5

I just created a text-file yyy in my home-directory. I modified it both with touch yyy and edited it manually.

Then I wanted to find this file (and others) via:

find ~/ -type f -mtime 1 -ctime 1 | grep yyy

but yyy isn't displayed. In find's man it is written:

-ctime n: File's status was last changed n*24 hours ago. ...

-mtime n: File's data was last modified n*24 hours ago. ...

So my first question is:

Why isn't yyy found

My second question is:

Does changed file's status mean: Changed content of file & permissions of file & ...?

Does modified file's data mean: Changed content of file?

Improve this question
6

Yes, "modified file's data" (mtime) means that the content was modified. This date can be manually changed (e.g. with touch).

Yes, "changed file's status" (ctime) means that either the content was changed, or the file's metadata (permission, owner, etc). This can not be changed manually.

Example:

$ date > foo
$ ls -l --full-time foo; ls -lc --full-time foo     # Both times have changed
-rw-r--r-- 1 xhienne xhienne 29 2017-01-18 13:40:07.677161702 +0100 foo
-rw-r--r-- 1 xhienne xhienne 29 2017-01-18 13:40:07.677161702 +0100 foo

$ chmod o-r foo
$ ls -l --full-time foo; ls -lc --full-time foo     # Only ctime has changed
-rw-r----- 1 xhienne xhienne 29 2017-01-18 13:40:07.677161702 +0100 foo
-rw-r----- 1 xhienne xhienne 29 2017-01-18 13:40:29.601161310 +0100 foo

$ date >> foo
$ ls -l --full-time foo; ls -lc --full-time foo     # Again, both times have changed
-rw-r----- 1 xhienne xhienne 58 2017-01-18 13:40:51.297160921 +0100 foo
-rw-r----- 1 xhienne xhienne 58 2017-01-18 13:40:51.297160921 +0100 foo

Your file is not found because your find predicates -mtime 1 and -ctime 1 search for a file that was modified yesterday (more exactly between 24h ago and 48h ago). For a file that is modified today, use either -mtime 0 or -mtime -1 (same for -ctime).

Example:

$ find -name foo -mtime 1 -ctime 1

$ find -name foo -mtime 0 -ctime 0
./foo

$ find -name foo -mtime -1 -ctime -1
./foo
Improve this answer
5
  • Thanks, reading atime option explanation, it is written: When find figures out how many 24-hour periods ago the file was last accessed, any fractional part is ignored, so to match -atime +1, a file has to have been accessed at least two days ago. This means: -ctime 0 : within [now,now+24h] -ctime +1 : within [now+2*24h,infinity]; -ctime -1 : within [now,now+2*24h]; – FloHe Jan 18 '17 at 12:54
  • @StéphaneChazelas Right. I added a precision to my answer just before your comment. I believe you didn't see it. Is my answer still in need of an edit according to you? – xhienne Jan 18 '17 at 12:56
  • @FloHe Yes except for -ctime -1 which means less that 24h ago, that is with [now, now + 24h[ – xhienne Jan 18 '17 at 13:04
  • -mtime -1 would also report files with modification time in the future, so it's not equivalent to -mtime 0. – Stéphane Chazelas Jan 18 '17 at 13:08
  • @StéphaneChazelas Right, and I didn't say they were equivalent. I just said that the OP can use either of them for their scenario. – xhienne Jan 18 '17 at 13:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.