The find command is a useful command line utility that helps when you want to find a file or directory with a specific name, size, owner, permissions or other conditions.
One thing that find command can’t do is to search in the contents of files. If you need to find a file based on its contents, then you should use the grep command instead.
The way the find command works is that it starts its search from the directory that we specify, and searches that directory and all its subdirectories for files and directories that satisfy the conditions that we set.
Search using the name
One of the most common conditions that we can use is the file’s name.
Basic Syntax
To find all files and directories in the current directory and its subdirectories that are named “log”, you can use:
find . -name “log”
Here the dot specifies the directory that the search is started from. If no path is given here, the current directory will be used as default.
Case Sensitivity
By default, the search is case-sensitive. If you want the search to be case insensitive, you should use the iname flag.
find . -iname “log”
Using RegEx
You can use RegEx to match simple patterns in the filename. ? will match only one character and * will match any number of characters. Ranges of characters or numbers can be specified in square brackets.
For instance, to find all the files in the /etc/ that have exactly 3 characters in their name and have txt extension, you can use
find /etc/ -name “???.txt”
To find all files and directories in the /etc/ directory and its subdirectories with names starting with “log” followed by any number of characters, you can use:
find /etc/ -name “log*”
To find all the JavaScript files in the current directory and its subdirectories, you can use
find . -name “*.js”
To find all HTML files in the current directory, with names like file1.html or file5.html, you can use
find . -name “file[1-9].html”
Limiting the search to files or directories
We have the option to limit the search to only return files or only directories. To do that you can use the type flag and specify f for files or d for directories.
To only search files named ali:
find . -type f -name “ali”
To only search directories named ali:
find . -type d -name “ali”
Search Using Size
The size flag is used to set a condition on the size of the file. You can use it to find files with an exact size, or larger or smaller than a specific size.
For instance, to find all the files in the current directory that are larger than 100KB, you can use
find . -size +100k
To find all files smaller than 10MB
find . -size -10M
To find all files that are exactly 50 bytes:
find . -size 50c
Search Using The Owner User And Group
If you’re looking for files that are owned by a specific user or group, you can use the user and group flags.
To limit the search only to the files owned by the user “batman”, you can use
find . -user batman
To limit the search to only the files owned by the group “admins”
find -group admins
Search Using The Permissions
Another criteria you an use is the file permissions. To do that you need to use the perm flag. The perm flag can be used in different ways.
I you want to find files that have exactly the specified permissions, you can use the perm flag followed by that permissions.
find . -perm 664
Note that this command only matches files with the exact permissions , and won’t match a file with more permissions say 666 or 774.
If you wanna find files that have at least the specified permissions, but also may have more permissions, you should put a dash before the permissions.
find . -perm -664
This command finds files with permissions 664 and more. So it’ll match 664, 666, 764, etc.
Search Using The Last Change or Access Time
Another condition you can use is the last time the file was accessed or changed.
Access time of a file changes every time the file is read or changed. For the access time, you can use the amin flag. “a” stands for “access” and “min” stands for “minutes”.
For instance to limit he search only to files that were accessed in the last 5 minutes, you can use
find /etc/ -amin -5
And to only search for files that were last accessed more than 10 minutes, you can use
find /etc/ -amin +10
The syntax for the last status change time is to use the cmin flag. The “c” stands for “change” and “min” again means “minutes”. Note that the status of the file changes every time the permission, owner or the file content is changed.
So to only search for files that their status changed in the last minute, you can use
find /etc/ -cmin -1
Finally to search based on the last time the content of the file was modified, you can use the mmin flag. So to limit the search to files which their content were changed in the past hour, you can use
find . -mmin -60
Note that every time the content of a file is changed, mmin, cmin and amin is updated. But when the permissions or ownership of a file changes only cmin and amin changes, and finally every time a file is read, only amin is updated.
Depth of The Search
If you want to limit the search to sub-directories that are at most n levels below the starting point, or at least n levels below the starting point, you can use the maxdepth and mindepth options.
For instance, if you only want to search the starting directory but not any of the sub-directories, you can use
find . -maxdepth 0 -name “log”
For instance, if you want to limit the search to the starting directory and its child directories but not below that, you can use
find . -maxdepth 1 -name “log”
Other Useful Flags
-ls
This flag is super useful. it lists the information about the files in the output. In other words, it’s like executing ls on all of the files that the find command has found.
For instance to see the information of all files larger than 100 MB, you can use
find . type -f -size +100M -ls
-empty
Matches the empty files and directories. For instance to find all empty directories under the current directory, you can use
find . -type d -empty
Executing a Command on Files That Find Command Finds!
After you’ve finally found the files or directories that match your criteria, you may want to execute a command on all of them. For instance you may wanna change their permissions or owners or maybe even remove them. To do that you can use the exec option.
For instance to remove all the files in the current directory that are larger then 10 MB, you can use
find . -type f -size +10M -exec rm {} +
Or if you wanna find all JavaScript files under current directory, and then search the contents of those files for the word “app”, you can use
find . -name “*.js” -exec grep “app” {} +
In this article, I went over the most useful options of the find command.