Unix doesn't care or keep track of when files are created...
To find files changed/updated on July 16th
create an empty file dated July 15th 23:59:59
create an empty file dated July 17th 00:00:00
==> man touch
Find files with modify timestamp between those two files
==> man find (-newer and ! -newer)
Perhaps if you run a backup tool like daily TSM incremental, TSM may be able to find out the creation date of files?
If you use a tool like perl or 'C' you will have access to three file atributes, ctime, atime and mtime which are creation time, access time, and modified time. That's the good news. The bad news is that none of these are to be trusted.
mtime is the most accurate of the lot but can be easily altered using 'touch' so is insufficient for a proper audit.
ctime is actually the modify time of the inode. In many cases this will equal creation time but, again, you shouldn't rely on it.
atime is the last time the file was read but is even more unreliable.
Having said all this most versions of find allow for the -ctime flag so, will all the provisos in mind,
This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
By continuing to use this site, you are consenting to our use of cookies.