It’s said that with age comes distinction and wisdom. If we believe that, then we’re talking about people and not files. Working with older files doesn’t make you wise beyond your years…one could argue that it makes you a glutton for punishment :). That doesn’t always have to be the case as we can solve finding and working with older files using the ‘find’ command.
Recently, I was tasked with finding files that had been modified in the past 5 days. I was to copy these files from a SAN Snapshot and move them over to a recover area that anyone could get to (read: Windows File Share).
We were doing this in Linux because the snapshot, which was a NTFS filesystem would only mount in Linux. It seems that Linux is more forgiving of errors on a hard disk than Windows is when dealing with NTFS.
So, the snapshot was located on a server designated as X.X.X.X below. I decided to use the find command to locate all files that were modified in the past 5 days. The find command can be summarized succinctly using the following logic statement: find where-to-look criteria what-to-do. Keeping this logic in mind, I used the following command to get what I needed:
find . -mtime 4 -daystart -exec cp -a {} /home/devnet/fileshare\$ on\ X.X.X.X/RECOVER/ \;
Let’s break down what the above command is doing. First and foremost, the find command when used in conjunction with a period means to search the current directory (where-to-look in logic statement above). If you need to specify where to search via path, replace the period with the path to the directory you’ll be searching in Next, I’ve added the following flags (criteria in logic statement above) which I’ll define:
- -mtime: stands for ‘modified time’. This means I’m searching for only files modified in the past 4 days.
- -daystart: This flag is used to measure time from the beginning of the current day instead of 24 hours ago which is default. So in the example above, it would find files 4 days from the start of today (which equates to 5 days from midnight versus 4 days from 24 hours ago for my task)
- -exec: specifies that with the results, a new command should be executed.
The {} above is where the results of our find command are passed. It will do the command after -exec for each result from the find command.
So, we’re copying with the cp -a command and flag, which will copy recursively, preserving file structure and attributes thanks to our -a flag. That command copies all the files we’ve found using the find command to the path stated next (what-to-do in our logic statement above). The last symbols \; are the end statement for our -exec flag. This must always be present for our -exec command…and the exec flag should be the last option given in the find command as well.
It’s important to note above that I mounted the NTFS SAN snapshot using the GUI like I would any NTFS volume on a Linux desktop and that I executed this find command while I was located in the root of the directory I wanted to search on that snapshot. The server I was copying the files to noted as X.X.X.X above was a Windows File Server on our network that had open permissions for me to copy to. I used Samba to mount this server in the directory ‘fileshare’ in my home directory. The RECOVER directory was made by me to house all the files I’ve found so I could keep them separate from any other files in the root of the file server directory. I had to manually create this folder prior to issuing the command.
There are more than a couple of different ways to do what I did above. There are also numerous ways to alter the command and adapt it for your needs. For example, perhaps you want to find all files that are 3 days old and delete them…and you’re not a stickler for the -daystart option. In this case:
find . -mtime -3 -exec rm -rf {} \;
Maybe you want to copy mp3’s from a directory to a separate location:
find . -name '*.mp3' -exec cp -a {} /path/to/copy/stuff/to \;
There are lots of ways to adapt this to help locate and deal with files. The command line/shell are always more than powerful enough to help you get what you need. I hope this helps you and if you have questions or just want to say thanks…please don’t hesitate to let me know in the comments below.
