How to Find Files Modified in the Last 24 Hours in Linux

When managing a Linux server or troubleshooting a compromised system, locating recently modified files is a critical administrative task. Whether you are searching for a configuration file you edited yesterday, tracking down a log file that just updated, or investigating potential security breaches, the Linux find command offers a precise way to locate files based on their timestamps.

Understanding Linux Timestamps

Before searching, it is helpful to understand how Linux tracks file time. Every file has three primary timestamps:

• mtime (Modification Time): The time the file’s contents were last changed. This is the most common metric used for finding recently updated files.
• ctime (Change Time): The time the file’s metadata (like permissions or ownership) was last changed.
• atime (Access Time): The time the file was last read or opened.

Step-by-Step: Finding Files Modified in the Last 24 Hours

The find command is incredibly powerful, and its -mtime flag allows you to search based on modification time.

1. Open your terminal application or connect via SSH.
2. Navigate to the directory where you want to begin your search, or simply use the root directory (/) to search the entire system.
3. Run the following command to find files modified in the last 24 hours (1 day):
   find /path/to/search -mtime -1

In this command:

• /path/to/search is where the search begins (e.g., /var/log).
• -mtime specifies we are filtering by modification time.
• -1 means “less than 1 day ago” (i.e., within the last 24 hours).

Advanced Usage: Searching by Minutes

If 24 hours is too broad a timeframe, you can search for files modified within the last few minutes using the -mmin flag.

To find files modified in the last 60 minutes, use:

find /path/to/search -mmin -60

This is particularly useful when you just installed a package or ran a script and need to see exactly which files were altered as a result.

Troubleshooting Common Issues

When using the find command across a large filesystem, you will likely encounter a few hurdles:

• Permission denied spam: If you search the entire root filesystem (/) as a standard user, your terminal will be flooded with “Permission denied” errors for directories you cannot access. To fix this, either run the command with sudo, or redirect the errors to a black hole by appending 2>/dev/null to your command. (e.g., find / -mtime -1 2>/dev/null).
• Confusing days with older files: Remember that -1 means less than one day ago. If you use +1, it means more than one day ago (older files). Using exactly 1 (no plus or minus) means exactly 24 to 48 hours ago.

Mastering time-based searches with the find command is an essential skill that significantly speeds up system administration and troubleshooting in Linux.