This is also dry run because we have used echo, if output looks good then you can remove echo and move files.

find command explanation

  • . where to look
  • ! -path . exclude current directory
  • -cmin -200 200 minutes ago
  • -cmin +100 100 minutes ago
  • -exec Execute command
  • { } The string { } replaced by the matches file name
  • \; Needs to be there as it tells the end of arguements provided to -exec variable
  • As far as I can tell, there's no reason to create a new shell for each invocation of mv here. Doing so will be far less efficient over a large number of files than just calling mv directly. – Chris Down Feb 6 '14 at 3:52
  • @ChrisDown thanks, what would be alternate solution? xargs ? – Rahul Patil Feb 6 '14 at 3:54
  • Why not just -exec echo mv {} /tmp \;? – Chris Down Feb 6 '14 at 3:59
  • @ChrisDown hmm, let me test that.. – Rahul Patil Feb 6 '14 at 3:59
  • @ChrisDown thanks.. mate. just updating in answer.. – Rahul Patil Feb 6 '14 at 4:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.