find modified files between two dates

Written by Peter Davies on .

Trying to identify the culprit of some modified files we needed a linux command to locate file changes between two dates, far in the past.

Most examples I found showed doing this using files created with the date range you needed:

touch --date "2013-04-01" /tmp/dtfrom
touch --date "2013-05-25" /tmp/dtto
find ./ -type f -newer /tmp/dtfrom ! -newer /tmp/dtto -exec ls -s {} \; -print

This can also be achieved using the simpler "newermt" parameter (assuming your findutils is new enough):

find ./ -type f -newermt 2013-04-01 ! -newermt 2013-05-25 -exec ls -hal {} \;

You can also check for permission changes, access dates too:

  • For accessed dates use the -newerat 2013-04-01
  • For permissions use the -newerct 2013-04-01

If you don't change permissions on the file, 'c' would normally correspond to the creation date, though.