Sort files in a directory by access time ignoring a subset of them

Question

Once in a while I download a few files to a directory d. During time lots of files were downloaded and I tried to look at them in the order they were downloaded sorted from oldest to newest.

I decided that the order doesn't matter so precisely, but the files I have accessed in the other way (e.g. opened a pdf file that I have found interesting) than "time of download" may change the order.

I used the command:

$ ls -rtlu

but it wasn't what I was looking for because the videos downloaded shortly one after another were separated by about 100 other files I haven't shown any interest in them recently. And all of them have the same access time in the output Feb 11 16:44. The first video was downloaded at Feb 11 16:28 and the second was downloaded at Feb 11 16:45.

Can I correct the output to list the files according to the access time but leave out (or get rid of) the files I don't work with?

e.g. finding out what accessed them (I think it could be audit application I installed recently)

Answer 1

Maybe ls -rtlc does what you want. It's ordered by inode change time (ctime). The inode change time changes whenever anything about the file changes except for its access time, i.e. doing anything other than reading changes the ctime (creating, writing, moving, changing attribues, etc.). So as long as you haven't moved the files around or changed their permissions, the ctime should still be the download time.

If the download time isn't what you want then I'm afraid you're out of luck. Which process accessed a file is not recorded. The file's access time is updated on each read (or on some reads, on modern Linux system, sacrificing convenience for performance), no matter which application reads the file. There's no distinction between reading with a PDF reader and reading with an audit or indexing application.

If you want to know which files you viewed recently then you could check if your file viewer itself keeps a history of the file that it's opened. Many GUI programs do keep a list of most recently opened files, but they usually don't give an easy programmatic access.

If you invoked the viewer from the command line, try your shell history. Depending on how you configured your shell, its history may or may not be complete and may or may not be timestamped.