Regarding equating file attributes in "ls" command

t@sh · 06-18-2016, 08:42 AM

I have a folder in which there are thousands of images. Of those thousand images, I want to bring together all those images whose “Last created” and “Last modified” attributes are exactly same.
( In other words, I want to separate all the images I didn’t ever rename for example )

Is there a way to do this from terminal ?

these are the two commands that I want to concatenate
ls -tU lists file by creation date. (I'm on a mac)
ls -lt lists file by modified date

such that I want to
"List files whose date created = date modified"

grail · 06-18-2016, 09:07 AM

Try the find command?

Turbocapitalist · 06-18-2016, 09:46 AM

If you are using a file system that supports "time of file birth" in "stat" then you can do it. But as far as I know, EXT4 and HFS+ don't. You can check with "stat" on a file:

Code:

stat -c "%Y %W" ./somefile

That will print out two numbers, if the second is zero then you cannot find the creation time of the file and you'll have to try a different approach. If the second number is not zero, then you can do it if you make "find" jump through some hoops with the option -exec and the program "test"

keefaz · 06-18-2016, 10:45 AM

[specific to OSX]

There is mdls command

Code:

mdls file..

You can select information with (for example)

Code:

mdls -name kMDItemFSCreationDate -name kMDItemFSContentChangeDate file...

But really I think you should just compare last modified with last changed, which is more meaningfull imo

Code:

stat -f "%m %c" file...

jpollard · 06-18-2016, 12:33 PM

The usual problem is that no two files are created at "exactly the same time".

If you look at the file dates using the stat command, you will see timestamps into the nanosecond range - thus the dates are almost guaranteed to be unique.

Depending on how the files are modified/backed up/restored the modified timestamp MAY be recorded to the second.

But the access/creation/birth (if recorded) will be to the nanosecond.

keefaz · 06-18-2016, 04:11 PM

Just tested in an OSX box, this seems to work:

Code:

cd directory
stat -f "%c:%a:%N" * | awk -F: '$1 != $2 {print $3}'

%c: time when the inode was last changed
%a: time when file was last accessed
%N: file name

jpollard · 06-18-2016, 04:40 PM

Quote:

Originally Posted by keefaz

Just tested in an OSX box, this seems to work:

Code:

cd directory
stat -f "%c:%a:%N" * | awk -F: '$1 != $2 {print $3}'

%c: time when the inode was last changed
%a: time when file was last accessed
%N: file name

I don't know what you are looking for, but if you CHANGE a file, you are also ACCESSING the file...

Also note that some backup/restore facilities can set the changed and modification dates to whatever is desired...(see "touch" command), and neither has anything to do with created date (which is more properly called "inode modification date").

keefaz · 06-18-2016, 04:44 PM

I am looking at what was modified, but I was wrong

Quote:

Originally Posted by t@sh

such that I want to
"List files whose date created = date modified"

So, awk expression becomes:

Code:

stat -f "%c:%a:%N" * | awk -F: '$1 == $2 {print $3}'