/dev/fd/*

[Jeep Hauser]

Hi folks,

A friend's box was broken into (a Raq, not MOSX), and one of the 
commands the intruder did was:

	find / -mmin -180 -ls

If I understand this correctly, it will traverse the entire 
filesystem (when executed as root) and list (in -ls format) every 
file that has been modified in the last 180 minutes (though I'm not 
sure wh

For kick, I ran this on my MOSX box and found a *ton* of stuff in 
various /dev/fd/* subdirectories, notably .jpg files that are 
mirrored in my /Users/<username>/Photos/iPhoto Library directory. I 
can't seem to find a pattern as to why these files are still in 
/dev/fd (not all of my iPhoto files are in there, just some), nor why 
the output of the find command doesn't seem to limit itself to the 
last 180 minutes.

On the Raq (sorry, but I don't know the shell used), it truly returns 
files modified within 180 minutes. On my MOSX (10.3.2) tsch shell, it 
returns files going back to last summer.

When using '180' instead of '-180' it returns nothing at all. I don't 
know the difference, and the man pages aren't helping me figure that 
out.

Soooo... is find misbehaving? Is it MOSX?

How about all those files in /dev/df/* -- are those really just 
pointers to the actual files, or actual files? What I could find on 
/dev/df/* on Google talks about how it's like a /tmp for various 
things, but it's more complex than what I'm familiar with.

Thanks much,

Jeep