find files where Change > Birth

user_1678652 0
Viewed 90

Is it possible to find files where Change > Birth?

Stat somefile shows this for a modifed file

Access: 2022-02-24 17:07:45.562037727 +0000
Modify: 2022-02-24 17:07:26.682343514 +0000
Change: 2022-02-24 17:07:26.682343514 +0000
 Birth: 2022-02-24 16:35:56.737147848 +0000

and this for a non-modifed one (a copied file)

Access: 2022-02-23 18:27:00.000000000 +0000
Modify: 2022-02-23 18:27:00.000000000 +0000
Change: 2022-02-24 15:57:29.334302184 +0000
 Birth: 2022-02-24 15:57:29.334302184 +0000

The modification time is the timestamp of the orginal file, a little less than the time it was copied into a docker image.

I'd like to find only the modified files.

unix-timestamp linux
2 Answers

Here is a little script in bash, to find if change "path1" > birth "path2".

The following sketch for a script assumes that change, birth have values.

change=$(stat "<path1>" | awk '/Change/ {$1=""; print}')
birth=$(stat "<path2>" | awk '/Birth/ {$1=""; print}')

if [ $change -ge $birth ];
then
    echo "greater"
fi
user_182742090

Suppose you create six files, wait a sec then touch 3 of them again to update their mtime:

$ touch file{1..6}; sleep 1; touch file{2..4}

You can find the files that have been modified with ruby:

ruby -e '
    Dir.glob("file*").each{|fn|
        st=File.stat(fn)
        puts "\"#{fn}\" satisfies the condition" if st.mtime>st.birthtime
    }
'

Or with Bash:

# The `stat` command tends to be SUPER platform specific
# This is BSD and likely only works on BSD / Mac OS
# Just modify that `stat` command to print mtime and btime for your platform
for fn in file*; do
    mtime=$(stat -f "%m" "$fn")
    btime=$(stat -f "%B" "$fn")
    (( mtime>btime )) && echo "\"${fn}\" satisfies the condition"
done

Either prints:

"file2" satisfies the condition
"file3" satisfies the condition
"file4" satisfies the condition
user_2986070
Related