How can I find files added to the system within X minutes of a specific time?

Posted on

QUESTION :

I have done a fresh install of Mac OS X Mountain Lion today on a new MacBook.

Because this was a new install, when I finally got round to configuring some of my own developer things, I was surprised to find some app had installed a binary into /usr/local/bin – a single binary called galileod.

Interestingly, I can’t find anything online about galileod. I had only installed the bare minimum of software at this point.

Looking in the file columns I can see Date Modified was 9th November 2012, but Date Added to the system was today at 17:01.

It’s now 10:20PM and I can’t remember which software I was installing at that point. So how do I find out which other files were installed to the system within, say, 5 minutes either side of 17:01?

EDIT: I found out what galileod was by running galileod --help – it is a binary used with Fitbit to communicate with the USB dongle. So that’s the mystery solved – but it would still be interesting to know how to find files added within X minutes of a timeframe for future reference.

ANSWER :

You can use find to find files that were created in the last N minutes. From man find:

  -mmin n
          File's data was last modified n minutes ago.

So, for example, if it is now 18:30 and you want files created between 17:45 and 18:00, i.e. created more than 30 minutes ago but less than 45 minutes ago, you would do this:

sudo find / -mmin +30 -mmin -45

The date added metadata has only been around since 10.7. It might be stored only in the Spotlight indexes.

mdfind 'kMDItemDateAdded>=$time.now(-3600)'

You can find modified files in the last n days:

sudo find / -mtime -1 -print

It’s a start…

http://www.cyberciti.biz/faq/howto-finding-files-by-date/

Leave a Reply

Your email address will not be published. Required fields are marked *