Americas

  • United States
sandra_henrystocker
Unix Dweeb

How to find files on Linux

How-To
Jun 24, 20248 mins
Linux

There are many options you can use to find files on Linux, including searching by file name (or partial name), age, owner, group, size, type and inode number.

Concentrated businesswoman ceo at laptop, working at office desk with documents, searching surfing web internet online
Credit: Inside Creative House / Shutterstock

The Linux find command makes it easy to find files on your system – even if you don’t remember their names or exactly when you last updated them. Some of the options are a bit more challenging than others, but all are very handy. This post provides insights into the types of criteria you can use to find just what you’re looking for.

To begin, move into your terminal window and get ready to use the find command. The trick is understanding all of the criteria that you can use with find to describe the file you’re looking for. Just about anything you know about the file can help you with the search.

The basic syntax of the find command takes the form shown below, though find commands can be considerably more complicated.

find [starting point]  [what to look for]  [what to display]

Finding files by name

A very basic example of a find command might look like this:

$ find . -name myfile -print

This command would have the find command starting its search at your current location in the file system, looking for a file named “myfile” and then displaying any matching files (including their paths relative to the current position). And, yes, you might end up finding more than a single file.

$ find . -name myfile -print
./tests/eg/myfile
./tests/myfile

In the above example, the command displays only the name and location of the files that it finds. Use the -ls command instead of -print and you get the kind of details you’d expect when you list files with the ls -l command.

$ find . -name myfile -ls
    36417      4 -rw-r--r--   1 shs      shs       188 Jun 10 09:57 ./tests/eg/myfile
    36418      4 -rw-r--r--   1 shs      shs        83 Jun 10 09:57 ./tests/myfile

Understand that starting locations don’t have to be relative. You can always use a complete path like /home/jdoe or /usr/local/bin wherever you are sitting in the file system provided you have read access to those locations or use the sudo command to give you root-level access.

Finding files by partial name

To find differently named files that share only some portion of their filenames, enclose the shared portion of the file names in a string using quotes and use asterisks to specify the location of the variable portions of the file names (e.g., “*txt to find files with names that end in “txt”). In the command below, we find files that start with “zip”.

$ find /usr/bin -name "zip*"
/usr/bin/zipgrep
/usr/bin/zipinfo
/usr/bin/zip
/usr/bin/zipcloak
/usr/bin/zipnote
/usr/bin/zipsplit

Finding files by age

To find files that have been modified within the last 24 hours, use a command like this with the -mtime (modification time) option:

$ find . -mtime 0 -ls
     3060      0 drwx------   1 shs      shs          3050 Jun 10 10:35 .
    36415      0 drwxr-xr-x   1 shs      shs            16 Jun 10 09:54 ./tests
    36416      0 drwxr-xr-x   1 shs      shs            12 Jun 10 09:53 ./tests/eg

The 0 in that command means “0 days old” (i.e., less than a day old). You can also use -mtime with positive and negative signs. For example -mtime -2 or -mtime +4. Using -mtime -1 means “less than one day old”. Using -mtime +1 means “more than one day old”, so the results would be dramatically different.  If you’re looking for a file that you were working on a week ago, a command like this might work just fine:

$ find . -mtime -8 -ls

Another easy way to list recently modified files is to use the ls command. The -ltr arguments represent a long listing (-l), sort in newest-first time order (-t) and reverse the order (-r). Using these options, the files will be listed with the most recently modified files shown last.

$ ls -ltr | tail -11

Finding files by owner

You can find files by owner using a command like the one below but, depending on the location, you might need to use sudo to have sufficient privileges.

$ sudo find /home/george -user george -name report -ls
    36424    4 -rw-r--r--   1 george  george   201 Jun 10 11:21 /home/george/report

Finding files by group

To find files by the associated group, run a command like this:

$ sudo find /tmp -group lola -ls
      153      4 -rw-r--r--   1 lola     lola           53 Jun 10 12:08 /tmp/ToDo

Finding files by age relative to some other file

You can find files younger than other files by using the -newer option as in the command below that finds files that are newer than another file or directory called “tests”.

$ find -newer tests -ls
     3060      0 drwx------   1 shs      shs          3058 Jun 10 12:51 .
    36417      4 -rw-r--r--   1 shs      shs           188 Jun 10 09:57 ./tests/eg/myfile
    36418      4 -rw-r--r--   1 shs      shs            83 Jun 10 09:57 ./tests/myfile
    36421      0 -rw-r--r--   1 shs      shs             0 Jun 10 10:39 ./hoho
    36427      4 -rw-------   1 shs      shs            59 Jun 10 12:00 ./.lesshst

You can find files older than other files by using the -not and -newer options.

$ find -not -newer index.html -ls
    10116      4 -rw-r--r--   1 shs    shs     1256 Oct 17  2019 ./index.html
    10114      4 -rw-r--r--   1 shs    shs     1216 Oct 17  2019 ./example.com/index.html
    10137      4 -rw-r--r--   1 shs    shs     1886 Oct 17  2019 ./shen.org/index.html

The find command doesn’t appear to have an option for “older”.

Finding files by size

The command below finds files that are larger than 10 MB.

$ find . -type f -size +10M
./.cache/gnome-software/flatpak-system-default/components.xmlb
./.cache/mozilla/firefox/c8n9kgaz.default-release/safebrowsing/google4/goog-phish-proto.vlpset

You can also look for files smaller than a particular size as in this example:

$ cd /usr/bin
$ find . -type f -size -10M | head -5
./abrt-action-analyze-java
./amuFormat.sh
./anaconda-cleanup
./anaconda-disable-nm-ibft-plugin
./anaconda-nm-disable-autocons

Finding files by type

You can easily search for files based on the file type (i.e., file extension).

$ find . -name *.jpg -print
./images/guitar.jpg

Finding empty files

To find empty files, you can use the -size 0 option or just specify -empty as in the following examples:

$ find . -type f -size 0 -ls
    27503      0 -rw-r-----   1 shs      shs             0 Apr  2 12:04 ./junkfile
    36421      0 -rw-r--r--   1 shs      shs             0 Jun 10 10:39 ./hoho

$ find . -type f -empty -ls
    27503      0 -rw-r-----   1 shs      shs             0 Apr  2 12:04 ./junkfile
    36421      0 -rw-r--r--   1 shs      shs             0 Jun 10 10:39 ./hoho

Finding files with no current user or group

If you want to find files with no current user or group associated with them (i.e., the accounts are no longer included in the /etc/passwd and /etc/group files), you can use the -nouser or the -nogroup options with the find command as shown in the examples below. These commands are being run with sudo to ensure we have permission to see the file details.

$ sudo find -nouser -ls
      153      4 -rw-r--r--   1 1005     1005           53 Jun 10 12:08 ./ToDo
$ sudo find -nogroup -ls
      153      4 -rw-r--r--   1 1005     1005           53 Jun 10 12:08 ./ToDo 

Finding files by inode number

If needed, you can also find files using their inode numbers. An example is shown below.

$ find . -inum 10551 -ls
    10551      8 -rw-r--r--   1 shs      shs          6261 Oct  2  2023 ./links

How deeply to look

You can limit how deeply into the file system the find command will search for a particular file by using the -maxdepth option. In the scenario below, we create a ten-level directory structure, set up a file in the tenth directory, toss some text into it with the fortune command and then use the find command – first with and then without the -maxdepth option — to look for the new file. The -maxdepth option prevents the first search from continuing past the depth specified, so only one of these find commands finds it.

$ mkdir -p 1/2/3/4/5/6/7/8/9/10
$ fortune > 1/2/3/4/5/6/7/8/9/10/TheEnd
$ find . -maxdepth 7 -name TheEnd
$ find . -name TheEnd
./1/2/3/4/5/6/7/8/9/10/TheEnd

Removing files once you’ve found them

To remove a file after finding it with the find command, add the -delete option like this:

$ find . -name TheEnd -delete

Wrap-up

There really are a lot of very useful options to help you find files on your Linux system – so many, in fact, that it may take a while to digest them all!

sandra_henrystocker
Unix Dweeb

Sandra Henry-Stocker has been administering Unix systems for more than 30 years. She describes herself as "USL" (Unix as a second language) but remembers enough English to write books and buy groceries. She lives in the mountains in Virginia where, when not working with or writing about Unix, she's chasing the bears away from her bird feeders.

The opinions expressed in this blog are those of Sandra Henry-Stocker and do not necessarily represent those of IDG Communications, Inc., its parent, subsidiary or affiliated companies.

More from this author