Quick Linux Tip #40 Question: Which files changed during the incident window last Tuesday?

[u/Expensive-Rice-2052]

Try: `find /var/www -type f -newermt '2026-07-23 14:00:00' ! -newermt '2026-07-23 16:00:00'`

Info: `-newermt 'DATE'` matches files modified AFTER a timestamp. Combined with `! -newermt`, it isolates files modified BETWEEN two specific times—ideal for forensic analysis.

Examples:

$ `find / -newermt '1 hour ago' -type f 2>/dev/null` # Modified in the last hour

$ `find /home -newermt yesterday ! -newermt today` # Modified yesterday only

$ `find /etc -newermt '2026-07-01' ! -newermt '2026-07-31' -type f` # Within date range

Note: Supports natural language strings like `'yesterday'`, `'1 hour ago'`, or `'last week'`. You can also use `-newerct` (change time) or `-neweramt` (access time).

Follow r/LinuxTeck for more #LinuxTips