Find Files (Strictly) Older than Another File

One way is to (ab)use epoch time. Here is a test run where I first create seven files in sequence in an empty directory, where the c# files get "the same" ctime as far as find will be concerned:

$ for i in a b "c1 c2 c3" d e; do touch $i; sleep 1; done
$ find -newer c2
.
./d
./e
$ find -not -newer c2
./c3
./c2
./a
./b
./c1
$ find -newerct @$(($(stat -c %Z c2)-1))
.
./c3
./d
./c2
./e
./c1
$ find -not -newerct @$(($(stat -c %Z c2)-1))
./a
./b

This should represent all possible sets of ctime relative to c2:

  1. ctime > c2
  2. ctimec2
  3. ctimec2
  4. ctime < c2

with somewhat fuzzy matching, at least.

The third command gets epoch ctime for the file c2, subtracts 1 via shell arithmetic and feeds this as reference to -newerct (the @ is needed for find to interpret is as such a timestamp) to find all files with ctime newer than this interpreted timestamp (see -newerXY in man find). The fourth command negates this match, and should in practice do what you want if I've understood the question correctly, if you put your reference file as c2 in my example.

Note that the "1 second" offset is somewhat arbitrary (which is what I meant by "fuzzy matching"), and one could imagine a situation where a bug could be constructed. However, timestamps of files are not "definite" anyway and can not be trusted to be, so I can't imagine it to generate either security or practical problems in real situations.

Actually, in practice you might even want to increase the 1 second offset (I see in your question that you use 1 minute right now), but that is an implementation detail.


Maybe pipe the find output into a loop of the test command which will let you use an "older-than" test:

find ... | while read file;
do
  [ "$file" -ot deployment_metadata.txt ] && echo "$file"
done