Find Recently Changed Files on Linux

Linux provides several ways to find files that were modified recently or to watch a directory for changes as they happen.

Files Modified in the Last Hour

find /path/to/directory -type f -mmin -60

-mmin works in minutes.

Files Modified in Recent Days

find /path/to/directory -type f -mtime -1
find /path/to/directory -type f -mtime -7

find’s -mtime is based on 24-hour periods, not calendar dates. Use precise timestamps or -newermt when calendar boundaries matter.

For example, with GNU find:

find /path/to/directory -type f -newermt 'today'

Show Details for Matching Files

find /path/to/directory -type f -mmin -60 -exec ls -lh {} +

For scripting, find -printf can avoid parsing ls output on GNU systems.

Watch Changes in Real Time with inotify

Install inotify-tools if needed, then:

inotifywait -m -e modify,create,delete,move /path/to/directory

Add -r to watch existing subdirectories recursively:

inotifywait -mr -e modify,create,delete,move /path/to/directory

Linux inotify is useful for application workflows and debugging, but it is not a persistent security audit log by itself.

Auditing with auditd

For security-oriented auditing, the Linux Audit subsystem can record write and attribute events with more context. Rules and persistence vary by distribution, so use the distribution’s auditd documentation when configuring production audit policy.

Conclusion

Use find for historical modification-time queries and inotify-based tools for real-time observation. For security auditing, use a persistent auditing system rather than relying only on filesystem timestamps.