How to Find Files Accessed in the Last 24 Hours in Ubuntu Linux

The Security Audit Challenge

When auditing an Ubuntu Linux server for a potential security breach, looking at when files were modified is often not enough. A clever attacker might read a sensitive configuration file containing database passwords without ever changing the file itself. To discover if unauthorized eyes have been snooping through your data, you must search the filesystem based on when files were last accessed (read). Scanning a massive directory structure manually for access timestamps is impossible. You must use the terminal to instantly filter files based on this specific metric.

Using the find Command with -atime

The standard Linux find command utilizes the -atime (Access Time) flag specifically for this type of security auditing.

1. Open your Terminal application (Ctrl + Alt + T) or log into your server via SSH.
2. Determine the directory you want to audit. For this example, we will check a user’s home directory.
3. Type the following command:
4. sudo find /home/username/ -type f -atime -1
5. Press Enter and provide your administrator password.

How the Command Works

• sudo ensures you have the permissions necessary to read the metadata of every file in the folder.
• -type f restricts the search strictly to files, ignoring directories.
• -atime -1 is the critical filter. It stands for “Access Time.” The -1 means “less than 1 day (24 hours) ago.”

A Critical Warning About Modern Linux

To improve hard drive performance and reduce wear on SSDs, many modern Linux filesystems (like ext4) are mounted with an option called relatime. This means the system does not update the access timestamp every single time a file is read, only when the file is modified. If your server uses relatime, the -atime command will not be perfectly accurate for security auditing. To guarantee accurate access tracking, you would need to remount your filesystem with the strictatime flag, though this will significantly decrease server performance.