Deletion of Files from File System

Imagine a scenario where there is an automatically run job that deletes "old" files from a file system - for example financial data more than 5 years old.

This might be implemented with the following code:

find /data/finance -type f -mtime +1827 -exec /bin/rm '{}' \;

Up until 19-Jan-2038 03:14:07 UTC the code above will work as expected. After that time, behavior will depend on several factors as detailed below.

Find using time(), file system with 32-bit time fields

Regardless of whether the OS has support for time64() or not, if the find command used in this example has not been patched and re-compiled to use it, it will still be "living in a time32() world". That is, when the 32-bit time_t structure wraps around, the find command will believe that the current date is sometime late in December 1901. Files created after the wrap-around will have the correct relative age, however files that had been created prior to the wrap-around will appear to the find command to have creation and modification dates up to 136 years in the future. The find command above will cease functioning as intended, because it will not delete any files from the file system until 5 years after the wrap-around. While this in most cases is probably not a catastrophic failure, it could lead to filled file systems, preventing creation of new files, which may or may not be catastrophic.

Find using time(), file system with 64-bit (or larger) time fields

Probably just a theoretical case, but included for completeness. Assuming that the OS has an internal time64_t clock and applies that to 64-bit file system time stamps, and that the find command is prepared to deal with those 64-bit timestamps (if find just truncates a 64-bit value from the file system to 32 bits, analysis is exactly the same as above). Analysis is much the same as above, however in this case all files, even those created after the wrap-around will appear to the find command to have dates in the future. The find command ceases to function as intended because it will not delete any files from the file system that were created after the wrap-around.

Find using time64(), file system with 32-bit time fields

If the OS has support for time64(), and the find command has been patched and re-compiled to use it, but files are stored on a file system with 32-bit on-disk time fields, then after the 32-bit time_t structure wraps around at 19-Jan-2038 03:14:07 UTC, any files created immediately after the wrap-around will appear to be 136 years old. The find command above will not function as intended after the wrap-around because it will delete files that have been created or modified recently, which needless to say could be catastrophic, especially if the files are deleted before they have been backed up.

Find using time64(), file system with 64-bit time fields

If the OS has support for time64(), and the find command has been patched and re-compiled to use it, and files are stored on a file system with 64-bit on-disk time fields, the find command above will continue to operate as intended after the wrap-around event.