Find recently changed files in Linux

"What changed?" is one of the most useful questions when something breaks or looks suspicious. Linux records when every file was last modified, and find can filter on those times. This guide shows how to list recent changes, how the three timestamps differ, and how to use them to audit a website or config folder.

Before you start

• A Linux VPS with Ubuntu 22.04 or 24.04, Debian 12, or AlmaLinux or Rocky Linux 8 or 9.
• An SSH session, with sudo for system folders.
• Some familiarity with find. The basics are in The find command: search for files in Linux.

The three timestamps

Each file has three times you can search on:

• mtime (modify): when the file's content last changed.
• ctime (change): when the file's metadata last changed, such as permissions, owner or name, and also whenever the content changed. You cannot set ctime by hand, which makes it useful in audits.
• atime (access): when the file was last read. Most servers mount with relatime, which updates it only occasionally, so do not rely on it.

See all three with stat:

stat /etc/nginx/nginx.conf

Access: 2026-11-09 08:01:12.418 +0000
Modify: 2026-11-07 16:44:03.902 +0000
Change: 2026-11-07 16:44:03.902 +0000
 Birth: 2026-10-02 09:15:47.110 +0000

Birth is the creation time, shown on filesystems and tools that support it.

Files changed in the last minutes

-mmin counts in minutes. A - means "less than":

find /var/www/example.com -type f -mmin -30

This lists files whose content changed in the last 30 minutes. Use -cmin to include permission and ownership changes:

find /var/www/example.com -type f -cmin -30

Files changed in the last days

-mtime counts in 24-hour periods:

• -mtime -1: changed within the last 24 hours.
• -mtime -7: within the last 7 days.
• -mtime +30: more than 30 days ago.

sudo find /etc -type f -mtime -2

Files changed since a specific time

To see everything changed since a moment, for example since a deploy, compare against a reference file:

touch -d "2026-11-09 09:00" /tmp/since
find /var/www/example.com -type f -newer /tmp/since

GNU find can also take a date directly:

find /var/www/example.com -type f -newermt "2026-11-09 09:00"

And a range, between two times:

find /var/www/example.com -type f -newermt "2026-11-08" ! -newermt "2026-11-09"

Show the results with times

Print the time next to each path and sort the list, newest last:

find /var/www/example.com -type f -mtime -1 -printf '%TY-%Tm-%Td %TH:%TM  %p\n' | sort

2026-11-09 08:12  /var/www/example.com/wp-content/uploads/2026/11/logo.png
2026-11-09 09:40  /var/www/example.com/index.php

For a single folder, ls is quicker:

ls -lt /var/log | head

-t sorts by modification time, newest first. Add -r to reverse.

Audit a website after an incident

Attackers often drop new PHP files or change existing ones. Look for recent PHP changes and new files in upload folders:

find /var/www/example.com -type f -name "*.php" -ctime -3 -printf '%CY-%Cm-%Cd %CH:%CM  %u  %p\n' | sort
find /var/www/example.com/wp-content/uploads -type f -name "*.php"

Using -ctime matters here. A file's mtime can be faked with touch, but its ctime is updated by the kernel on every change, including the faking itself.

For ongoing, automatic tracking of changes to important files, a file integrity tool is a better fit than manual searches.

Skip noisy folders

Cache and session folders change constantly. Prune them to keep the output readable:

find /var/www/example.com -path '*/cache' -prune -o -type f -mmin -60 -print

Check it works

Create a test file and find it:

touch ~/recent-test
find ~ -maxdepth 1 -type f -mmin -5

recent-test appears in the output. Run stat ~/recent-test to see its times, then delete it with rm ~/recent-test.

Troubleshooting

• Files you know changed do not appear: the program may have kept the old mtime, as cp -p, rsync -a and tar extraction do. Search by -cmin or -ctime instead.
• -mtime +1 misses files from 30 hours ago: day counts drop fractions. Use -mmin +1440 for "older than 24 hours".
• atime never seems to change: the filesystem uses relatime or noatime. That is normal and saves disk writes.
• Times look hours off: stat and find use the server's time zone. Check it with timedatectl.

Next steps

• Remove files once they age out: Delete files older than X days.
• Get alerts on file changes: Monitor file integrity with AIDE.