5

I just created a text-file yyy in my home-directory. I modified it both with touch yyy and edited it manually.

Then I wanted to find this file (and others) via:

find ~/ -type f -mtime 1 -ctime 1 | grep yyy

but yyy isn't displayed. In find's man it is written:

-ctime n: File's status was last changed n*24 hours ago. ...

-mtime n: File's data was last modified n*24 hours ago. ...

So my first question is:

Why isn't yyy found

My second question is:

Does changed file's status mean: Changed content of file & permissions of file & ...?

Does modified file's data mean: Changed content of file?

Improve this question

1 Answer 1

Reset to default
6

Yes, "modified file's data" (mtime) means that the content was modified. This date can be manually changed (e.g. with touch).

Yes, "changed file's status" (ctime) means that either the content was changed, or the file's metadata (permission, owner, etc). This can not be changed manually.

Example:

$ date > foo
$ ls -l --full-time foo; ls -lc --full-time foo     # Both times have changed
-rw-r--r-- 1 xhienne xhienne 29 2017-01-18 13:40:07.677161702 +0100 foo
-rw-r--r-- 1 xhienne xhienne 29 2017-01-18 13:40:07.677161702 +0100 foo

$ chmod o-r foo
$ ls -l --full-time foo; ls -lc --full-time foo     # Only ctime has changed
-rw-r----- 1 xhienne xhienne 29 2017-01-18 13:40:07.677161702 +0100 foo
-rw-r----- 1 xhienne xhienne 29 2017-01-18 13:40:29.601161310 +0100 foo

$ date >> foo
$ ls -l --full-time foo; ls -lc --full-time foo     # Again, both times have changed
-rw-r----- 1 xhienne xhienne 58 2017-01-18 13:40:51.297160921 +0100 foo
-rw-r----- 1 xhienne xhienne 58 2017-01-18 13:40:51.297160921 +0100 foo

Your file is not found because your find predicates -mtime 1 and -ctime 1 search for a file that was modified yesterday (more exactly between 24h ago and 48h ago). For a file that is modified today, use either -mtime 0 or -mtime -1 (same for -ctime).

Example:

$ find -name foo -mtime 1 -ctime 1

$ find -name foo -mtime 0 -ctime 0
./foo

$ find -name foo -mtime -1 -ctime -1
./foo
Improve this answer
5
  • Thanks, reading atime option explanation, it is written: When find figures out how many 24-hour periods ago the file was last accessed, any fractional part is ignored, so to match -atime +1, a file has to have been accessed at least two days ago. This means: -ctime 0 : within [now,now+24h] -ctime +1 : within [now+2*24h,infinity]; -ctime -1 : within [now,now+2*24h];
    – FloHe
    Jan 18, 2017 at 12:54
  • @StéphaneChazelas Right. I added a precision to my answer just before your comment. I believe you didn't see it. Is my answer still in need of an edit according to you?
    – xhienne
    Jan 18, 2017 at 12:56
  • @FloHe Yes except for -ctime -1 which means less that 24h ago, that is with [now, now + 24h[
    – xhienne
    Jan 18, 2017 at 13:04
  • -mtime -1 would also report files with modification time in the future, so it's not equivalent to -mtime 0.
    – Stéphane Chazelas
    Jan 18, 2017 at 13:08
  • @StéphaneChazelas Right, and I didn't say they were equivalent. I just said that the OP can use either of them for their scenario.
    – xhienne
    Jan 18, 2017 at 13:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.