There are many options you can use to find files on Linux, including searching by file name (or partial name), age, owner, group, size, type and inode number.
The Linux find command makes it easy to find files on your system – even if you don’t remember their names or exactly when you last updated them. Some of the options are a bit more challenging than others, but all are very handy. This post provides insights into the types of criteria you can use to find just what you’re looking for.
To begin, move into your terminal window and get ready to use the find command. The trick is understanding all of the criteria that you can use with find to describe the file you’re looking for. Just about anything you know about the file can help you with the search.
The basic syntax of the find command takes the form shown below, though find commands can be considerably more complicated.
find [starting point] [what to look for] [what to display]
Finding files by name
A very basic example of a find command might look like this:
$ find . -name myfile -print
This command would have the find command starting its search at your current location in the file system, looking for a file named “myfile” and then displaying any matching files (including their paths relative to the current position). And, yes, you might end up finding more than a single file.
$ find . -name myfile -print ./tests/eg/myfile ./tests/myfile
In the above example, the command displays only the name and location of the files that it finds. Use the -ls command instead of -print and you get the kind of details you’d expect when you list files with the ls -l command.
$ find . -name myfile -ls
36417 4 -rw-r--r-- 1 shs shs 188 Jun 10 09:57 ./tests/eg/myfile
36418 4 -rw-r--r-- 1 shs shs 83 Jun 10 09:57 ./tests/myfile
Understand that starting locations don’t have to be relative. You can always use a complete path like /home/jdoe or /usr/local/bin wherever you are sitting in the file system provided you have read access to those locations or use the sudo command to give you root-level access.
Finding files by partial name
To find differently named files that share only some portion of their filenames, enclose the shared portion of the file names in a string using quotes and use asterisks to specify the location of the variable portions of the file names (e.g., “*txt“ to find files with names that end in “txt”). In the command below, we find files that start with “zip”.
$ find /usr/bin -name "zip*" /usr/bin/zipgrep /usr/bin/zipinfo /usr/bin/zip /usr/bin/zipcloak /usr/bin/zipnote /usr/bin/zipsplit
Finding files by age
To find files that have been modified within the last 24 hours, use a command like this with the -mtime (modification time) option:
$ find . -mtime 0 -ls
3060 0 drwx------ 1 shs shs 3050 Jun 10 10:35 .
36415 0 drwxr-xr-x 1 shs shs 16 Jun 10 09:54 ./tests
36416 0 drwxr-xr-x 1 shs shs 12 Jun 10 09:53 ./tests/eg
The 0 in that command means “0 days old” (i.e., less than a day old). You can also use -mtime with positive and negative signs. For example -mtime -2 or -mtime +4. Using -mtime -1 means “less than one day old”. Using -mtime +1 means “more than one day old”, so the results would be dramatically different. If you’re looking for a file that you were working on a week ago, a command like this might work just fine:
$ find . -mtime -8 -ls
Another easy way to list recently modified files is to use the ls command. The -ltr arguments represent a long listing (-l), sort in newest-first time order (-t) and reverse the order (-r). Using these options, the files will be listed with the most recently modified files shown last.
$ ls -ltr | tail -11
Finding files by owner
You can find files by owner using a command like the one below but, depending on the location, you might need to use sudo to have sufficient privileges.
$ sudo find /home/george -user george -name report -ls
36424 4 -rw-r--r-- 1 george george 201 Jun 10 11:21 /home/george/report
Finding files by group
To find files by the associated group, run a command like this:
$ sudo find /tmp -group lola -ls
153 4 -rw-r--r-- 1 lola lola 53 Jun 10 12:08 /tmp/ToDo
Finding files by age relative to some other file
You can find files younger than other files by using the -newer option as in the command below that finds files that are newer than another file or directory called “tests”.
$ find -newer tests -ls
3060 0 drwx------ 1 shs shs 3058 Jun 10 12:51 .
36417 4 -rw-r--r-- 1 shs shs 188 Jun 10 09:57 ./tests/eg/myfile
36418 4 -rw-r--r-- 1 shs shs 83 Jun 10 09:57 ./tests/myfile
36421 0 -rw-r--r-- 1 shs shs 0 Jun 10 10:39 ./hoho
36427 4 -rw------- 1 shs shs 59 Jun 10 12:00 ./.lesshst
You can find files older than other files by using the -not and -newer options.
$ find -not -newer index.html -ls
10116 4 -rw-r--r-- 1 shs shs 1256 Oct 17 2019 ./index.html
10114 4 -rw-r--r-- 1 shs shs 1216 Oct 17 2019 ./example.com/index.html
10137 4 -rw-r--r-- 1 shs shs 1886 Oct 17 2019 ./shen.org/index.html
The find command doesn’t appear to have an option for “older”.
Finding files by size
The command below finds files that are larger than 10 MB.
$ find . -type f -size +10M ./.cache/gnome-software/flatpak-system-default/components.xmlb ./.cache/mozilla/firefox/c8n9kgaz.default-release/safebrowsing/google4/goog-phish-proto.vlpset
You can also look for files smaller than a particular size as in this example:
$ cd /usr/bin $ find . -type f -size -10M | head -5 ./abrt-action-analyze-java ./amuFormat.sh ./anaconda-cleanup ./anaconda-disable-nm-ibft-plugin ./anaconda-nm-disable-autocons
Finding files by type
You can easily search for files based on the file type (i.e., file extension).
$ find . -name *.jpg -print ./images/guitar.jpg
Finding empty files
To find empty files, you can use the -size 0 option or just specify -empty as in the following examples:
$ find . -type f -size 0 -ls
27503 0 -rw-r----- 1 shs shs 0 Apr 2 12:04 ./junkfile
36421 0 -rw-r--r-- 1 shs shs 0 Jun 10 10:39 ./hoho
$ find . -type f -empty -ls
27503 0 -rw-r----- 1 shs shs 0 Apr 2 12:04 ./junkfile
36421 0 -rw-r--r-- 1 shs shs 0 Jun 10 10:39 ./hoho
Finding files with no current user or group
If you want to find files with no current user or group associated with them (i.e., the accounts are no longer included in the /etc/passwd and /etc/group files), you can use the -nouser or the -nogroup options with the find command as shown in the examples below. These commands are being run with sudo to ensure we have permission to see the file details.
$ sudo find -nouser -ls
153 4 -rw-r--r-- 1 1005 1005 53 Jun 10 12:08 ./ToDo
$ sudo find -nogroup -ls
153 4 -rw-r--r-- 1 1005 1005 53 Jun 10 12:08 ./ToDo
Finding files by inode number
If needed, you can also find files using their inode numbers. An example is shown below.
$ find . -inum 10551 -ls
10551 8 -rw-r--r-- 1 shs shs 6261 Oct 2 2023 ./links
How deeply to look
You can limit how deeply into the file system the find command will search for a particular file by using the -maxdepth option. In the scenario below, we create a ten-level directory structure, set up a file in the tenth directory, toss some text into it with the fortune command and then use the find command – first with and then without the -maxdepth option — to look for the new file. The -maxdepth option prevents the first search from continuing past the depth specified, so only one of these find commands finds it.
$ mkdir -p 1/2/3/4/5/6/7/8/9/10 $ fortune > 1/2/3/4/5/6/7/8/9/10/TheEnd $ find . -maxdepth 7 -name TheEnd $ find . -name TheEnd ./1/2/3/4/5/6/7/8/9/10/TheEnd
Removing files once you’ve found them
To remove a file after finding it with the find command, add the -delete option like this:
$ find . -name TheEnd -delete
Wrap-up
There really are a lot of very useful options to help you find files on your Linux system – so many, in fact, that it may take a while to digest them all!
