How to Find Files Modified Between Specific Dates in Linux Using the find Command

A Practical Guide to Search Files by Modification Time in Modern Linux Distributions

When working with Linux servers, you may need to locate files that were created, accessed, or modified during a particular period.

For example, you might want to:

• Find files modified today or yesterday.
• Identify files changed during the last 24 hours.
• Search for files modified between two specific dates.
• Locate recently updated configuration files.
• Find old log files and safely delete them.
• Automate file cleanup using cron jobs or shell scripts.

The Linux

find

command provides a powerful and flexible way to perform all these operations.

In this tutorial, we’ll explore practical examples of searching for files by modification date using GNU

find

, available on modern Linux distributions such as Ubuntu, Debian, Fedora, Rocky Linux, AlmaLinux, and Arch Linux.

1. Understanding File Timestamps in Linux

Before searching for files, it’s important to understand the three main timestamps maintained by Linux filesystems.

mtime

atime

ctime

Important:

ctime

does not represent file creation time. It tracks inode status changes, including permission changes, ownership changes, and content modifications.

Some filesystems also support a creation timestamp, often called

btime

or birth time, but its availability is not guaranteed.

To inspect a file’s timestamps, use:

stat /var/log/syslog

You can also check your installed GNU

find

version:

find --version

The examples below use GNU Findutils functionality commonly available on current Linux distributions.

2. Find Files Modified During the Last 24 Hours

To find regular files modified within the last 24 hours:

find /path/to/directory -type f -mtime -1

Explanation:

• find

  searches a directory hierarchy.

• /path/to/directory

  specifies the search location.

• -type f

  restricts results to regular files.

• -mtime -1

  matches files modified less than one 24-hour period ago.

For example:

find /var/www/html -type f -mtime -1

This command searches for files modified within the last 24 hours under

/var/www/html

.

Note: The last 24 hours and the current calendar day are not the same thing.

If you execute this command at 3:00 PM, it includes modifications made since approximately 3:00 PM yesterday.

3. Find Files Modified Today

To find files modified since midnight today:

find /path/to/directory -daystart -type f -mtime 0

The

-daystart

option changes the reference point for time calculations to the beginning of the current day.

For example:

find /var/www/html -daystart -type f -mtime 0

Alternatively, use explicit date boundaries:

find /var/www/html -type f \
  -newermt "$(date +%F)" \
  ! -newermt "$(date -d 'tomorrow' +%F)"

The second example uses strict timestamp comparisons. As written, it can include a file modified exactly at tomorrow’s midnight. For a precise half-open calendar-day interval, use

-newermt

with a lower boundary adjusted for strict comparison, or the

-daystart

method above.

4. Find Files Modified Yesterday

To search for files modified during the previous calendar day:

find /path/to/directory -daystart -type f -mtime 1

Example:

find /var/log -daystart -type f -mtime 1

This searches for regular files whose modification times fall within yesterday’s calendar day.

It is particularly useful when investigating application errors or reviewing recently updated logs.

5. Find Files Modified Exactly N Days Ago

GNU

find

supports searching by file age using

-mtime

.

For example:

find /path/to/directory -type f -mtime 7

This finds files whose modification timestamps are between 7 and 8 days old, measured in complete 24-hour periods.

GNU

find

rounds down the number of elapsed 24-hour periods before comparing the result.

The following table summarizes the syntax:

-mtime 0

-mtime 1

-mtime 7

-mtime -7

-mtime +7

Be careful with

+N

: because of rounding,

-mtime +7

is not the correct choice if you need to include every file older than exactly 168 hours.

For that requirement, use:

find /path/to/directory -type f -mmin +10080

This selects files older than 10,080 complete minutes, effectively requiring more than 10,081 minutes because of the same integer rounding behavior.

For precise second-level boundaries, prefer timestamp-based comparisons.

6. Find Files Modified Between Two Specific Dates

One of the most useful features of modern GNU

find

is the

-newermt

option.

For example, to find files modified between October 1 and October 15, 2026:

find /var/www/html -type f \
  -newermt "2026-10-01" \
  ! -newermt "2026-10-16"

This searches for files modified after midnight on October 1 and no later than midnight on October 16.

For most practical investigations, this provides the intended date range, although the exact midnight boundaries should be considered when precision matters.

You can also specify times:

find /var/www/html -type f \
  -newermt "2026-10-01 08:00:00" \
  ! -newermt "2026-10-01 18:00:00"

This is useful when investigating changes during a deployment or maintenance window.

Tip:

-newermt

interprets date strings according to the applicable timezone. Check your system timezone using:

timedatectl

If your server stores logs in UTC but your deployment schedule uses local time, explicitly account for that difference.

7. Find Files Modified During the Last N Minutes

For shorter time intervals, use

-mmin

.

Find files modified within the last 30 minutes:

find /var/www/html -type f -mmin -30

Find files modified within the last 60 minutes:

find /etc -type f -mmin -60

Find files modified between approximately 30 and 60 minutes ago:

find /var/www/html -type f \
  -mmin +29 \
  -mmin -61

These commands can be helpful when diagnosing unexpected configuration changes or investigating a recent application deployment.

8. Find Recently Modified Files by Extension

You can combine modification-time filters with filename patterns.

Find PHP files modified during the last 24 hours:

find /var/www/html -type f \
  -name "*.php" \
  -mtime -1

Find configuration files modified during the last seven days:

find /etc -type f \
  -name "*.conf" \
  -mtime -7

Find recently modified log files:

find /var/log -type f \
  -name "*.log" \
  -mtime -1

Use

-iname

instead of

-name

for case-insensitive filename matching.

9. Display File Modification Dates in Search Results

By default,

find

prints matching file paths.

To display modification timestamps alongside filenames, use

-printf

:

find /var/www/html -type f -mtime -1 \
  -printf '%TY-%Tm-%Td %TH:%TM:%TS %p\n'

Example output:

2026-11-01 09:15:23.0000000000 /var/www/html/index.php
2026-11-01 10:42:11.0000000000 /var/www/html/config.php
2026-11-01 11:05:49.0000000000 /var/www/html/api.php

To sort the output chronologically:

find /var/www/html -type f -mtime -1 \
  -printf '%T@ %TY-%Tm-%Td %TH:%TM:%TS %p\n' |
sort -n

The

%T@

format produces the modification timestamp as seconds since the Unix epoch, making numeric sorting possible.

For filenames containing newlines, consider using null-delimited output and tools that support it rather than relying on line-oriented processing.

10. Find Files Older Than a Specified Period

Finding old files is particularly useful for log rotation, backup maintenance, and disk-space management.

For example, to find files at least eight days old according to GNU

find

‘s complete-day calculation:

find /var/log/myapp -type f -mtime +7

To find files older than 30 complete 24-hour periods:

find /var/backups -type f -mtime +29

Remember that

-mtime

works with rounded-down 24-hour periods.

For precise retention policies, use explicit date or timestamp boundaries instead of assuming that

-mtime +N

means exactly N days.

11. Safely Delete Old Files

The

find

command can also remove matching files.

However, deleting files based on their modification time requires extra care, especially on production servers.

Step 1: Preview matching files

Before deleting anything, list the files:

find /var/log/myapp -type f \
  -name "*.log" \
  -mtime +29 \
  -print

Review the output carefully.

Step 2: Delete matching files

Once you’ve confirmed the results:

find /var/log/myapp -type f \
  -name "*.log" \
  -mtime +29 \
  -delete

The

-delete

action removes matching files without starting a separate

rm

process for every file.

Warning: Deletion is irreversible through normal shell operations. Do not run cleanup commands against critical system directories without verifying the paths and conditions.

Also note that

-delete

implies depth-first traversal. Avoid combining it carelessly with

-prune

.

Alternative: Delete files using

-exec

You can also use:

find /var/log/myapp -type f \
  -name "*.log" \
  -mtime +29 \
  -exec rm -v -- {} +

Here:

• -exec

  runs an external command.

• rm -v

  removes files and displays their names.

• --

  prevents filenames beginning with hyphens from being interpreted as options.

• {}

  represents matching file paths.

• +

  groups multiple files into fewer command executions.

For directories that other users can modify concurrently, GNU

find

also provides

-execdir

, which can reduce certain path-related security risks.

For simple file deletion,

-delete

is generally preferable.

12. Find Modified Files Without Searching Subdirectories

By default,

find

searches recursively.

To limit the search to the specified directory:

find /var/www/html -maxdepth 1 \
  -type f \
  -mtime -1

The

-maxdepth 1

option prevents traversal into subdirectories.

You can also limit recursion to a particular depth:

find /var/www/html -maxdepth 2 \
  -type f \
  -mtime -1

This can reduce unnecessary filesystem traversal when searching large directory structures.

13. Practical Example: Find Files Changed After a Deployment

Suppose you deployed a PHP application on November 1, 2026, at 10:00 AM.

To identify files modified after that time:

find /var/www/myapp -type f \
  -newermt "2026-11-01 10:00:00" \
  -printf '%TY-%Tm-%Td %TH:%TM:%TS %p\n'

This can help identify:

• Updated PHP application files.
• Modified configuration files.
• Generated cache files.
• Unexpected changes made after deployment.

For a more targeted investigation:

find /var/www/myapp -type f \
  -name "*.php" \
  -newermt "2026-11-01 10:00:00"

Keep in mind that modification timestamps alone cannot establish who changed a file or why. For reliable deployment auditing, combine filesystem checks with Git history, deployment logs, and appropriate audit mechanisms.

14. Automating File Cleanup with Cron

You can automate periodic cleanup using cron.

For example, create a dedicated directory for disposable application logs:

sudo mkdir -p /var/log/myapp/archive

Then configure a cron job:

sudo crontab -e

Example cron entry:

0 3 * * * /usr/bin/find /var/log/myapp/archive -type f -name '*.log' -mtime +29 -delete

This runs daily at 3:00 AM according to the cron daemon’s configured timezone.

It removes matching archived

.log

files according to the specified age condition.

Before enabling such a job, verify that the directory contains only files intended for automated deletion.

Production recommendation: Prefer the application’s supported log-retention mechanism or

logrotate

for active application logs. Avoid deleting files that are still open for writing, because removing their directory entries may not immediately release disk space.

15. Common Mistakes When Using

find

Several mistakes can produce unexpected results.

Mistake 1: Confusing

-mtime 1

with yesterday

Without

-daystart

, this means files modified between 24 and 48 hours ago, not necessarily yesterday.

Mistake 2: Assuming

-mtime +7

means strictly older than seven days

GNU

find

rounds the elapsed number of 24-hour periods down before comparing it with the requested value.

Mistake 3: Deleting files without reviewing the results

Always test the same selection criteria with

-print

before adding

-delete

.

Mistake 4: Confusing

ctime

with creation time

ctime

refers to inode status changes, not file creation.

Mistake 5: Ignoring timezone differences

Date-based searches may produce unexpected results when a server operates in UTC but administrators expect local time.

Mistake 6: Assuming file modification timestamps are immutable

Tools such as

touch

can modify timestamps, and file-copying or deployment tools may preserve original modification times.

16. Quick Reference: Linux

find

Time Filters

find /dir -type f -mtime -1

find /dir -daystart -type f -mtime 0

find /dir -daystart -type f -mtime 1

find /dir -type f -mtime 7

find /dir -type f -mtime -7

find /dir -type f -mtime +7

find /dir -type f -mmin -30

find /dir -type f -newermt "2026-10-01"

find /dir -type f -mtime +7 -delete

Replace

/dir

with the directory you want to search.

Conclusion

The Linux

find

command is an essential tool for system administrators, DevOps engineers, and developers who need to locate files based on modification timestamps.

For everyday searches,

-mtime

and

-mmin

provide convenient time-based filtering.

For calendar-day searches,

-daystart

makes the results easier to interpret.

When you need precise date and time boundaries,

-newermt

offers greater flexibility.

And when cleaning up old files, always preview your results before using

-delete

or

-exec rm

.

By combining these features, you can efficiently investigate filesystem changes, troubleshoot deployments, manage logs, and automate maintenance tasks across modern Linux environments.

References

• GNU Project — GNU Findutils Manual: https://www.gnu.org/software/findutils/manual/html_node/
• GNU Project — Deleting Files: https://www.gnu.org/software/findutils/manual/html_node/find_html/Deleting-Files.html
• Debian —

  find(1)

  Manual: https://manpages.debian.org/trixie/findutils/find.1.en.html

Documentation reviewed: November 1, 2026. Examples target GNU Findutils rather than BSD/macOS

find

or BusyBox implementations.