Queries with Time v2.5

atime

last accessed → Updates when a file is opened or accessed by you, an application, or a remote system.

ctime

last changed → Updates when anything about a file changes except access time — including permissions, attributes, or metadata.

mtime

last modified → Updates when the contents of a file are changed, not its attributes. For example:

• Editing a file → mtime changes

• Changing permissions or metadata → ctime changes, mtime does not

date

• d = day

• M = month

• y = year

time

• h = hour

• m = minute

• s = second

Any time or date

\*

Ranges

Use brackets to define ranges:

• [ ] inclusive

• { } excludes the boundary values

• They can even be mixed: [ } or { ]

mtime:[now-30m TO now]

Modified in the last 30 minutes.

mtime:[now-1h TO now] OR ctime:[now-1h TO now]

Modified or changed in the last hour.

mtime:[now-1d TO now] OR atime:[now-1d TO now]

Modified or accessed in the last day.

mtime:{now-1h TO now}

Modified in the last hour, excluding exactly 1 hour ago and the current moment.

mtime:[now-5y TO now-3M]

Not modified for over 3 months but less than 5 years.

mtime:[\* TO now-1y] AND atime:[\* TO now-1y]

Not modified and not accessed in over 1 year (* = any time in the past).

mtime:{now-5y TO now-3M}

Modified more than 3 months ago but less than 5 years ago, excluding exactly 3 months and 5 years.