GNU Find – Understanding mtime and ctime Options

findtimestamps

I just created a text-file yyy in my home-directory. I modified it both with touch yyy and edited it manually.

Then I wanted to find this file (and others) via:

find ~/ -type f -mtime 1 -ctime 1 | grep yyy

but yyy isn't displayed. In find's man it is written:

-ctime n: File's status was last changed n*24 hours ago. …

-mtime n: File's data was last modified n*24 hours ago. …

So my first question is:

Why isn't yyy found

My second question is:

Does changed file's status mean: Changed content of file & permissions of file & …?

Does modified file's data mean: Changed content of file?

Best Answer

Yes, "modified file's data" (mtime) means that the content was modified. This date can be manually changed (e.g. with touch).

Yes, "changed file's status" (ctime) means that either the content was changed, or the file's metadata (permission, owner, etc). This can not be changed manually.

Example:

$ date > foo
$ ls -l --full-time foo; ls -lc --full-time foo     # Both times have changed
-rw-r--r-- 1 xhienne xhienne 29 2017-01-18 13:40:07.677161702 +0100 foo
-rw-r--r-- 1 xhienne xhienne 29 2017-01-18 13:40:07.677161702 +0100 foo

$ chmod o-r foo
$ ls -l --full-time foo; ls -lc --full-time foo     # Only ctime has changed
-rw-r----- 1 xhienne xhienne 29 2017-01-18 13:40:07.677161702 +0100 foo
-rw-r----- 1 xhienne xhienne 29 2017-01-18 13:40:29.601161310 +0100 foo

$ date >> foo
$ ls -l --full-time foo; ls -lc --full-time foo     # Again, both times have changed
-rw-r----- 1 xhienne xhienne 58 2017-01-18 13:40:51.297160921 +0100 foo
-rw-r----- 1 xhienne xhienne 58 2017-01-18 13:40:51.297160921 +0100 foo

Your file is not found because your find predicates -mtime 1 and -ctime 1 search for a file that was modified yesterday (more exactly between 24h ago and 48h ago). For a file that is modified today, use either -mtime 0 or -mtime -1 (same for -ctime).

Example:

$ find -name foo -mtime 1 -ctime 1

$ find -name foo -mtime 0 -ctime 0
./foo

$ find -name foo -mtime -1 -ctime -1
./foo
Related Question