How to Find Files Modified in the Last 7 Days (find -mtime)

find . -type f -mtime -7 lists every file modified in the last 7 days. The -mtime -7 reads as "modification time less than 7 days ago". Flip the sign to +7 and you get files older than 7 days, which is the version cleanup scripts use to clear out stale logs and temporary files.

The off-by-one is what catches people: -mtime 7 (no sign) means exactly 7 days ago, plus or minus rounding, which almost never matches what you actually want. Use -mtime -7 for recent, -mtime +7 for old, and never bare -mtime N unless you specifically want the 24-hour slice that landed N days ago.

Set your values

The one-liner

find :search_path -type f -mtime -:days

That returns every regular file under your search path with a modification time newer than :days days ago. Drop -type f if you also want directories and symlinks.

What -mtime actually does (the off-by-one)

-mtime N filters by modification age in 24-hour units, rounded toward zero. The sign in front of N controls the comparison:

The rounding rule: GNU find floors the file's age to whole 24-hour intervals before comparing. A file modified 6.9 days ago has age 6 and matches -mtime -7. A file modified 7.0001 days ago has age 7 and does not match -mtime -7. This is the off-by-one that breaks scripts when "last week" means slightly different things to different people.

If you need exact time windows, use -mmin (minute resolution) or -newer FILE (exact timestamp) instead.

Find files modified in the last N hours

-mmin -N is the minute-resolution variant. Use it when 24-hour buckets are too coarse.

find :search_path -type f -mmin -:minutes

For "modified in the last hour", use -mmin -60. For "modified in the last 15 minutes", -mmin -15. The same - / + sign rules apply.

Find files modified since a specific time

-newer FILE compares against the modification time of a reference file. The standard trick is to touch a marker file at the exact instant you care about, then ask find for everything newer:

touch -t 202605170900 /tmp/since-mark
find :search_path -type f -newer /tmp/since-mark

The touch -t YYYYMMDDhhmm syntax sets the modification time of the marker. This is more precise than -mtime because it avoids the day-floor rounding.

Find files modified between two dates

Combine -newer and ! -newer for a window:

touch -t 202605010000 /tmp/start-mark
touch -t 202605150000 /tmp/end-mark
find :search_path -type f -newer /tmp/start-mark ! -newer /tmp/end-mark

This returns files modified between May 1 and May 15 inclusive of the start, exclusive of the end. Standard practice for "give me everything from last week" reports.

Find files NOT modified in the last N days

The inverse, useful for finding stale files:

find :search_path -type f -mtime +:days

The + flips the comparison. -mtime +7 means "older than 7 days" which is exactly what cleanup scripts want. If stale-file detection is the actual goal (find everything untouched for a while, then audit or archive it), I treat it as its own task in finding files not modified in the last N days.

Delete files older than N days

The classic cleanup pattern. Use -mtime +:days -delete to remove anything that hasn't been touched in the window:

find :search_path -type f -mtime +:days -delete

Critical safety habit: always run the command with -print first to verify what would be deleted, then swap -print for -delete. find -delete has no confirmation and no undo. The find and delete files article covers the safe-delete pattern in more depth, including how to handle the directory-deletion-order trap.

List the N most recently modified files

Combining find with sort and head gives you a recency leaderboard:

find :search_path -type f -printf '%T@ %p\n' | sort -rn | head -20

GNU find -printf '%T@' outputs the modification time as a Unix timestamp; BSD lacks -printf, so use -exec stat. The numeric sort surfaces the most recent first; head -20 keeps the output scannable.

macOS BSD vs GNU find

The mtime-specific differences that bite:

If your cleanup scripts need to run on both Linux and macOS, stick to -mtime, -mmin, -newer. Avoid -printf and any GNU-specific format flags.

Common find -mtime mistakes

1. Using -mtime N instead of -mtime -N or +N. Bare -mtime 7 means "exactly 7 days old after rounding" which matches files modified somewhere in the 24-hour window 7-8 days ago. Almost never what you want. Always include - (recent) or + (old).

2. Forgetting that -mtime -1 is the same as -mtime 0. Both match "modified in the last 24 hours". The negative-zero edge case trips up scripts that try to detect "newer than yesterday" using arithmetic.

3. Assuming -mtime uses calendar days. It uses 24-hour intervals from the current moment, not midnight-to-midnight boundaries. A file modified yesterday at 11:00 PM and checked at 6:00 AM today has age < 1 day and matches -mtime -1, not because it was "modified yesterday" but because it was modified less than 24 hours ago.

4. Mixing -mtime and -newer thinking they're equivalent. -newer FILE compares against the file's exact mtime; -mtime N compares against the floor-to-day age. For scripts that need precision, prefer -newer.

5. Forgetting -type f. Without it, -mtime -7 -delete will try to delete directories whose mtime is recent, which is almost any directory you've added files to. Always include -type f for file-only operations, or -type d -empty for directory cleanup.

6. Running cleanup against /. find / -mtime +30 -delete is a foot-cannon. Always anchor the search at a specific directory. The find and delete files article has the full safe-delete checklist.

When NOT to use -mtime

Use a different approach when:

• You need sub-minute resolution. -mmin is whole-minute only. For sub-minute precision, use -newer FILE with a touch-set marker file.
• You're working with file content changes, not metadata. -mtime reflects when the inode's mtime was updated, which any write triggers. If you care about "files whose content actually differs from yesterday's snapshot", you want a content hash diff, not find.
• You need to track access patterns, not modifications. -atime is the access-time variant; on many filesystems it's disabled (noatime mount option) for performance, so this often returns the same as -mtime.
• You're on a filesystem where mtime is unreliable. Some network filesystems, FUSE mounts, and badly-configured rsync setups update mtime in ways that confuse -mtime. Verify with stat before trusting the find output.

See also

• find Command Cheat Sheet: the full find reference covering name, type, size, permissions, and exec patterns
• Find files by owner, group, or permission: the other half of an audit pass, who owns the stale files and whether their modes are too loose
• Find and delete files safely with find -delete: the cleanup-script playbook
• grep cheat sheet: pair with find ... -print0 | xargs -0 grep to search inside the matched files
• Bash for loop: when you need logic inside the find result loop that doesn't fit -exec
• External: GNU find -mtime docs, BSD find(1) man page

FAQ