Quote from HeelpBook on February 18, 2021, 12:39 am

The files modified in the past day are listed using the find command in Linux. To find easily files modified the past day we can run the following command:

find DIRECTORY -type f -mtime -1

The mtime parameter is the time of the file last modification, -1 is for the past 24 hours, considering between now and a day ago. The -type f parameter is used to only test the files of the directory. The -mtime -1 is the same as -mtime 0. The search will be not limited only the specific directory selected (it will also go through on sub-folders).

The following example list all the files that have been modified in the current directory:

$ find . -type f -mtime -1
./site/source/linux/interview/example1.txt
./site/source/linux/example2.properties
./site/source/linux/example3.txt

Note: This command can be used to on the directory / to investigate all the processes running, and which one has modified the configuration of the computer. Passing a different parameter can returns files that have been modified earlier, in the past week or past month for example.

Finally, the -mtime is not the only command switch available, but also -ctime and -atime (Change and Access time values), that can be used with the above command. Here a recap about these three switches:

• mtime, or modification time, is when the file was last modified. When you change the contents of a file, its mtime changes.
• ctime, or change time, is when the file's property changes. It will always be changed when the mtime changes, but also when you change the file's permissions, name or location.
• atime, or access time, is updated when the file's contents are read by an application or a command such as grep or cat.