funwithlinux blog

How to Recursively Find All Files Newer Than a Unix Timestamp with a Bash One-Liner (Standard Linux Utilities)

In the world of Linux system administration, DevOps, or even everyday file management, there are countless scenarios where you might need to track down files modified after a specific point in time. For example:

  • Identifying recent log files for troubleshooting.
  • Backing up only files changed since a last backup.
  • Auditing modifications to sensitive directories.

Unix timestamps (also called epoch time) are a common way to represent time in computing—they count the number of seconds since January 1, 1970, 00:00:00 UTC. If you have a Unix timestamp (e.g., 1717171200 for June 1, 2024), and you need to find all files modified after that timestamp, Linux’s standard command-line tools can help you do this efficiently with a single line of bash.

In this guide, we’ll break down how to build a robust, recursive file-finding one-liner using find, date, and other standard utilities. No external dependencies—just tools preinstalled on nearly every Linux system.

2025-11

Table of Contents#

  1. Understanding Unix Timestamps
  2. Core Tools: find and date
  3. Building the One-Liner: Step-by-Step
  4. Examples: Practical Use Cases
  5. Handling Edge Cases & Customization
  6. Alternative Methods (for Advanced Users)
  7. Conclusion
  8. References

1. Understanding Unix Timestamps#

Before diving into the command, let’s clarify what a Unix timestamp is. A Unix timestamp (or epoch time) is a 32-bit integer representing the number of seconds elapsed since the "Unix epoch": January 1, 1970, 00:00:00 UTC.

How to Work with Timestamps#

  • Get the current timestamp: Use date +%s (e.g., 1717257600 for June 2, 2024, 00:00:00 UTC).
  • Convert a timestamp to a human-readable date: Use date -d @<timestamp>. For example: 
    date -d @1717171200  
# Output: Sat Jun  1 00:00:00 UTC 2024
  • Convert a date to a timestamp: Use date -d "YYYY-MM-DD HH:MM:SS" +%s. For example: 
    date -d "2024-06-01 00:00:00" +%s  
# Output: 1717171200

2. Core Tools: find and date#

To recursively find files newer than a Unix timestamp, we’ll use two standard Linux utilities:

The find command searches directories recursively and filters files based on criteria like name, size, or modification time. Key features for our task:

  • -type f: Restrict results to regular files (exclude directories, symlinks, etc.).
  • -newermt <date>: Match files whose modification time is newer than the specified <date>.

date: Timestamp Conversion#

The date command converts between timestamps and human-readable dates. Critical for our task:

  • -d @<timestamp>: Parse the timestamp as a date (e.g., date -d @1717171200).
  • +%Y-%m-%d %H:%M:%S: Format the output as an ISO 8601 date (e.g., 2024-06-01 00:00:00), which find understands.

3. Building the One-Liner: Step-by-Step#

We’ll combine find and date to create a one-liner that:

  1. Recursively searches a target directory.
  2. Filters files modified after a given Unix timestamp.

Step 1: Define the Target Timestamp#

Let’s use TIMESTAMP=1717171200 (June 1, 2024, 00:00:00 UTC) as an example. Replace this with your target timestamp.

Step 2: Convert the Timestamp to a find-Friendly Date#

Use date -d @<timestamp> to convert the timestamp to a date string. For find to reliably parse it, format the date as YYYY-MM-DD HH:MM:SS:

date -d @1717171200 +'%Y-%m-%d %H:%M:%S'  
# Output: 2024-06-01 00:00:00

Step 3: Recursively Find Files with find#

Use find with -newermt to match files modified after the converted date. Combine with the date command via command substitution ($(...)):

find /path/to/search -type f -newermt "$(date -d @$TIMESTAMP +'%Y-%m-%d %H:%M:%S')"

Final One-Liner#

Putting it all together (replace /path/to/search and TIMESTAMP with your values):

TIMESTAMP=1717171200; find /path/to/search -type f -newermt "$(date -d @$TIMESTAMP +'%Y-%m-%d %H:%M:%S')"

4. Examples: Practical Use Cases#

Example 1: Find Files Newer Than a Specific Timestamp#

Search for files in ~/documents modified after June 1, 2024 (timestamp 1717171200):

TIMESTAMP=1717171200  
find ~/documents -type f -newermt "$(date -d @$TIMESTAMP +'%Y-%m-%d %H:%M:%S')"

Example 2: Find Files Modified in the Last 24 Hours#

To find files changed in the last 24 hours, calculate the timestamp for 24 hours ago (current timestamp - 86400 seconds):

TIMESTAMP=$(( $(date +%s) - 86400 ))  # 86400 seconds = 24 hours  
find /var/log -type f -newermt "$(date -d @$TIMESTAMP +'%Y-%m-%d %H:%M:%S')"

Example 3: Include Hidden Files and Suppress Errors#

Add -print 2>/dev/null to include hidden files and ignore "permission denied" errors:

TIMESTAMP=1717171200  
find / -type f -newermt "$(date -d @$TIMESTAMP +'%Y-%m-%d %H:%M:%S')" -print 2>/dev/null

5. Handling Edge Cases & Customization#

Time Zones#

By default, date -d @<timestamp> uses your system’s time zone. To force UTC (matching the Unix epoch’s time zone), add -u to date:

date -u -d @1717171200 +'%Y-%m-%d %H:%M:%S'  
# Output: 2024-06-01 00:00:00 (UTC)

Millisecond Timestamps#

If your timestamp is in milliseconds (e.g., 1717171200000), divide by 1000 first:

MILLI_TIMESTAMP=1717171200000  
TIMESTAMP=$((MILLI_TIMESTAMP / 1000))  
find . -type f -newermt "$(date -d @$TIMESTAMP +'%Y-%m-%d %H:%M:%S')"

Other Time Types#

find supports other time-based filters besides modification time:

  • -newerat <date>: Files accessed after <date>.
  • -newerct <date>: Files whose metadata (e.g., permissions) changed after <date>.

Example: Find files accessed after the target timestamp:

find /path -type f -newerat "$(date -d @$TIMESTAMP +'%Y-%m-%d %H:%M:%S')"

6. Alternative Methods (For Understanding)#

Using stat to Compare Timestamps Directly#

For educational purposes, you can use stat to fetch a file’s modification time (in seconds) and compare it to the target timestamp. This is slower for large directories but illustrates the underlying logic:

TIMESTAMP=1717171200  
find /path -type f -exec sh -c '  
  for file do  
    file_mtime=$(stat -c %Y "$file")  # %Y = modification time in seconds  
    if [ "$file_mtime" -gt "$TIMESTAMP" ]; then  
      echo "$file"  
    fi  
  done  
' sh {} +

Why the one-liner is better: find -newermt is optimized for speed, as it avoids spawning subshells for each file.

7. Conclusion#

Recursively finding files newer than a Unix timestamp is straightforward with Linux’s standard tools. The core one-liner—combining find for recursion and date for timestamp conversion—balances simplicity and efficiency:

TIMESTAMP=<your-timestamp>; find /path/to/search -type f -newermt "$(date -d @$TIMESTAMP +'%Y-%m-%d %H:%M:%S')"

Adapt it to your needs by changing the path, timestamp, or time type (-newermt, -newerat, etc.). For large directories, stick to find -newermt for best performance!

8. References#

  • find manual: man find (search for -newermt).
  • date manual: man date (search for -d and timestamp formatting).
  • Unix Epoch Converter: epochconverter.com (for validating timestamps).