The Audit Trail
In Ubuntu Linux, the operating system tracks three different timestamps for every file: when it was modified (mtime), when its status changed (ctime), and when it was last accessed (atime). The access time is updated every time a file is opened and read by a user or an application, even if the file’s contents are not altered. If you are investigating a potential security breach or attempting to determine exactly which configuration files were loaded by a web server on a specific date, you must instruct the Linux search engine to filter files based exclusively on their access history.
Using the find Command with -atime
The Linux find command utilizes the -atime flag (access time) to isolate files based on 24-hour blocks of time stretching backward from the exact moment you run the command.
- Open your Terminal application (Ctrl + Alt + T) or log into your server via SSH.
- To scan the
/var/log/directory and return files that were accessed exactly 7 days ago, type the following command exactly:find /var/log/ -type f -atime 7 - Press Enter.
The 24-Hour Window
The number you provide to the -atime flag is highly specific. When you specify 7 (without a plus or minus sign), the find command does not look for files accessed within the last 7 days. Instead, it looks for files accessed in the strict 24-hour window that occurred exactly between 168 hours and 192 hours ago. This allows for incredibly precise historical auditing of user activity on the server.