How to Use the find Command to Locate Files Modified in the Last 24 Hours in Linux

When you are managing a massive Linux server containing millions of system files, tracking down a specific script you were editing yesterday can be incredibly frustrating if you forgot the exact filename and directory. While the standard find command is usually used to search for names, it possesses a massive suite of advanced time-based flags. You can instruct the Linux terminal to completely ignore filenames and strictly hunt for files based on the exact minute they were last modified.

How the Time Flags Work

The find command tracks three distinct timestamps for every single file on a Linux system:

• mtime (Modification Time): The last time the actual contents of the file were edited or changed.
• atime (Access Time): The last time the file was opened or read by a user or script.
• ctime (Change Time): The last time the file’s metadata, permissions, or ownership were altered.

To find files you actively edited yesterday, you must use the mtime (modification) flag.

Step-by-Step Instructions

1. Open your Linux terminal.
2. If you want to search your entire system, you will start the command at the root directory (/). If you only want to search your personal home folder, you will start at ~.
3. Type the following command to locate every file modified within the last 24 hours (1 day):

find /path/to/search -mtime -1

For example, to search your entire home directory for files you edited within the last 24 hours, you would type:

find ~ -mtime -1

4. Press Enter.

Understanding the Math

The number you provide after the -mtime flag represents blocks of 24 hours, and the plus or minus sign dictates the direction in time.

• -mtime -1 means modified less than 1 day ago (within the last 24 hours).
• -mtime 1 (without a sign) means modified exactly 24 to 48 hours ago.
• -mtime +1 means modified more than 1 day ago (older than 48 hours).

Searching by Exact Minutes

If searching by 24-hour blocks is too broad, you can switch to the mmin flag, which operates on exact minutes.

To find a configuration file that you know you broke within the last 15 minutes, you would type:

find /etc -mmin -15

The terminal will instantly output a highly targeted list of every single file in the /etc directory that has had its contents altered in the last 900 seconds, allowing you to instantly locate and repair your mistake.