LinuxQuestions.org - [SOLVED] find only new created files from certain date => display folder and path only

- Linux - Newbie (https://www.linuxquestions.org/questions/linux-newbie-8/)

- - find only new created files from certain date => display folder and path only (https://www.linuxquestions.org/questions/linux-newbie-8/find-only-new-created-files-from-certain-date-%3D-display-folder-and-path-only-910158/)

find only new created files from certain date => display folder and path only

Hello, I seem to be having problems constructing the correct syntax for finding only newly created files from a certain date.

The command "must" (in my ideal situation):

display output must only be path and filename, nothing else
find onlynewly created files, not the modified ones
able to omit (exclude) directories, the command will run from the root point => /
able to pipe it to an second command (e.g. delete the results / append to text file / ...)
must also find newly created hidden files
must also find newly created (hidden) folders
able to specify a date from which to find the newly created files/folders (e.g. 20th October 2011 => 20-10-2011 , this last point is a luxury thing but if it can be implemented it would be great, if not, a "# days back" method is also good!

I only got this:

find ./ -type f -mtime -4 -exec ls -al {} \;
It finds newly created AND modified files up to 4 days back.

I am afraid my specifications forces the the above only to be possible in a BASH script, if that is the case, a kick in the right direction would be very welcome (or dare I ask, a fully working example for me to modify to my own needs)

Many thanks in advance!

If your file system supports it, you could use something like:

Code:

find / -newerBt "2011-10-25 21:00:00"

But ext3, for example, only stores modification (mtime), attribute modification (ctime), and access (atime), so if you're using ext3 you won't be able to distinguish modified from created.

--Bryan

Extending the above, there is NO create time in Unix

Quote:

Three fields in the inode structure contain the last access, change, and modification times: atime, ctime, and mtime. The atime field is updated each time the pointer to the file's data blocks is followed and the file's data is read. The mtime field is updated each time the file's data changes. The ctime field is updated each time the file's inode changes. The ctime is not creation time; there is no way under standard Unix to find a file's creation time.

Perl Cookbook; see also https://secure.wikimedia.org/wikipedia/en/wiki/Inode

The very informative man page for 'find' is here http://linux.die.net/man/1/find
I'd prob start with a simple find cmd and append some other bash cmds if required; easier to debug than all in one line eg

Code:

for file in $(find / ....)

do

  other chks here ...

done

You may(?) be able to do it with just find (except for 'create' as explained)

Good bash tutorials
http://rute.2038bug.com/index.html.gz
http://tldp.org/LDP/Bash-Beginners-G...tml/index.html
http://www.tldp.org/LDP/abs/html/

Welcome to LQ :)

Thank you Bryan and Chris,

After trying the command provided by Chris I got the following message:
"This system does not provide a way to find the birth time of a file."

Which led me to search on: "linux birth time of a file" => I did a google search and came back on linuxquestions :) on the following topic:
http://www.linuxquestions.org/questi...-linux-473684/

After reading Bryan's comment I see the "lmitation" and I can use those provided links!
Thanks!

If it's alright I want to keep this topic open for a few more days and then close it, maybe someone else has some tips/work-arounds?
I'll close it friday if this is ok?

Thanks again!

I'm afraid even w/ scripting you won't have much fun as Linux
doesn't know anything about creation time-stamps. If they
are crucial for whatever you're doing you may want to use
kernel auditing, or maybe an inotify-script to keep track of
creations, and write those to an easily parseable file.

Cheers,
Tink

No use to keep this open, thanks everyone for the info.
Looks like I have to take a different route.