The Linux find command makes it easy to locate files on your system – even if you don’t remember their names or the exact time you last updated them. Some options might be more challenging than others, but all are incredibly useful. This post provides insights into the types of criteria you can use to find exactly what you’re looking for.
To begin, open your terminal window and get ready to use the find command. The key is understanding the various criteria you can use with find to specify the file you’re searching for. Just about any detail you know about the file can aid in your search.
The basic syntax of the find command is illustrated below, though find commands can be considerably more complex.
find [starting point] [what to look for] [what to display]
A very basic example of a find command might look like this:
This command would have the find command starting its search at your current location in the file system, looking for a file named “myfile” and then displaying any matching files (including their paths relative to the current position). And, yes, you might end up finding more than a single file.
In the above example, the command displays only the name and location of the files that it finds. Use the -ls command instead of -print and you get the kind of details you’d expect when you list files with the ls -l command.
Understand that starting locations don’t have to be relative. You can always use a complete path like /home/jdoe or /usr/local/bin wherever you are sitting in the file system provided you have read access to those locations or use the sudo command to give you root-level access.
To find differently named files that share only some portion of their filenames, enclose the shared portion of the file names in a string using quotes and use asterisks to specify the location of the variable portions of the file names (e.g., “*txt“ to find files with names that end in “txt”). In the command below, we find files that start with “zip”.
To find files that have been modified within the last 24 hours, use a command like this with the -mtime (modification time) option:
The 0 in that command means “0 days old” (i.e., less than a day old). You can also use -mtime with positive and negative signs. For example -mtime -2 or -mtime +4. Using -mtime -1 means “less than one day old”. Using -mtime +1 means “more than one day old”, so the results would be dramatically different. If you’re looking for a file that you were working on a week ago, a command like this might work just fine:
Another easy way to list recently modified files is to use the ls command. The -ltr arguments represent a long listing (-l), sort in newest-first time order (-t) and reverse the order (-r). Using these options, the files will be listed with the most recently modified files shown last.
You can find files by owner using a command like the one below but, depending on the location, you might need to use sudo to have sufficient privileges.
To find files by the associated group, run a command like this:
You can find files younger than other files by using the -newer option as in the command below that finds files that are newer than another file or directory called “tests”.
You can find files older than other files by using the -not and -newer options.
The find command doesn’t appear to have an option for “older”.
The command below finds files that are larger than 10 MB.
You can also look for files smaller than a particular size as in this example:
You can easily search for files based on the file type (i.e., file extension).
To find empty files, you can use the -size 0 option or just specify -empty as in the following examples:
If you want to find files with no current user or group associated with them (i.e., the accounts are no longer included in the /etc/passwd and /etc/group files), you can use the -nouser or the -nogroup options with the find command as shown in the examples below. These commands are being run with sudo to ensure we have permission to see the file details.
If needed, you can also find files using their inode numbers. An example is shown below.
You can limit how deeply into the file system the find command will search for a particular file by using the -maxdepth option. In the scenario below, we create a ten-level directory structure, set up a file in the tenth directory, toss some text into it with the fortune command and then use the find command – first with and then without the -maxdepth option — to look for the new file. The -maxdepth option prevents the first search from continuing past the depth specified, so only one of these find commands finds it.
To remove a file after finding it with the find command, add the -delete option like this:
There really are a lot of very useful options to help you find files on your Linux system – so many, in fact, that it may take a while to digest them all!
