[SOLVED] Recent files in Linux.

hack3rcon · 07-16-2017, 01:27 AM

Hello.
Has Linux any recent files? I like to know when I'm not at the desk then which files viewed by others.

Thank you.

syg00 · 07-16-2017, 02:08 AM

If you are not at your machine, no-one should be able to access anything.
What did you web search return ?.

pan64 · 07-16-2017, 03:42 AM

at first you can lock your computer, so noone can use it without your password.
Next, nowadays the PCs connected to the network, so one can reach your PC without sitting at your desk.
finally the system (running programs) may write files anywhere (like logs or anything else) without a keypress, without logged in users (human beings).

dejank · 07-16-2017, 03:52 AM

You can find recently accessed files with, what a surprise, find command. For example:

Code:

find . -user username -type f -amin -60

will show you all files, but not directories, owned by username that were accessed in the last 60 min in working directory. Instead of that . use path to directory that you wish to examine. For some more insight of how find command works, you can read man page, or/and visit this page: https://www.tecmint.com/35-practical...-find-command/.

aragorn2101 · 07-17-2017, 01:17 AM

Yup, you can do this easily with the find command. There are a few flavours for the access times and modified times:

Code:

find $HOME -type f TIME_ARG

###  TIME_ARG can be (for example):

-amin -120
  file was last accessed less than 120 minutes ago. The "less than" is indicated by the minus sign in front of the number.
-atime -1
  file was last accessed less than 1 day ago.
-mmin -45
  file was last modified less than 45 minutes ago.
-mtime -0.5
  file was last modified less than half a day ago (less than 12 hours).

But as syg00 said, no one should be accessing your files when you're not there. Create separate user profiles for every user, set password and encrypt your home directory.

MadeInGermany · 07-18-2017, 01:11 AM

The atime works in Unix only.
In Linux since kernel 2.6.30 the default mount option is relatime, so find -amin and ls -lu are not reliable.
The atime is updated if it were off by more than 1 day, so frequent access can still be seen with -atime -1.
If you want to use reliable atime in Linux you need to explicitly mount with option strictatime.

hack3rcon · 07-23-2017, 01:05 AM

I opened a file but "find $HOME -type f -amin 1" not show it !!!

Code:

$ find $HOME -type f -amin 1
/home/mohsen/.config/google-chrome/Default/Preferences
/home/mohsen/.config/google-chrome/Local State
/home/mohsen/.config/dconf/user

dejank · 07-23-2017, 02:31 AM

Quote:

Originally Posted by hack3rcon

I opened a file but "find $HOME -type f -amin 1" not show it !!!

Code:

$ find $HOME -type f -amin 1
/home/mohsen/.config/google-chrome/Default/Preferences
/home/mohsen/.config/google-chrome/Local State
/home/mohsen/.config/dconf/user

You want -amin -1, not -amin 1. Read man page of find, please. There is explanation there for time units and difference between +n, -n and n.

JJJCR · 07-24-2017, 04:21 AM

check out this link you might get some idea:

https://askubuntu.com/questions/4700...rough-terminal

hack3rcon · 07-26-2017, 02:35 AM

Quote:

Originally Posted by JJJCR

check out this link you might get some idea:

https://askubuntu.com/questions/4700...rough-terminal

Thank you. Below command shows me the result that I wanted.

Code:

$ sed -nr 's/.*href="([^"]*)".*/\1/p' ~/.local/share/recently-used.xbel