Searching for un-used files

Question

Our Marketing department is close to maxing out 5.5 TBs of disk on our Xraid. Is there a way to search on files that have not been read in "x" number of days (likely a search that would show files that have not read before a particular date)?
I'm using the term "read" because we likely have many older files (image files) that have an older Created or Modified date, but are read for printing, PDF creation and collecting for print and will need to be retained. I just want to locate the files that have not been touched in 18 months, including read for creating a PDF or printing.

Answer 1

If your volume is indexed via spotlight, you might be able to pull this off. I said might. You really must test this because you are asking for if the file is "Read." The challenge here is that I am not sure if Spotlight will update a file that is read as compared to a file that is opened. So test this first. But, in theory, this might point you in the right direction.
First, create or collect a bunch of sample files. Then start investigating those files using the mdls command. For example, if I have files titled one.txt, two.mov, and three.doc, I might get a result similar to this when using mdls one.txt:
kMDItemContentCreationDate = 2009-06-24 17:05:15 -0400
kMDItemContentModificationDate = 2009-06-24 17:05:32 -0400
kMDItemContentType = "dyn.ah62d4rv4ge80g55sq2"
kMDItemContentTypeTree = (
"public.data",
"public.item"
kMDItemDisplayName = "one.txt"
kMDItemFSContentChangeDate = 2009-06-24 17:05:32 -0400
kMDItemFSCreationDate = 2009-06-24 17:05:15 -0400
kMDItemFSCreatorCode = ""
kMDItemFSFinderFlags = 0
kMDItemFSHasCustomIcon = 0
kMDItemFSInvisible = 0
kMDItemFSIsExtensionHidden = 0
kMDItemFSIsStationery = 0
kMDItemFSLabel = 0
kMDItemFSName = "one.txt"
kMDItemFSNodeCount = 0
kMDItemFSOwnerGroupID = 20
kMDItemFSOwnerUserID = 501
kMDItemFSSize = 23
kMDItemFSTypeCode = ""
kMDItemKind = "Document"
kMDItemLastUsedDate = 2009-06-27 08:39:44 -0400
kMDItemUsedDates = (
2009-06-24 00:00:00 -0400,
2009-06-27 00:00:00 -0400
Ok, so you have some attributes that are based on time displayed in the results (kMDItemContentCreationDate , kMDItemFSContentChangeDate, kMDItemContentModificationDate, kMDItemFSCreationDate, and kMDItemLastUsedDate). The one that may provide what you are looking for is kMDItemLastUsedDate. This attribute will update each time a file is opened. Here is where the "read" part of your question comes in. I am guessing you are supporting the creative industry, likely desktop publishing. You have documents that point to images. Many never change but are used all the time. That being the case, I did not test to see if kMDItemLastUsedDate updates on an InDesign place or collect. I will let you test that.
If this works, then you can use mdfind to find files older than 7 days old. Here is how you do it:
mdfind -onlyin /Path/to/data 'kMDItemLastUsedDate <= $time.today(-7)'
The structure here is simple. Tell mdfind to look only in /Path/to/data (set this to your real path) and search for any file whose kMDItemLastUsedDate attribute is less than or equal to 7 days old (increase or decrease the number as needed).
This will produce a list of files. With a little shell scripting you can take the list and then act on it. ie: move the files, archive them, etc.
As mentioned, you need to test your specific condition. I am curious to know if a place or update links will trigger an update to kMDItemLastUsedDate.
Hope this helps.
Message was edited by: Strontium90