Get all the files that changed most recently

Question

I have a program that changes a few files in the file system. I would like to know exactly which one it changed. How can I see all the files on the system that were changed 5 mins ago by a specific program. Is that possible?

It will also work if I could find all the files that were changed most recently and than manually check which one belongs specific program.

Answer 1

Try setting up a search in Finder like so:

This won't search system files however. For that you'll want to use EasyFind. It also won't specify which program modified the file.

Answer 2

The example above shows a solution using the Finder. Under the hood this is using file Metadata library. This is accessible via the command line through the "md* utilities like mdfind, mdls etc. If you're going to be running this command frequently you might want have it available to easily paste in a terminal instead of pointing and clicking in the Finder and this would be a expeditious way to return them.

mdfind 'kMDItemContentModificationDate >= $time.now(-300)' will show you all the files that were modified in the last 5 minutes (300 seconds) on the entire file system.

If you know where the program will be handling files you can limit the results using the -onlyin command for instance to find files in your Desktop folder try: mdfind -onlyin ~/Desktop 'kMDItemContentModificationDate >= $time.now(-300)'

You don't mention much about the program. You can use mdls on the file to get a listing of all the attributes you might be able to query by:

$ mdls SampleDoc.pages
_kMDItemOwnerUserID            = 501
kMDItemAuthors                 = (
    ""
)
kMDItemComment                 = ""
kMDItemContentCreationDate     = 2011-11-17 02:01:06 +0000
kMDItemContentModificationDate = 2011-11-17 02:01:06 +0000
kMDItemContentType             = "com.apple.iwork.pages.sffpages"
kMDItemContentTypeTree         = (
    "com.apple.iwork.pages.sffpages",
    "public.zip-archive",
    "com.pkware.zip-archive",
    "public.data",
    "public.item",
    "public.archive",
    "public.composite-content",
    "public.content"
)
kMDItemDateAdded               = 2015-11-23 05:13:23 +0000
kMDItemDisplayName             = "SampleDoc.pages"
kMDItemFonts                   = (
    "Helvetica-Bold",
    "Helvetica-Oblique",
    LucidaGrande
)
kMDItemFSContentChangeDate     = 2011-11-17 02:01:06 +0000
kMDItemFSCreationDate          = 2011-11-17 02:01:06 +0000
kMDItemFSCreatorCode           = ""
kMDItemFSFinderFlags           = 64
kMDItemFSHasCustomIcon         = (null)
kMDItemFSInvisible             = 0
kMDItemFSIsExtensionHidden     = 0
kMDItemFSIsStationery          = (null)
kMDItemFSLabel                 = 0
kMDItemFSName                  = "SampleDoc.pages"
kMDItemFSNodeCount             = (null)
kMDItemFSOwnerGroupID          = 20
kMDItemFSOwnerUserID           = 501
kMDItemFSSize                  = 823736
kMDItemFSTypeCode              = ""
kMDItemKeywords                = (
    ""
)
kMDItemKind                    = "Pages Publication"
kMDItemLogicalSize             = 823736
kMDItemPhysicalSize            = 827392
kMDItemTitle                   = ""

So perhaps you could filter on the MDItemContentType attribute type. Or if this is a program you control you could set an extended attribute explicitly and add that to the search criteria to make sure you only get the files from your program.

Finally another option that is useful is the -live flag. It will stay connected and give you a tally of the number of files meeting the criteria.

$ mdfind -onlyin ~/Desktop -live 'kMDItemContentModificationDate >= $time.now'
[Type ctrl-C to exit]
Query update: 1 matches
Query update: 2 matches

This can be useful when all you need to know is that the process touched the file system. If your query is tight enough you know it will only change based on when those specific files are touched and then you can do whatever you need to do based on the fact that it happened.