1

I need to find all files that were edited during office hours only since the computer could be used for freelancing at night. Is there a way to search for created / modified time of day regardless of date? I have both Windows and Linux systems available.

2
  • Are you only trying to find files on the local computer that were modified, or are these files on a network drive or external storage? What is the file system? Commented Sep 28, 2017 at 22:43
  • Thanks, they are stored currently on a backup drive as the original is in police custody, so some of the time stamps have been updated, like the one on folder creation, during the copy process, but hopefully we can find the timestamps that didn't change and use those. I can copy them again to a linux machine, but they are currently local to Windows. I am looking into that similar question Kamil, thank you.
    – Alan
    Commented Sep 28, 2017 at 22:56

3 Answers 3

1

Yes, you can search for modified dates for any program/file using a free software called Search Everything. However, you will need to click the Date/Time column in the program and manually look through it yourself. There is no program to do this for you sadly. Hope this helps. - Aphrodite

0

Linux solution.

There is a similar question. Based on my answer there I came up with a general Bash script to solve this kind of problems. You will find the code below. Save it to a file named findt (or another) then chmod a+x findt. Place it where your $PATH points to or elsewhere – I assume you know the basics, the difference etc.

Invoke findt -h to learn the syntax. Excerpt:

USAGE

  `findt [OPTION]... FROM TO [ARG]...`

SYNOPSIS

Invokes find command to list objects (files, directories, ...) modified, changed or accessed between FROM and TO (inclusive). FROM and TO are times given in 24-hour HH:MM or H:MM format (00:00 - 23:59). Modification date (day) does not matter. If FROM is later than TO then the interval includes midnight.

OPTIONs

  `-h`    print this help and exit

  `-m`    use mtime (default)  
  `-c`    use ctime  
  `-a`    use atime (note: understand `noatime` mount option etc.)  
  `-b`    use birth time, `stat -c %w`  
          (useless, see `https://unix.stackexchange.com/a/91200`)

If more than one ?time is specified, only the last one matters.

  `-p`    use `-print` with `find` (default)  
  `-0`    use `-print0` instead  
  `-d`    use `-delete` with `find` (non-POSIX)  

-d is silent unless -p or -0 is also used.

ARGs

Arguments following TO are passed to find as its initial arguments. Specify paths and additional tests (e.g. -type f) here.

Most of the code is for parsing the command line, printing help etc. The working part of the script is find invocation. It's slightly generalized solution from my already mentioned answer. It's explained there so I won't repeat myself here.

The tool just prints names, unless you use -d. Note it uses HH:MM from plain stat -c %y etc. ignoring timezone information; if there are different timezones involved then you may want to adjust the solution.

In your case you should run something like:

findt 8:00 15:59 /path/to/dir -type f

This is the code:

#!/usr/bin/env bash

set -e

myname="${0##*/}"
from=-1
to=-1
property=%y
is_print=0
is_zero=0
is_delete=0
post_args=""
conj=-a

main() {
while [ "${1:0:1}" = "-" ]; do
  options="${1:1}"
  shift
  while [ ${#options} -ne 0 ]; do
    case "$options" in
      h*)
        print_help
        exit 0;;
      m*)
        property=%y;;
      c*)
        property=%z;;
      a*)
        property=%x;;
      b*)
        property=%w;;
      p*)
        is_print=1;;
      0*)
        is_zero=1;;
      d*)
        is_delete=1;;
      *)
        print_error;;
    esac
  options="${options:1}"
  done
done

from=`parse_time "$1"`
to=`parse_time "$2"`
shift 2

[ $from -gt $to ]    && conj=-o
[ $is_delete -eq 0 ] && is_print=1
[ $is_print -eq 1 ]  && post_args="-print"
[ $is_zero -eq 1 ]   && post_args="-print0"
[ $is_delete -eq 1 ] && post_args="$post_args -delete"

find "$@" -exec bash -c '\
hm=`stat -c $4 "$0" | cut -c 12-16`; [ "${#hm}" -eq 0 ] && exit 1 ; \
t=$((60*10#`echo $hm | cut -c 1-2`+10#`echo $hm | cut -c 4-5`)); \
test \( $t -ge $1 \) $3 \( $t -le $2 \)' \
{} $from $to $conj $property \; $post_args
}

parse_time() {
time_string="$1"
[ ${#time_string} -eq 4 ] && time_string="0$time_string"
[[ "$time_string" =~ ^[0-2][0-9]:[0-5][0-9]$ ]] || print_error
{ value=$((60*10#${time_string:0:2}+10#${time_string:3:2})); } 2>/dev/null || print_error
[ $value -ge 1440 ] && print_error
printf '%s' $value
}

print_error() {
cat >&2 << EOF
${myname}: error parsing command line
Try '$myname -h' for more information.
EOF
exit 1
}

print_help() {
cat << EOF
USAGE

    $myname [OPTION]... FROM TO [ARG]...

SYNOPSIS

Invokes \`find' command to list objects (files, directories, ...) modified,
changed or accessed between FROM and TO (inclusive). FROM and TO are times given
in 24-hour HH:MM or H:MM format (00:00 - 23:59). Modification date (day)
does not matter. If FROM is later than TO then the interval includes midnight.

OPTIONs

    -h  print this help and exit

    -m  use mtime (default)
    -c  use ctime
    -a  use atime (note: understand \`noatime' mount option etc.)
    -b  use birth time, \`stat -c %w'
        (useless, see https://unix.stackexchange.com/a/91200)

If more than one ?time is specified, only the last one matters.

    -p  use \`-print' with \`find' (default)
    -0  use \`-print0' instead
    -d  use \`-delete' with \`find' (non-POSIX)

-d is silent unless -p or -0 is also used.

ARGs

Arguments following TO are passed to \`find' as its initial arguments.
Specify paths and additional tests (e.g. \`-type f') here.

EXAMPLES

To list objects in /tmp modified during working hours:
    $myname 7:00 14:59 /tmp

To list and delete big files accessed late at night in /home/foo
    $myname -apd 23:30 4:30 /home/foo -typef -size +640M

LICENCE
        Creative Commons CC0.
EOF
}

main "$@"
0

You can try the command in Linux environment.

To find all files that are modified today only

find . -mtime -1 -print

touch -t `date +%m%d0000` /tmp/$$
find /tmefndr/oravl01 -type f -newer /tmp/$$
rm /tmp/$$

  

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .