17.8 Exact File Time Comparisons

One problem with find's time operators (17.5, 17.7) (-atime and its brethren) is that they don't allow very exact comparisons. They only allow you to specify time to within a day. Sometimes that's just not good enough. You think that your system was corrupted at roughly 4 p.m. yesterday (March 20); you want to find any files that were modified after that point, so you can inspect them. Obviously, you'd like something more precise than "give me all the files that were modified in the last 24 hours."

Some versions of touch (21.7), and other freely available commands like it, can create a file with an arbitrary timestamp. That is, you can use touch to make a file that's backdated to any point in the past (or, for that matter, postdated to some point in the future). This feature, combined with find's -newer operator, lets you make comparisons accurate to one minute or less.

For example, to create a file dated 4 p.m., March 20, give the command:

/tmp	% touch 03201600 /tmp/4PMyesterday

Then to find the files created after this, give the command:

% find . -newer /tmp/4PMyesterday -print

What about "older" files? Older files are "not newer" files, and find has a convenient NOT operator (!) for just this purpose. So let's say that you want to find files that were created between 10:46 a.m. on July 3, 1982, and 9:37 p.m. on August 4, 1985. You could use the following commands:

% touch 0703104682 /tmp/file1
% touch 0804213785 /tmp/file2
% find . -newer /tmp/file1 ! -newer /tmp/file2 -print
% rm /tmp/file[12]