The Daily Audit
If you manage an Ubuntu Linux server, one of the most critical troubleshooting steps after a system failure or a suspected security breach is auditing exactly what changed on the hard drive immediately before the event occurred. Digging through log files manually is often too slow. Instead, you need a way to instantly generate a list of every single file that was created or modified within the last day. The Linux kernel tracks these modification timestamps meticulously, and you can query them directly using the command line.
Using the find Command with -mtime
The Linux find command utilizes the -mtime (Modified Time) flag specifically for filtering files based on 24-hour blocks.
- Open your Terminal application (Ctrl + Alt + T) or log into your server via SSH.
- To search the entire server (
/) for files modified within the last 24 hours, type the following command exactly: sudo find / -type f -mtime -1- Press Enter and provide your administrator password.
Understanding the Syntax
The minus sign (-1) is the most important part of the command. It instructs the terminal to look backward from the current exact moment to exactly one 24-hour block ago. The system will output a massive list of file paths. If you want to expand the search window, simply increase the number:
-mtime -7will find every file modified in the last 7 days (168 hours).-mtime +30(using a plus sign) will find files that have not been modified in over 30 days, which is useful for finding stale data that can be safely deleted.