I need to find all files that were edited during office hours only since the computer could be used for freelancing at night. Is there a way to search for created / modified time of day regardless of date? I have both Windows and Linux systems available.
Bash Find Command – How to Find Files Modified During Specific Times
bashfind
Related Solutions
Some of the fine things find
(on GNU/Linux) can do for you:
Units:
n
exactly n untis-n
less than n units+n
more than n units -
What happened:
-atime
: last time accessed-ctime
: changes on file itself (permissions, owners, …), not its content-mtime
: file's content changed-amin n
: n minutes age-atime n
: n days (24 hours) ago- same goes for
ctime/min
andmtime/min
)
Thus:
find -atime -30
→ last accessed less than 30 days agofind -ctime +5
→ more than 5 days ago, changes on file itselffind -mtime +2 -31
→ file's content changed more than two days but less than 31 days ago
also
- -daystart
: after today, 0.00h
Grepping
find
stuff -exec grep {} \;
→; the last part ({} \;
) is essential - mind the single white space between {}
and \;
The -exec
options allows incorporating other commands into find
The Linux kernel has had an xstat(2)
system call in the works for several years, now. David Howells of RedHat did much of the work. xstat(2)
allows one to retrieve the creation time (sometimes rechristened the "born time" or "birth time" in the Linux and BSD worlds for no really good reason) of files from the several filesystems that support it, including EXT4 (which has a creation timestamp on disc) and CIFS (which with its DOS/OS/2/Windows heritage has supported a creation timestamp as a first class citizen for decades). M. Howells worked on the CIFS patches that go along with the system call.
OpenSolaris and the BSDs actually do have a st_birthtim
datum in their stat(2)
system call right now, and the feature is accessible to script writers via application programs such as find
and ls
. On the OpenSolaris ls
man page you'll find crtime
alongside atime
, mtime
, and ctime
in several places. Similarly, the FreeBSD find
command has -Bmin
, -Bnewer
, and -Btime
primaries. And the Mac OS ls
has a -U
option.
If you were writing your script for OpenSolaris, the BSDs, or Mac OS 10, you could just get on with whatever you want to do with creation times right now. Indeed if you were writing for Windows you could do the same. Cygwin has supported st_birthtim
since 2007, making Win32's CreationTime
timestamp, which it has had since the first version of Windows NT and which Windows NT maintains on both NTFS and FAT volumes, available to Cygwin tools.
However, the same isn't true in the GNU Linux world. Creation time capability has yet to make it to GNU coreutils' ls
or to GNU findutils' find
. Indeed, it isn't even part of the mainstream Linux kernel yet. Part of the problem is that the xstat(2)
system call got bogged down in a diversion where people wanted to keep three timestamps, instead of have four as in the Windows NT kernel API, and dump ctime
to replace it with crtime
.
Linus Torvalds' response in 2010 was that "it's all totally useless and people can't even agree on a name" and "Let's wait five years".
In fact, as I suspect most people reading this will know, the world has been widely agreeing the name "creation time" since the 1980s and we've been waiting at least 25 years already. It's the name used in OS/2 1.0; it's the name used in VMS ODS-1; it's the name used in Windows NT 3.5; it's the name used in SMB; and it's the name used in the question. ☺
Further reading
- David Howells (2010-07-15). [PATCH 08/18] xstat: CIFS: Return extended attributes [ver #6]. Linux kernel mailing list.
- 2.4.7 FileBasicInformation. Windows SMB protocol. MSDN. Microsoft corporation.
- find(1) manual page. FreeBSD manual pages.
- stat(2) manual page. FreeBSD manual pages.
- ls(1) manual page. Darwin manual pages. Apple corporation.
- Corinna Vinschen (2007-03-26). _Re: Support for st_birthtime_. Cygwin mailing list.
- Linus Torvalds (2010-07-22). Re: [PATCH 02/18] xstat: Add a pair of system calls to make extended file stats available [ver #6]. Linux kernel mailing list.
- A.3.1.3 File Headers. Files-11. OpenVMS Systems Documentation. HP.
Best Answer
Yes, you can search for modified dates for any program/file using a free software called Search Everything. However, you will need to click the Date/Time column in the program and manually look through it yourself. There is no program to do this for you sadly. Hope this helps. - Aphrodite