How to List the Last Five Modified Files in Linux?

In Linux, it is often necessary to find out the most recently modified files for various reasons, such as troubleshooting or auditing purposes. Listing the last five modified files is a common requirement that can be achieved using various Linux commands. This article explores multiple methods to accomplish this task efficiently.

Note Linux commands are case-sensitive.

Using ls Command

The ls command is one of the most commonly used commands in Linux to list files and directories. We can use the ls command to list the files in a directory sorted by modification time using the -t option. We can then use the head command to display the first five files from the list.

$ ls -lt | head -n 6

Output

total 31654651
-rw-r--r--  1 user root 1.2K Dec 11 11:22 linuxfile.py
-rw-r--r--  1 user root 2.7M Dec 10 15:26 script-linux.pdf
-rw-r--r--  1 user root 9.2M Dec  9 16:21 win_scp.pdf
-rw-r--r--  1 user root 502K Dec  8 10:20 class1.pdf
-rw-rw-rw-  1 user root 2.0M Dec  5 22:06 script23.jpg

The -l option displays the files in a long listing format, including file permissions, ownership, size, and modification time. The -t option sorts the files by modification time in descending order, with the most recently modified file at the top. The head command displays the first six lines, which include the column headers and the last five modified files.

Using find Command with sort

The find command combined with sort provides precise timestamp-based sorting. This method displays modification times as Unix timestamps for accurate comparison.

$ find /home/cg/root/ -type f -printf '%T@\t%p<br>' | sort -n | tail -5

Output

1684171184.3445822090	/home/cg/root/6462638544588/main.py
1684171184.7965797450	/home/cg/root/6462695907cd6/main.py
1684171186.4405707830	/home/cg/root/646264dd4a983/main.lua
1684171186.9005682750	/home/cg/root/64625da89eee4/main.lua
1684171188.9325571980	/home/cg/root/6462694c393df/main.pl

Using find Command with Time Criteria

The find command is another useful tool for searching files based on various criteria, including modification time. We can search for all files modified within the last 24 hours and display the most recent ones.

$ find . -type f -mtime -1 -print0 | xargs -0 ls -lt | head -n 6

Output

-rw-r--r-- 1 root root  496 Dec 20 12:55 ./shell.py
-rw-r--r-- 1 root root  418 Dec  8 03:54 ./sh/remote.sh
-rw-r--r-- 1 root root 4096 Dec 20 12:54 ./shell3.sh
-rw-r--r-- 1 root root  436 Dec 20 12:54 ./script/test3.sh
-rw-r--r-- 1 root root 4096 Dec 20 12:53 ./test.py

The find command searches for all files (-type f) in the current directory and subdirectories that have been modified within the last 24 hours (-mtime -1). The -print0 option prints filenames with null character termination, and xargs -0 handles these null-terminated names safely.

Using find Command with stat

The stat command provides detailed file information, including precise modification timestamps. Combined with find, it offers another method to list recently modified files.

$ find /home/cg/root -type f -exec stat --format '%Y %n' {} + | sort -nr | head -5

Output

1684172257 /home/cg/root/646267076a666/demo.m
1684172255 /home/cg/root/64626d0533a41/testing.txt
1684172255 /home/cg/root/646267bba8bdf/main.pl
1684172254 /home/cg/root/646267eb29beb/demo.m
1684172250 /home/cg/root/64626d8526584/main.lua

This command uses stat with the --format '%Y %n' option to display the modification time as a Unix timestamp followed by the filename. The results are sorted numerically in reverse order (-nr) to show the most recent files first.

Comparison of Methods

Conclusion

This article has explored multiple methods to list the last five modified files in Linux. The ls command provides a simple solution for single directories, while find offers more flexibility for recursive searches and complex criteria. Each method serves different use cases depending on whether you need recursive searching, precise timestamps, or human-readable output.