find

The find command walks a directory tree and tests each entry against criteria such as its name, type, size, or modification time.

Choosing Where to Search

The basic syntax is:

find [PATH] [EXPRESSION]

The path chooses the starting point, and the expression selects or acts on entries below it.

This command searches /home and its descendants for entries named puppies.jpg:

$ find /home -name puppies.jpg

Recursion is the default. Use . as the starting path when you want to search the current directory tree.

Matching Names and Types

The -name test accepts an exact basename or a shell-style pattern. Quote wildcard patterns so the current shell passes them unchanged to find:

$ find . -name "*.txt"

Without the quotes, the shell may expand *.txt against the current directory before find begins. Use -iname instead of -name when the name match should ignore letter case.

Add -type d to select directories or -type f to select regular files:

$ find /home -type d -name MyFolder

Both tests must be true here: the entry must be a directory and its basename must be MyFolder.

Matching Size and Modification Time

Use -size with + for greater than the specified unit or - for less than it:

$ find . -type f -size +10M
$ find . -type f -size -1k

Here, uppercase M represents 1,048,576-byte units, while lowercase k represents 1,024-byte units. find rounds sizes up to the selected unit before applying the numeric comparison, so boundary behavior is based on those units.

Use -mtime to test the number of complete 24-hour periods since the file was modified:

$ find . -type f -mtime -7
$ find . -type f -mtime +30

-mtime -7 matches a value less than 7, while -mtime +30 matches a value greater than 30. Because complete 24-hour periods are used, these tests are not based on calendar-midnight boundaries.

Printing and Acting on Matches

If no action is supplied, GNU find prints matching paths. You can write -print explicitly when you want the expression's action to be clear:

Print matches explicitly:

$ find . -name "*.log" -print

Use -exec to run another command for matches:

$ find . -name "*.log" -exec ls -l {} \;

For the \; form, {} is replaced by one matching pathname for each command invocation. The semicolon terminates the -exec action and is escaped so the shell passes it to find.

Before using a destructive action such as -delete or an -exec command that changes files, run the same tests with -print and inspect every result. A narrower starting path and -maxdepth N can also limit the search.

Permission-denied messages usually mean the current account cannot search part of the tree. Prefer a narrower, relevant starting path; do not add elevated privileges until you understand and intend the expanded access.

To practice building search expressions, try these hands-on labs:

1. Linux find Command: File Searching - This lab provides an introduction to the find command, a versatile utility for searching and locating files and directories based on various criteria. You'll practice using find to locate specific files.
2. Discover Critical System Resources - Learn essential Linux commands for locating files and executables, including find. You'll practice efficiently navigating the file system and discovering critical system resources.

Summary

You can now build focused find expressions and verify results before taking action.

1. Choose the narrowest useful starting path.
2. Quote name patterns and combine them with type tests.
3. Filter by size or complete 24-hour modification periods.
4. Limit recursion depth when appropriate.
5. Print and inspect matches before destructive actions.