The Linux find command is arguably the most powerful search utility available in any operating system. While most users rely on it to search for files by name, its true strength lies in its ability to filter files based on metadata, such as file size, permissions, and timestamps.
Locating files based on when they were last modified is essential for system administration tasks, such as finding recently changed configuration files, identifying compromised files after a security breach, or isolating old log files for deletion.
Understanding the Modification Time (-mtime) Flag
To search by modification date, we use the -mtime flag. This flag calculates time in 24-hour intervals (days) relative to the exact moment the command is executed.
The -mtime flag requires a numerical argument, which can be prefixed with a plus (+) or a minus (-) sign to change the logic.
-mtime N: Exactly N days ago (a very strict 24-hour window).-mtime -N: Less than N days ago (modified recently).-mtime +N: More than N days ago (modified a long time ago).
Example 1: Finding Files Modified in the Last 7 Days
If you want to find all files in the /var/log/ directory that have been modified within the last 7 days, you use the minus (-) operator.
find /var/log/ -type f -mtime -7
/var/log/: The starting directory for the search.-type f: Restricts the search to files only (ignores directories).-mtime -7: Modified less than 7 days ago.
Example 2: Finding Files Older Than 30 Days
To find files that have not been touched for a long time—perhaps to archive them or clear disk space—you use the plus (+) operator.
find /home/user/downloads/ -type f -mtime +30
This command finds all files in the downloads folder that were last modified more than 30 days ago.
Searching by Minutes (-mmin)
If you need granular precision, such as finding a configuration file you edited just a few minutes ago but cannot remember where you saved it, measuring by days is useless. Instead, use the -mmin flag, which operates exactly like -mtime but calculates time in minutes.
To find all files in the /etc/ directory modified in the last 60 minutes:
find /etc/ -type f -mmin -60
Combining Time Flags with Actions
The true power of find is chaining a search query into an immediate action using the -exec flag or the -delete flag.
Warning: Use extreme caution with the -delete flag, as it bypasses the trash bin and permanently removes files.
To automatically find and delete all files in the /tmp/ directory that are older than 14 days, run:
find /tmp/ -type f -mtime +14 -delete
It is always highly recommended to run the command without the -delete flag first to review the list of files that will be destroyed.