How to show all files created on a specific date?

security search find files

23,694

To show all files created on 16/05/2015:

sudo find / -type f -newermt 2015-05-16

Now to see attributes such as owner, modification date, permissions easily use ls -l command:

sudo find / -type f -newermt 2015-05-16 | xargs ls -l

Thanks to muru note: same result can be achieved with:

sudo find / -type f -newermt 2015-05-16 -ls

Read this for more information on what ls -l means.

UPDATE To sort easily use -t option with ls (from newest to oldest)

sudo find / -type f -newermt 2015-05-16 | xargs ls -lt

If you want a reverse sort (from oldest to newest)

sudo find / -type f -newermt 2015-05-16 | xargs ls -ltr

And you can pipe it to tee to output in Terminal and in a log file too.

23,694

muru

Updated on September 18, 2022

Comments

muru over 1 year
On 16/05/2015 at 17:18 I visited a malicious website. And I suspect a drive-by-download, so I want to check my machine to see since that time in order of creation which files have been created or changed. And I know that I can use the find command to view files which have been changed, say, less than 3 days ago:
```
sudo find / -mtime -3
```
But I want it to be after that specific data and time that it shows me the file created and changed, I would also like it to show me it in the order in which these files have been created and/or changed, and one last thing which would be really useful is if it were to also (next to each result) show me the last modification date of that file. So is there any way of achieving this?

OS Information:
```
Description:    Ubuntu 15.04
Release:    15.04
```
Package Information:
```
findutils:
  Installed: 4.4.2-9build1
  Candidate: 4.4.2-9build1
  Version table:
 *** 4.4.2-9build1 0
        500 http://gb.archive.ubuntu.com/ubuntu/ vivid/main amd64 Packages
        100 /var/lib/dpkg/status
```
muru almost 9 years

find has an -ls option.
Admin almost 9 years

I am finding that it is outputting them in random order (or at least not in oldest-newest, or newest-oldest as I would like). How would you get it to output in one of these orders?
Maythux almost 9 years

@ParanoidPanda check the edit
Admin almost 9 years

It only shows back until May 18 19:32, so does this mean that it just had a limit to the time period it can show, or does it mean that all the stuff on my system was changed/created then, and after, and nothing before that still exists?
Maythux almost 9 years

This means last modified file on your system is on May 18 19:32
OlivierLarue almost 8 years

You can use datetime as well : find . -newermt '2016-07-26T12:00:00'.
user63274 over 6 years

This is really great but the results for me are too broad. It lists all the files that the applications or system has changed. I would like to JUST list those that I have modified or created. I tried the -u option but still, doesn't list JUST those I have created (like .txt files or libreoffice files, etc). Would there be a way to list ONLY the user files? Thank you.