find: ctime & mtime

[Guy Harris]

>What is the difference of the find options ctime and mtime?
>How will the two different options give me two differnt listings?
>Or will they?
>Should I use atime, to be safe, when I do incremental backups every night?

The difference between the "find" options is the same as the difference
between the "(inode) change time" and "modified time" of a file; see,
for instance, STAT(2).

The "modified time" is updated when a file's contents are modified,
either by writing to the file or by truncating it ("creat", "open" with
O_TRUNC, "(f)truncate" for folks lucky enough to have it).  The "(inode)
change time" is updated whenever the file's inode is changed; this
includes changing the link count (e.g. linking to it and, at least on
many systems, renaming it), changing the permissions on it, etc..  It
also is updated when the file is written to.

As such, "ctime" will list more files than "mtime" does; I would suggest
using "ctime", since that will back up files that have been e.g.
renamed, or have had their mode changed, so that restoring from the
backup restores those changes.

Using "atime" is probably a bad idea, since that will list every file
that somebody *looked at* in the given amount of time; this is a bit
excessive.