find command question

[CKT]

Hi,

Does anyone know what is the difference between -mtime and -ctime for the find command? Thanks.

JT

[Andy Monks · Accepted solution]

From man find

-atime n True if the file access time subtracted from
the initialized time is n-1 to n multiples of
24 h. The initialization time shall be a time
between the invocation of the find utility
and the first access by that invocation of
the find utility to any file specified by its
path operands. The access time of
directories in pathname_list is changed by
find itself.

-mtime n True if the file modification time subtracted
from the initialization time is n-1 to n
multiples of 24 h. The initialization time
shall be a time between the invocation of the
find utility and the first access by that
invocation of the find utility to any file
specified in its path operands.

-ctime n True if the time of last change of file
status information subtracted from the
initialization time is n-1 to n multiples of
24 h. The initialization time shall be a time
between the invocation of the find utility
and the first access by that invocation of
the find utility to any file specified by its
path operands.

[Brian M. Fisher]

-mtime is when the file itself has been modified
-ctime is when the inode information has changed i.e. change of perms. or owernship

Brian
<*(((>< er

[James R. Ferguson]

Jules:

A word of "caution" too...you will see the inode timestamp change whenever you use /usr/sbin/fbackup. This can be useful or troublesome depending upon your viewpoint.

/usr/bin/tar however, leaves the inode timestamp intact but alters the access timestamp unlike fbackup which leaves it untouched.

...JRF...
/usr/sbin/fbackup doesn't alter the access timestamp of a file whereas /usr/bin/tar does just that.