Locate Files Based on Time Modified with find

Ever run find with -mtime +1 expecting files modified more than 24 hours ago, only to get results that are actually more than 48 hours old? You are not alone. The +N and -N operators in find work in whole-day (or whole-minute) increments, and the boundary is easy to misread.

The find command

find /maildir/ -mtime +1

This returns files in /maildir/ whose last modification time is more than 2 full 24-hour periods ago (i.e., 48+ hours).

How -mtime actually counts

find measures time in 24-hour blocks and truncates toward zero. Here is the mapping that trips most people up:

The key takeaway: +N means “strictly greater than N full periods,” so +1 skips the first 24-hour window entirely. If you need “more than 24 hours,” use -mtime +0 instead.

Practical examples

# Files modified in the last 7 days
find /var/log/ -mtime -7

# Files modified more than 30 days ago (candidates for cleanup)
find /tmp/ -mtime +30 -type f

# Files modified in the last 15 minutes
find /opt/app/ -mmin -15

# Combine with a name filter
find /maildir/ -mtime +1 -name "*.eml"

Tips

• Pair -mtime with -type f to avoid listing directories.
• Use -ls or -printf '%T@ %p\n' to see the exact modification timestamp alongside the path.
• For cron-based cleanup jobs, -mtime +N is the standard way to target files older than N days without touching anything recent.

• How-To
• Technology

• Bash
• SysAdmin