[bash] Seeing if a file has been modified before/after a date

w3stfa11 · 10-13-2006, 11:47 PM

I can't seem to figure this simple thing out. There's this folder and stuff will be put inside of it. I want to find out if it was moved there after a certain day and time which are in the format, mm/dd/yy and hh:mm, although I can probably change the format. BTW, this is in Bash. I think I need to use ls -l --time-style="+%D %R" and then extract those two fields and compare that with the given date and time. I think I'm making this harder than it is. Can anyone help me out here? Can I use Date somehow? Thanks.

95se · 10-14-2006, 12:25 AM

I hate doing this, but man find ... I believe there is probably something there that will suit your needs.

jlinkels · 10-14-2006, 07:09 AM

Find is an alternative, but it assumes you already know the date you are looking for.

What I do is simple and dumb. I translate every time stamp into seconds using the date command, and then perform arithmetic with it.

If you want to know the date/time of a file, use the correct modifiers with the ls command, awk the fields what you want. Feed this into date and convert it to seconds.

jlinkels

ntubski · 10-14-2006, 10:20 AM

info find is generally more useful, I found this:

Quote:

2.3.2 Comparing Timestamps
--------------------------

As an alternative to comparing timestamps to the current time, you can
compare them to another file's timestamp. That file's timestamp could
be updated by another program when some event occurs. Or you could set
it to a particular fixed date using the `touch' command. For example,
to list files in `/usr' modified after February 1 of the current year:

touch -t 02010000 /tmp/stamp$$
find /usr -newer /tmp/stamp$$
rm -f /tmp/stamp$$

So you can use

Code:

touch --date='mm/dd/yy hh:mm' /tmp/stamp$$
find /folder -newer /tmp/stamp$$
rm -f /tmp/stamp$$

w3stfa11 · 10-14-2006, 12:16 PM

Quote:

Originally Posted by ntubski

info find is generally more useful, I found this:

So you can use

Code:

touch --date='mm/dd/yy hh:mm' /tmp/stamp$$
find /folder -newer /tmp/stamp$$
rm -f /tmp/stamp$$

Thank you ntubski very much. That will be perfect! Also thanks to jlinkels.

makyo · 10-14-2006, 12:23 PM

Hi.

If what you truly want is:

Quote:

Originally Posted by w3stfa11

I want to find out if it was moved there after a certain day and time

then you may be disappointed. There are 3 times associated with files:

Code:

"When we are talking about file times we refer to three unix
file times:

      Change time is defined as: "A change that modifies the
      file system i-node". We can use the example of "chmod
      a-w myfile" , "chown a-w myfile", etc.

      Modification time is defined as: "A modification modifies
      the contents of the file". We can use the example: echo
      foobar >> myfile.

      Access Time is defined as: "Access time is the last time
      the file was read or written". Example: "more myfile".

-- excerpt from http://www.linuxpowered.com/html/editorials/ls.html

So it's read (atime), write (mtime), and change administrative data (ctime). There is nothing about a move that would cause any of those times of a file to be changed.

However, there may be a way to approximate the time. Because you moved something into a directory, and a directory is a special kind of file, the mtime of the directory would reflect the last time a change occurred there. The mtimes of the source and target directories would be the important times.

If the files were moved into the directory at the same time, and if you made no subsequent changes to the directory, the time of the directory modification would be (about) the time of the move.

See man ls for details on listing the different times of the directory, but it would look something like:

Code:

ls -ld directory-path

the mtime is the default listing; you need to specify more to get the access time and change time (atime, ctime).

Another possibility is if you created the files and moved them shortly afterward into the directory and made no other changes to the files, then the mtime of the files would be close to when you moved them.

Best wishes ... cheers, makyo

( edit 1: clarify )

Tinkster · 10-14-2006, 02:56 PM

On that note: Tripwire or AIDE should help with these kinds of tasks.

Cheers,
Tink

w3stfa11 · 10-15-2006, 06:02 PM

Well I don't know if this changes things, but what I'll be doing is creating a tar and putting some files in it when I specify (could be any time any day) and then moving it onto that folder, upon which I'll compare the dates.

Example, my brother will specify some files, I'll TAR them and then move them onto the folder. I'll then compare if it's before or after a date.