Time & Size Predicates

Files modified in the last 24 hours
find ~/atelier/_bibliotheca/domus-captures/docs -name "*.adoc" -mtime 0 -type f
Files modified more than 30 days ago
find /var/log -name "*.log" -mtime +30 -type f 2>/dev/null | head -10
Files modified in the last 60 minutes
find ~/atelier/_bibliotheca/domus-captures -name "*.adoc" -mmin -60 -type f
Files NOT accessed in the last 90 days
find /var/log -atime +90 -type f 2>/dev/null | head -10
Files newer than a reference file
touch -t 202604010000 /tmp/ref-timestamp
find ~/atelier/_bibliotheca/domus-captures/docs -newer /tmp/ref-timestamp -name "*.adoc" -type f | head -10
Files larger than 50K
find ~/atelier/_bibliotheca/domus-captures -size +50k -type f | head -10
Files smaller than 1K — likely stubs or empty shells
find ~/atelier/_bibliotheca/domus-captures/docs/modules/ROOT/partials -size -1k -type f -name "*.adoc"
Files between 10K and 100K
find ~/atelier/_bibliotheca/domus-captures/docs -size +10k -size -100k -type f -name "*.adoc"
Empty files
find ~/atelier/_bibliotheca/domus-captures/docs/modules/ROOT -empty -type f
Empty directories — candidates for cleanup
find ~/atelier/_bibliotheca/domus-captures/docs/modules/ROOT -empty -type d

The Three Timestamps

Every file has three timestamps. ls only shows mtime. stat shows all three.

Flag Timestamp What triggers it Fakeable?

-mtime

modification

write() — content changed

Yes (touch -t)

-atime

access

read() — content read

Yes (touch -a)

-ctime

change

Inode metadata changed (permissions, owner, rename, link count, or content)

No

ctime is the honest timestamp — it updates on any inode change and cannot be set manually. If mtime and ctime diverge significantly, someone used touch(1) to backdate the file.

Show all three timestamps for a single file
stat /etc/ssh/sshd_config
Just the modify time — compact format
stat -c '%y %n' /etc/ssh/sshd_config
All three in one line — compare at a glance
stat -c 'A:%x  M:%y  C:%z  %n' /etc/ssh/sshd_config

-printf — Custom Output with Sorting

find -printf eliminates the need to pipe through ls or stat. Sortable, scriptable, precise.

Recently modified files, newest-first, with timestamps
find . -maxdepth 3 -type f -mtime -7 -printf '%T+ %p\n' | sort -r | head -20

%T+ = YYYY-MM-DD+HH:MM:SS.nnnnnn — ISO-sortable, sub-second precision.

Size + time + path — find the largest recent changes
find . -type f -mtime -7 -printf '%s\t%T+\t%p\n' | sort -rn | head -20
Permissions + owner + time + path — mini ls -lt
find . -type f -mtime -3 -printf '%M %u %T+ %p\n' | sort -k3 -r
Files modified today only — not "last 24 hours"
find . -type f -printf '%TY-%Tm-%Td %p\n' | awk -v today="$(date +%F)" '$1 == today'
-mtime 0 means "last 24 hours." -newermt "$(date +%F)" means "since midnight today." The awk approach above gives the same precision as -newermt but works on older find versions.

-newerXY — Timestamp Comparisons

The X is which timestamp to test, Y is the reference type. Both are one of: a (access), m (modify), c (change), t (explicit time string).

Files modified since midnight today
find . -name "*.adoc" -type f -newermt "$(date +%F)"
Files modified between two dates
find . -type f -newermt "2026-05-01" ! -newermt "2026-05-15"
Files whose ctime is newer than their mtime — something touched the inode after content was last written
find . -type f -newercm . -printf '%C+ ctime | %T+ mtime | %p\n' 2>/dev/null | head -20

Forensic — Detecting Timestamp Manipulation

When mtime and ctime are on different dates, either the file was moved/renamed, permissions changed, or someone used touch to set a false modification time. ctime always tells the truth.

Find files where ctime and mtime dates diverge
sudo find / -maxdepth 3 -type f -printf '%C+ ctime | %T+ mtime | %p\n' 2>/dev/null \
  | awk -F'|' '{split($1,c," "); split($2,m," "); if(c[1] != m[1]) print}' \
  | head -20
Files with mtime in the past but ctime recent — possible backdating
find /etc -type f -printf '%Cs %Ts %p\n' 2>/dev/null \
  | awk '$1 - $2 > 86400 {print strftime("%F",  $1), "ctime |", strftime("%F", $2), "mtime |", $3}'

%Cs and %Ts are epoch seconds — arithmetic comparison, then strftime for human display.