The Creation Timestamp
Every file in an Ubuntu Linux file system maintains a “change time” (ctime) metadata tag. This timestamp specifically tracks exactly when the file’s metadata was changed, which heavily correlates to when the file was first created or moved onto the system. When dealing with a rapidly expanding log directory or auditing a massive backup folder, you frequently need to isolate only the files that were generated recently. To do this, you must instruct the Linux search engine to filter the filesystem based specifically on the ctime metadata.
Using the find Command with -ctime
The Linux find command utilizes the -ctime flag to instantly isolate files based on how many 24-hour periods have passed since they were created or their permissions were altered.
- Open your Terminal application (Ctrl + Alt + T) or log into your server via SSH.
- To scan the
/var/backups/directory and explicitly return only files that were created within the last 3 days, type the following command exactly: sudo find /var/backups/ -type f -ctime -3- Press Enter and provide your administrator password.
Targeting Old Files
You can flip the modifier from a minus (-) to a plus (+) to search for old data. For example, running find /home/user/Downloads/ -type f -ctime +90 will scan your Downloads folder and output a list of any file that has existed on your hard drive for more than 90 days (roughly three months). This is an incredibly powerful way to find ancient, forgotten files and safely delete them to reclaim storage space without accidentally touching anything you downloaded recently.