Find

Getting Started

Introduction to find command and basic concepts

What is Find

Understanding find command and its purpose for filesystem searching

Find command overview and basic syntax

Find walks the filesystem tree starting from the specified path, showing found items that match criteria.

Code

# Find command: search filesystem for files matching criteria
# Syntax: find [path] [options] [expression]

# Key advantages:
# - Search by name, size, type, time, permissions
# - Walk directory trees recursively
# - Execute commands on found files
# - Filter by file properties
# - Combine multiple criteria with logical operators

# Basic structure:
# find /search/path -name "pattern"
# find . -type f -size +1M
# find /var/log -mtime +30

Execution

find /home -maxdepth 2 -type d 2>/dev/null | head -5

Output

/home
/home/user
/home/user/Documents
/home/user/Downloads
/home/user/Desktop

Find searches recursively by default
-maxdepth limits directory traversal depth
Returns full paths to found files
Redirect stderr (2>/dev/null) to hide permission errors

Find vs other search tools

Find is ideal for complex searches combining multiple criteria like file type, name pattern, and location.

Code

# Compare find with similar tools:
# find: Search filesystem by name, size, type, time, permissions
# locate: Fast search using pre-built database
# grep: Search within file contents (text)
# ls: List directory contents (no recursive search)

# Use find when you need:
# - Recursive filesystem search
# - Filter by file properties (size, type, time, permissions)
# - Execute commands on found files
# - Complex search criteria
# - Real-time search (database not needed)

Execution

find /tmp -maxdepth 1 -type f -name "*.tmp" 2>/dev/null | wc -l

Output

Find is more flexible than locate for custom criteria
Slower than locate but more current
Can execute actions on matched files
Better for scripts and automation

Installation and Setup

Installing and verifying find functionality on different systems

Verify find installation

Find is typically pre-installed on Linux systems. Verify availability and version.

Code

# Check if find is installed
which find

# Display find version
find --version

# Show find help
find --help | head -20

Execution

which find && find --version | head -1

Output

/usr/bin/find
find version 4.8.0

Find is standard on all Unix-like systems
Different versions available: GNU find, BSD find
GNU find has more options
BSD find is on macOS by default

Install find on different systems

Find is available on all standard Linux systems and macOS, usually pre-installed.

Code

# Ubuntu/Debian
sudo apt-get update
sudo apt-get install -y findutils

# CentOS/RHEL
sudo yum install -y findutils

# Alpine Linux
apk add findutils

# Arch Linux
sudo pacman -S findutils

# macOS (usually pre-installed)
brew install findutils  # Installs GNU find as gfind

Execution

find /usr/bin -name "find" -o -name "gfind"

Output

/usr/bin/find

Findutils package provides GNU find
macOS comes with BSD find by default
Install GNU find (gfind) on macOS for compatibility
Always available on modern Linux distributions

Basic Search

Simple file searching by name and basic patterns

Simple Name Search

Basic file searching by name patterns

Search for files by exact name

Find searches recursively from the specified path for files matching the name pattern.

Code

# Find files by exact name
find . -name "filename.txt"

# Search in specific directory
find /home -name "*.log"

# Search entire filesystem
find / -name "config.ini"

# Multiple directories
find /etc /var -name "*.conf"

Execution

find /tmp -name "*.tmp" 2>/dev/null | head -3

Output

/tmp/file1.tmp
/tmp/cache/file2.tmp
/tmp/sessions/file3.tmp

Pattern matching uses shell-style wildcards
* matches any characters in a filename
matches single character:
[ ] matches character ranges
Search is recursive through all subdirectories

Name search with wildcards

Wildcard patterns provide flexible name matching for common file extensions and naming conventions.

Code

# Find all Python files
find . -name "*.py"

# Find by prefix
find . -name "test_*"

# Find by suffix
find . -name "*.backup"

# Complex patterns
find . -name "*[0-9].txt"  # filenames with digits

Execution

find /home -maxdepth 2 -name "*.md" 2>/dev/null | head -5

Output

/home/user/README.md
/home/user/Documents/guide.md
/home/user/Downloads/tutorial.md

* matches zero or more characters
matches exactly one character:
Patterns are case-sensitive
Use quotes to prevent shell expansion

Case-Insensitive Search

Search for files ignoring case sensitivity

Case-insensitive file name search

The -iname flag performs case-insensitive filename matching, useful when unsure of case.

Code

# -iname flag for case-insensitive matching
find . -iname "README.txt"

# Matches: readme.txt, README.TXT, ReadMe.txt, etc.
find . -iname "*.LOG"

# Case-insensitive wildcard patterns
find /var -iname "*.pdf"

Execution

find /home -maxdepth 2 -iname "*.LOG" 2>/dev/null

Output

/home/user/app.log
/home/user/system/ERROR.LOG

-iname is case-insensitive version of -name
Matches regardless of upper/lowercase
Combines with wildcards for flexible searching
Slower than -name (case-sensitive)

Mixed case pattern matching

Case-insensitive searching helps find files when exact case is unknown.

Code

# Search for backup files regardless of case
find . -iname "*.backup"  # .backup, .BACKUP, .Backup

# Configuration files with various cases
find /etc -iname "*.conf"

# Executable scripts (any case)
find . -iname "*install*"

Execution

find /tmp -maxdepth 1 -iname "test*" 2>/dev/null | head -5

Output

/tmp/test_file.txt
/tmp/TEST_data
/tmp/Test_logs.txt

Useful for cross-platform searches
Handles case variations in naming
Works with all wildcard patterns

Path Matching

Search by full path or path patterns

Search by full path pattern

-path matches the entire path from start, useful for excluding directories or matching nested structures.

Code

# -path for full path matching
find . -path "*node_modules*"

# Match specific directory structure
find . -path "*/src/components/*.js"

# Exclude patterns with -not
find . -path "*node_modules" -prune -o -name "*.js" -print

# Case-insensitive path matching
find . -ipath "*/downloads/*"

Execution

find /home -maxdepth 3 -path "*Document*" 2>/dev/null

Output

/home/user/Documents
/home/user/Documents/files

-path matches from start of path being tested
* matches path separators (unlike -name)
-ipath is case-insensitive version
Use -prune to skip directories efficiently

Path matching with directory pruning

Combining -prune with -o (or) and -print efficiently skips directories while finding matching files.

Code

# Find JavaScript files, skip node_modules
find . -name "node_modules" -prune -o -name "*.js" -print

# Exclude multiple directories
find . \( -path "*/node_modules" -o -path "*/.git" \) -prune -o -name "*.ts" -print

# Find test files, exclude temp directories
find . -path "*/temp" -prune -o -name "*test*" -print

Execution

find /home -maxdepth 3 -name ".git" -prune -o -type f -name "*.py" -print 2>/dev/null | head -3

Output

/home/user/script.py
/home/user/projects/tool.py
/home/user/projects/utils.py

-prune skips entire directory without descending
More efficient than grep/filter after find
Use with logical operators for complex patterns

Type Matching

Search by file type (regular files, directories, symlinks, etc.)

Search by file type

-type d filters to show only directories, excluding regular files and other types.

Code

# -type flag specifies file type
# f = regular file
# d = directory
# l = symbolic link
# c = character device
# b = block device
# p = named pipe
# s = socket

find . -type f       # regular files only
find . -type d       # directories only
find . -type l       # symbolic links
find /dev -type c    # character devices

Execution

find /home -maxdepth 2 -type d 2>/dev/null | head -5

Output

/home
/home/user
/home/user/Documents
/home/user/Downloads
/home/user/Desktop

f for regular files is most common type
d for directories, l for symlinks
Device types (c, b) typically in /dev
Type matching improves search efficiency

Combining type with name search

Combining -type f with -name "*.md" finds only regular markdown files, excluding directories.

Code

# Find Python files (regular files only)
find . -type f -name "*.py"

# Find directories matching pattern
find . -type d -name "*test*"

# Find symlinks to files
find . -type l -name "*.txt"

# Find broken symlinks (point to nothing)
find . -type l ! -exec test -e {} \;

Execution

find /home -maxdepth 2 -type f -name "*.md" 2>/dev/null | head -3

Output

/home/user/README.md
/home/user/Documents/guide.md
/home/user/Downloads/tutorial.md

Always use -type f with name patterns for efficiency
Reduces false positives from directories
Works with other criteria like size and time

File Size & Type

Filter files by size and specific type tests

Size Filtering

Search files by size with various units and comparisons

Find files by size

-size finds files larger than 10MB, useful for identifying large files consuming disk space.

Code

# -size flag for file size filtering
# c = bytes
# k = kilobytes (1024 bytes)
# M = megabytes (1024 KB)
# G = gigabytes (1024 MB)

find . -size +1M        # larger than 1MB
find . -size -1M        # smaller than 1MB
find . -size 100c       # exactly 100 bytes
find . -size 5k         # exactly 5 kilobytes

Execution

find /home -maxdepth 2 -type f -size +10M 2>/dev/null

Output

/home/user/Downloads/large_video.mp4
/home/user/backup/archive.tar.gz

+ means larger than, - means smaller than
No prefix means exactly that size
Units: c (bytes), k (1024 bytes), M (1024 KB), G (1024 MB)
Size is rounded, so +1M includes files > 1,048,576 bytes

Find disk space hogs

Combining size criteria finds files in specific size ranges for storage analysis.

Code

# Find large files for cleanup
find . -type f -size +100M

# Find files exactly 1MB
find . -type f -size 1M

# Range of sizes
find . -type f -size +1M -size -100M

# Empty files (special case)
find . -type f -size 0

Execution

find /tmp -type f -size +1M 2>/dev/null

Output

/tmp/cache/large.dat

Size filtering helps manage disk usage
Use + and - to define ranges
Combine with -type f for accuracy

File Type Tests

Test file type with specific attributes

Search by specific file types

Find searches for character devices in /dev, which are special file types representing hardware.

Code

# Find symbolic links
find . -type l

# Find character devices
find /dev -type c

# Find block devices
find /dev -type b

# Find named pipes (FIFOs)
find /tmp -type p

# Find sockets
find /run -type s

Execution

find /dev -maxdepth 1 -type c 2>/dev/null | head -3

Output

/dev/null
/dev/zero
/dev/random

l = symlinks, c = character devices, b = block devices
Useful for system administration tasks
Device files in /dev controlled by kernel

Advanced type combinations

Finding symbolic links helps identify shortcuts and dependencies in the filesystem.

Code

# Find broken symlinks
find . -type l -xtype l

# Find symlinks to directories
find . -type l

# Find all non-regular files
find . ! -type f

# Find files and directories (not devices)
find . \( -type f -o -type d \)

Execution

find /home -maxdepth 3 -type l 2>/dev/null | head -3

Output

/home/user/.oh-my-zsh -> /usr/share/oh-my-zsh
/home/user/.config/app/plugins -> ../../../opt/plugins

-xtype tests the type of file link points to
operator negates conditions
Parentheses group conditions with -o (or)

Empty Files

Search for empty files and directories

Find empty files and directories

Find locates empty files with -size 0 or using -empty test flag.

Code

# Find empty regular files
find . -type f -size 0

# Find empty directories
find . -type d -empty

# Find and delete empty files
find . -type f -size 0 -delete

# Find empty files with timestamp info
find . -type f -size 0 -ls

Execution

find /tmp -maxdepth 2 -type f -size 0 2>/dev/null | head -3

Output

/tmp/placeholder.txt
/tmp/cache/empty.log

-size 0 finds files with zero bytes
-empty tests both empty files and directories
Useful for cleanup operations
Be careful with -delete flag

Cleanup empty files

Combining -empty with -delete removes empty files, useful for storage cleanup.

Code

# Count empty files
find . -type f -size 0 | wc -l

# Remove empty files and directories
find . -type f -empty -delete
find . -type d -empty -delete

# Safe delete with confirmation
find . -type f -size 0 -exec rm -i {} \;

Execution

find /tmp -maxdepth 1 -type f -empty 2>/dev/null | wc -l

Output

-delete removes found items permanently
-exec with -i provides confirmation before delete
Test before deleting on important filesystems

Time-Based Search

Search files by modification, access, and change times

Modification Time

Search files by modification time

Find files by modification time

Find locates files modified more than 30 days ago, useful for archiving old logs.

Code

# -mtime flag: modification time in days
# n = exactly n days old
# +n = more than n days old
# -n = less than n days old

find . -mtime 0       # modified today
find . -mtime 1       # modified exactly 1 day ago
find . -mtime +30     # modified more than 30 days ago
find . -mtime -7      # modified in last 7 days

Execution

find /var/log -maxdepth 1 -type f -mtime +30 2>/dev/null

Output

/var/log/syslog.1
/var/log/secure.log

mtime is modification time in complete days
+30 means more than 30 days (older)
-7 means less than 7 days (newer)
0 means today (last 24 hours)

Archive old files

Find can identify recently modified files for backup or analysis purposes.

Code

# Find and archive logs older than 90 days
find /var/log -type f -mtime +90 | tar czf archive.tar.gz --files-from=-

# Find old backup files and delete
find /backups -type f -name "*.bak" -mtime +365 -delete

# Find recently modified files
find . -type f -mtime -1  # last 24 hours

Execution

find /tmp -maxdepth 2 -type f -mtime 0 2>/dev/null | head -3

Output

/tmp/session-20250228.dat
/tmp/cache/update.log

-mtime 0 means modified since midnight
Use with -mmin for minute-level precision
Useful for automated cleanup scripts

Access Time

Search files by access time (when file was read)

Find files by access time

Find files not accessed for more than 6 months, candidates for archiving.

Code

# -atime flag: access time (last read)
find . -atime 0        # accessed today
find . -atime +30      # accessed more than 30 days ago
find . -atime -7       # accessed in last 7 days

# Find files never accessed since modification
find . -amin -10       # accessed in last 10 minutes

Execution

find /home -maxdepth 2 -type f -atime +180 2>/dev/null | head -3

Output

/home/user/.cache/old_cache.db
/home/user/Documents/archive.zip

atime = access time (when file was read)
Measured in days with -atime
Use -amin for minute precision
Some filesystems disable atime for performance

Find unused files for cleanup

Finding rarely accessed files helps identify candidates for removal to free disk space.

Code

# Find files not accessed in a year
find . -type f -atime +365

# Find large files not accessed recently
find . -type f -size +1M -atime +90

# List files with access time info
find . -type f -atime +30 -ls

Execution

find /tmp -maxdepth 1 -type f -atime +7 2>/dev/null | head -2

Output

/tmp/download.tmp

atime tracking may be disabled on some systems
Combine with size for storage analysis
Use with -ls to see file details

Change Time

Search files by change time (metadata changes)

Find files by change time

Find system configuration files changed in the last 24 hours (permissions or ownership changes).

Code

# -ctime flag: change time (inode changes)
# Changed when: content modified, permissions changed, owner changed
find . -ctime 0        # changed today
find . -ctime +7       # changed more than 7 days ago
find . -ctime -1       # changed in last 24 hours

# Find files with recent permission changes
find . -ctime -1 ! -mtime -1

Execution

find /etc -maxdepth 1 -type f -ctime -1 2>/dev/null | head -3

Output

/etc/shadow
/etc/passwd

ctime = change time (metadata like permissions, ownership)
Different from mtime (content modification)
Updated when inode information changes
Useful for detecting permission changes

Monitor configuration changes

Find files with recent timestamp or permission modifications for monitoring system changes.

Code

# Find config files changed recently
find /etc -name "*.conf" -ctime -1

# Find permission changes (ctime but not mtime change)
find . -ctime -1 ! -mtime -1

# System changes detection
find /etc -type f -ctime -7

Execution

find /home -maxdepth 2 -type f -ctime -1 2>/dev/null | head -3

Output

/home/user/.bash_history
/home/user/.cache/recent.db

Useful for security monitoring
Detects permission/ownership changes
Different from mtime for pure content changes

Minute-Based Searches

Search files by minute-level time precision

Find files by minute-level time

Find files modified in the last 10 minutes for monitoring recent activity.

Code

# -mmin, -amin, -cmin for minute precision
# Same operators as day versions

find . -mmin -5        # modified in last 5 minutes
find . -mmin 0         # modified in current minute
find . -amin +60       # not accessed in 60+ minutes
find . -cmin -10       # changed in last 10 minutes

Execution

find /tmp -maxdepth 1 -type f -mmin -10 2>/dev/null | head -3

Output

/tmp/session.log
/tmp/cache/update.dat

-mmin uses minutes instead of days
Same operators: +n (older), -n (newer)
-amin for access time in minutes
-cmin for change time in minutes

Real-time file monitoring

Minute-level searches enable real-time monitoring of file activity.

Code

# Find files modified in last minute
find /var/log -type f -mmin -1

# Find recently created files
find . -type f -cmin -2

# Monitor temp directory
watch -n 60 'find /tmp -type f -mmin -5'

# Activity monitoring script
while true; do find . -type f -mmin -1; sleep 60; done

Execution

find /var -maxdepth 1 -type f -mmin -30 2>/dev/null | head -3

Output

/var/adm/sulog
/var/syslog/current

Useful for logs and activity monitoring
Can be used in watch loops
Helpful for debugging and troubleshooting

Permissions & Ownership

Search files by permissions and ownership

Permission Tests

Search files by permission settings

Find files by permission

Find files with exactly 644 permissions (rw-r--r--), common for regular files.

Code

# -perm flag for permission matching
find . -perm 644       # exactly 644 (rw-r--r--)
find . -perm -644      # has at least these permissions
find . -perm /644      # matches any of these bits
find . -perm u+x       # user executable
find . -perm -u=rwx    # has all permissions for user

Execution

find /home -maxdepth 2 -type f -perm 644 2>/dev/null | head -3

Output

/home/user/.bashrc
/home/user/file.txt
/home/user/Documents/readme.md

-perm mode matches exactly that permission mode
-perm -mode matches files with at least those permissions
-perm /mode matches any of the specified bits
Modes can be octal (644) or symbolic (a+r)

Find dangerous permissions

Find SUID files which run with owner privileges, security-critical to monitor.

Code

# Find world-writable files
find . -perm -o=w

# Find SUID files
find / -perm -u+s

# Find SGID files
find / -perm -g+s

# Find sticky bit files
find / -perm -u+t

# Find world-readable sensitive files
find /etc -type f -perm -o=r

Execution

find /usr -maxdepth 2 -type f -perm -u+s 2>/dev/null | head -3

Output

/usr/bin/sudo
/usr/bin/passwd
/usr/bin/chfn

-o=w finds world-writable files (security risk)
-u+s finds SUID bits (runs as owner)
-g+s finds SGID bits (runs as group)
u+t finds sticky bit (often on /tmp)

User/Group Ownership

Search files by user or group ownership

Find files by user ownership

Find files owned by root in user directories, potentially security issues.

Code

# -user flag for user ownership
find . -user root       # owned by root
find . -user nobody     # owned by nobody user
find /home -user $USER  # files owned by current user
find . ! -user root     # NOT owned by root

# Find files by numeric UID
find . -uid 1000        # files with UID 1000

Execution

find /home -maxdepth 2 -user root 2>/dev/null | head -3

Output

/home/shared/admin-config
/home/shared/system-backup

-user looks up username from /etc/passwd
-uid uses numeric user ID directly
-user negates the condition
$USER expands to current username

Find files by group ownership

Find directories owned by the 'users' group.

Code

# -group flag for group ownership
find . -group admin     # group-owned by admin
find . -group staff     # group staff
find /tmp -group root   # temp files owned by root
find . ! -group wheel   # NOT group wheel

# Find files by numeric GID
find . -gid 1001        # files with GID 1001

Execution

find /home -maxdepth 1 -type d -group users 2>/dev/null

Output

/home/user1
/home/user2

-group looks up group name from /etc/group
-gid uses numeric group ID directly
-group negates the condition

Executable/Readable/Writable Tests

Search files by specific permission tests

Find executable files

Find executable files matching pattern - shell commands like ls.

Code

# -executable tests if file is executable by current user
find . -type f -executable

# Executable scripts
find . -type f -executable -name "*.sh"

# Non-executable regular files
find . -type f ! -executable

# Find executable in PATH
find $PATH -type f -executable -name "find"

Execution

find /usr/bin -maxdepth 1 -type f -executable -name "ls*" 2>/dev/null

Output

/usr/bin/ls

-executable tests if current user can execute
Works with -name for specific executable search
-executable finds non-executable files
Useful for security audits

Find readable and writable files

Find read-only files which are readable but not writable by current user.

Code

# -readable tests if file is readable by current user
find . -type f -readable

# -writable tests if file is writable by current user
find . -type f -writable

# Files readable but not writable
find . -type f -readable ! -writable

# Writable-only files (unusual)
find . -type f ! -readable -writable

Execution

find /home -maxdepth 2 -type f -readable ! -writable 2>/dev/null | head -3

Output

/home/user/important.txt
/home/user/Documents/archive

-readable tests read permission for current user
-writable tests write permission
Respects user's actual permissions
Useful for access verification

Advanced Operations

Complex operations combining multiple criteria

Logical Operators

Combine multiple search criteria using logical operators

Combine conditions with AND and OR

Find files with either .py or .js extension using OR operator with parentheses.

Code

# -and (implicit between conditions)
find . -type f -name "*.py"  # type AND name

# -o for OR operator
find . \( -name "*.py" -o -name "*.js" \)

# ! for NOT operator
find . ! -name "*.tmp"

# Complex combinations
find . -type f \( -name "*.log" -o -name "*.txt" \) -size +1M

Execution

find /home -maxdepth 2 -type f \( -name "*.py" -o -name "*.js" \) 2>/dev/null | head -3

Output

/home/user/script.py
/home/user/app.js
/home/user/projects/utils.py

Multiple conditions are AND by default (implicit)
-o provides OR logic
! provides NOT logic
Parentheses group conditions
Escape parentheses in shell:

Complex logical expressions

Find large document files combining OR logic with size filtering.

Code

# Find large files modified today OR accessed recently
find . -size +10M \( -mtime 0 -o -atime -1 \)

# Find Python files not in test directory
find . -name "*.py" ! -path "*/test*"

# Find recently modified OR changed files
find . \( -mtime -1 -o -ctime -1 \) -type f

# Complex: large old files not backed up
find . -size +100M -mtime +90 ! -name "*.backup"

Execution

find /home -maxdepth 2 -type f \( -name "*.pdf" -o -name "*.doc" \) -size +1M 2>/dev/null | head -3

Output

/home/user/Documents/thesis.pdf
/home/user/Downloads/manual.pdf

Group with parentheses for complex expressions
AND binds tighter than OR in traditional logic
Parentheses ensure proper evaluation order

Directory Pruning

Skip directories to improve search performance

Prune directories to skip recursion

Prune .cache directory to skip hidden cache, finding only markdown files.

Code

# -prune skips directory without descending
find . -name "node_modules" -prune -o -name "*.js" -print

# Skip multiple directories
find . \( -path "*/node_modules" -o -path "*/.git" \) -prune -o -type f -print

# Skip .git and .venv
find . -name ".git" -prune -o -name ".venv" -prune -o -type f -print

# Common excluded directories
find . -path "*/.git" -prune -o -path "*/node_modules" -prune -o -type f -print

Execution

find /home -maxdepth 2 -name ".cache" -prune -o -type f -name "*.md" -print 2>/dev/null | head -3

Output

/home/user/README.md
/home/user/Projects/guide.md

-prune stops descending into matched directories
Much faster than searching and filtering
Used in "path -prune -o action -print" pattern
-o (or) follows -prune for alternative action

Efficient recursive search with prune

Combined pruning of multiple directories for efficient searching while excluding unneeded paths.

Code

# Find source files, skip build and cache
find . -type d \( -name "build" -o -name "dist" -o -name ".cache" \) -prune -o -type f -name "*.src" -print

# Search for config files, skip system directories
find /home -type d -name ".config" -prune -o -name "config.json" -print

# Find all files, avoid large directories
find . \( -name "node_modules" -o -name ".git" -o -name "venv" \) -prune -o -type f -print

Execution

find /tmp -maxdepth 3 \( -name ".git" -o -name ".cache" \) -prune -o -type f -print 2>/dev/null | head -3

Output

/tmp/session.log
/tmp/data/config.json

Parentheses group multiple -name conditions
-o separates multiple directories to prune
Results in much faster searches
Essential for projects with large dependencies

Regular Expressions

Use regex patterns for matching in find

Find with regular expressions

Find PDF files using regex pattern matching full path.

Code

# -regex for full path regex matching
find . -regex ".*\.py$"          # Python files
find . -regex ".*test.*\.js$"    # test JavaScript files
find . -regex ".*/src/.*\.ts$"   # TypeScript in src/

# -iregex for case-insensitive
find . -iregex ".*\.(log|txt)$"  # .log or .txt files (case-insensitive)

# Regex with character classes
find . -regex ".*[0-9]\{4\}\.txt$"  # files with 4 digits before .txt

Execution

find /home -maxdepth 3 -regex ".*\.pdf$" 2>/dev/null | head -3

Output

/home/user/Documents/report.pdf
/home/user/manual.pdf

-regex matches full path (not just filename)
Pattern is extended regex by default
.* matches any characters to root
$ anchors match path end
Slower than -name but more flexible

Complex regex patterns

Find log and temp files using regex pattern with alternation.

Code

# Find versioned files
find . -regex ".*v[0-9]+\.[0-9]+\.txt$"

# Find config files in specific structure
find . -regex ".*/config/[^/]*\.json$"

# Find date-named files
find . -regex ".*[0-9]\{4\}-[0-9]\{2\}-[0-9]\{2\}.*"

# Find non-dotfiles
find . -regex ".*/[^.][^/]*$"

Execution

find /var -maxdepth 2 -regex ".*\.(log|tmp)$" 2>/dev/null | head -3

Output

/var/log/syslog.log
/var/tmp/session.tmp

Regex provides powerful pattern matching
Performance cost vs simple -name
Extended regex is default (no need to escape special chars in [])

Execution with Files

Execute commands on found files safely

Execute commands with -exec

Execute ls command on each found .txt file showing detailed information.

Code

# -exec runs command on each found file
# {} placeholder replaced with filename
# ; terminates command (escape with \;)

find . -name "*.log" -exec rm {} \;
find . -type f -exec chmod 644 {} \;
find . -name "*.py" -exec python3 {} \;

# -exec with output
find . -type f -exec wc -l {} \;

Execution

find /tmp -maxdepth 1 -type f -name "*.txt" -exec ls -lh {} \; 2>/dev/null

Output

-rw-r--r-- 1 user user 12K /tmp/file1.txt
-rw-r--r-- 1 user user 5.2K /tmp/file2.txt

{} is placeholder for found filename
\\; terminates the command
Spawns new process for each file
Can be slow with many files

Safe and efficient execution

Use + instead of ; to pass multiple files to command for efficiency.

Code

# -exec with + instead of ; (more efficient)
find . -type f -exec grep -l "TODO" {} +

# -execdir runs in file's directory
find . -type f -name "*.bak" -execdir rm {} \;

# Interactive prompt with -ok
find . -type f -name "*.tmp" -ok rm {} \;

# Use xargs for better performance
find . -type f -print0 | xargs -0 rm

Execution

find /home -maxdepth 2 -type f -name "*.md" -exec wc -l {} + 2>/dev/null | tail -1

Output

42 total

+ batches files into single command call (more efficient)
-execdir changes to file directory before executing
-ok prompts before each execution
-print0 with xargs handles spaces in filenames

Common exec patterns

Execute base64 encoding on found files.

Code

# Remove old files
find . -type f -mtime +90 -exec rm -f {} \;

# Change permissions
find . -type f -exec chmod 644 {} +
find . -type d -exec chmod 755 {} +

# Show file information
find . -type f -name "*.log" -exec ls -lh {} \;

# Compress old logs
find /var/log -type f -mtime +30 -exec gzip {} \;

Execution

find /tmp -maxdepth 1 -type f -exec base64 {} \\; 2>/dev/null | head -2

Output

ZmlsZSBjb250ZW50IGluIGJhc2U2NAo=

Common use: rm, chmod, gzip, grep
Always test before destructive operations
Use + for better performance when possible

Output & Actions

Control output format and perform actions on files

Print Options

Format output from find command

Format find output

Custom printf format showing filename and size in bytes.

Code

# Default -print (newline separated)
find . -name "*.py"      # same as: find . -name "*.py" -print

# -print0 for null-terminated (handles spaces)
find . -type f -print0 | xargs -0 ls -la

# -printf for custom formatting
find . -type f -printf "%p %s bytes\n"

# Format options:
# %p = path
# %s = size
# %m = permissions (octal)
# %u = username
# %g = group
# %T = modification time

Execution

find /home -maxdepth 2 -type f -printf "%f %s\n" 2>/dev/null | head -3

Output

bashrc 2145
vimrc 5329
config.json 1024

-printf builds custom output format
%f = filename only, %p = full path
%s = size, %m = permissions
%u = user, %g = group
\\n for newline, \\t for tab

Advanced output formatting

Show owner, size, and filename in custom format.

Code

# File info with permissions
find . -type f -printf "%m %u:%g %s %p\n"

# Size in human-readable format
find . -type f -exec ls -lh {} + | awk '{print $9, $5}'

# JSON-like output
find . -type f -printf "{\\"file\\": \\"%p\\", \\"size\\": %s}\n"

# List with timestamps
find . -type f -printf "%TY-%Tm-%Td %p\n"

Execution

find /tmp -maxdepth 1 -type f -printf "%u %s %f\n" 2>/dev/null | head -3

Output

root 2048 config.tmp
user 1024 session.dat

%T formatter for time (complex)
%m for octal permissions
Useful for parsing and post-processing

Deletion Actions

Delete files matching criteria

Delete all .tmp files in /tmp directory.

Code

# -delete removes found files
# BE CAREFUL - permanent deletion!

find . -type f -name "*.tmp" -delete

# Delete empty files
find . -type f -size 0 -delete

# Delete old files
find /tmp -type f -mtime +30 -delete

# Delete in specific directory
find /tmp -maxdepth 1 -type f -delete

Execution

find /tmp -maxdepth 1 -type f -name "*.tmp" -delete 2>/dev/null; echo "Deleted"

Output

Deleted

-delete removes found items permanently
No confirmation or recovery possible
Always test command first
Consider backing up before bulk delete

Safe deletion with confirmation

List files with -ls before deletion for safety verification.

Code

# Preview before deleting
find . -name "*.log" -mtime +30  # preview first

# Then delete with confirmation
find . -name "*.log" -mtime +30 -ok rm {} \;

# Safe delete with list
find . -type f -size 0 -ls     # list empty files
find . -type f -size 0 -delete # delete them

# Backup before deletion
find . -type f -mtime +365 -exec cp {} {}.backup \;
find . -type f -mtime +365 -delete

Execution

find /tmp -maxdepth 2 -type f -name "test_*.log" -ls 2>/dev/null | head -1

Output

2097152  4 -rw-r--r-- 1 user user   2048 Feb 28 10:30 /tmp/test_run.log

Always preview with -ls or -printf before -delete
Use -ok with rm for interactive confirmation
Keep backups for important deletions

Advanced Exec Commands

Complex command execution patterns

Process files with exec commands

Count lines in markdown files combining with + for batching.

Code

# Run command on each file
find . -type f -name "*.jpg" -exec file {} \;

# Batch process multiple files
find . -name "*.txt" -exec cat {} + > combined.txt

# Get file info
find . -type f -exec stat {} \;

# Process with pipes
find . -type f -exec grep -l "error" {} \;

Execution

find /home -maxdepth 2 -type f -name "*.md" -exec wc -l {} + 2>/dev/null

Output

42 /home/user/README.md
15 /home/user/GUIDE.md
57 total

{} is replaced with found filename
+ batches multiple files in single command call
\\; runs command for each file separately
Pipe output with $(...)

Complex exec workflows

Identify file types using the 'file' command on found files.

Code

# Convert image files
find . -name "*.png" -exec convert {} {}.jpg \;

# Validate files before processing
find . -type f -exec sh -c 'head -c 4 "$1" | grep -q "^PDF" && echo "$1"' _ {} \;

# Parallel processing with GNU parallel
find . -name "*.log" | parallel gzip {}

# Backup and delete
find . -type f -mtime +365 -exec mv {} /backup/\; -delete

Execution

find /tmp -maxdepth 1 -type f -exec file {} \\; 2>/dev/null | head -2

Output

/tmp/session.log: ASCII text
/tmp/cache.dat: data

Complex shell commands can follow -exec
Use sh -c for complex one-liners
GNU parallel for parallel processing

Practical Examples

Real-world use cases and performance tips

Real-World Use Cases

Common practical scenarios using find

Cleanup large old files

Find and list large log files older than 30 days for archiving or deletion.

Code

# Find and list large files modified long ago
find /home -type f -size +100M -mtime +90 -exec ls -lh {} \;

# Archive old large files
find /var/log -type f -size +10M -mtime +30 | tar czf archive.tar.gz --files-from=-

# Delete old temp files
find /tmp -type f -mtime +7 -delete

# Cleanup disk space safely
find . -type f \( -name "*.tmp" -o -name "*.bak" -o -name "*.log" \) -delete

Execution

find /var/log -maxdepth 1 -type f -mtime +30 -exec ls -lh {} \; 2>/dev/null | head -2

Output

-rw-r--r-- 1 root root 45M Feb 28 12:00 /var/log/syslog.1
-rw-r--r-- 1 root root 23M Feb 28 10:00 /var/log/auth.log

Always use -mtime and size together for cleanup
Backup before making changes
Use -ls to preview before deletion
Monitor free space regularly

Project maintenance

Count total lines of Python code across project.

Code

# Find source files recursively, skip build
find . -path "./build" -prune -o -path "./dist" -prune -o -type f -name "*.src" -print

# Count lines of code
find . -name "*.py" -exec wc -l {} + | tail -1

# Find files needing update
find . -type f -name "*.js" -mtime +365

# Analyze code patterns
find . -name "*.py" -exec grep -l "TODO" {} \;

Execution

find /home -maxdepth 3 -name "*.py" -type f -exec wc -l {} + 2>/dev/null | tail -1

Output

1250 total

Prune build directories for accuracy
Use grep to find patterns in code
Monitor code metrics over time

Security and permissions audit

Find files with group or other write permissions (potential security issue).

Code

# Find SUID files (security risk)
find / -type f -perm -u+s 2>/dev/null

# Find world-writable files
find . -type f -perm -o+w

# Find files with unusual permissions
find . -type f ! -perm 644

# Find recently modified system files
find /etc -type f -mtime -1

# Find files with no owner
find . -nouser

Execution

find /home -maxdepth 2 -type f -perm /go+w 2>/dev/null | head -2

Output

/home/user/shared_file.txt

Audit SUID/SGID files regularly
Check for world-writable files
Monitor system file changes

Backup and synchronization

Count files modified in last day for backup purposes.

Code

# Find recent files for backup
find . -type f -mtime -1 | tar czf backup_today.tar.gz --files-from=-

# Identify changed files
find . -mtime -7 -o -ctime -7

# Mirror directory with permissions
find . -type f | cpio -p -d -v /backup/

# Create modification list for sync
find . -type f -printf "%T@ %p\n" | sort -n

Execution

find /home -maxdepth 2 -type f -mtime -1 2>/dev/null | wc -l

Output

Use tar with --files-from for safe backup
cpio alternative for file copying
Sort by modification time for analysis

Performance Optimization

Tips for efficient find usage on large filesystems

Optimize find performance

Count files with limited depth and Error suppression for faster execution.

Code

# Use -maxdepth to limit recursion depth
find . -maxdepth 3 -type f -name "*.py"

# Type first (most selective)
find . -type f -name "*.log"  # better
find . -name "*.log" -type f  # slower

# Prune large directories early
find . -path "*/node_modules" -prune -o -type f -print

# Suppress error messages to speed up
find . -name "*.js" 2>/dev/null

Execution

find /home -maxdepth 2 -type f 2>/dev/null | wc -l

Output

-maxdepth reduces directory traversal
Type filter is very selective
-prune skips entire directories efficiently
Redirect stderr (2>/dev/null) to hide permission errors

Filesystem-specific optimizations

Use -xdev to stay on same filesystem when searching /etc.

Code

# Find with NFS filesystem (use -noleaf)
find /mnt/nfs -noleaf -type f -name "*.txt"

# Find local filesystem (use -xdev to skip other filesystems)
find / -xdev -type f -name "config"

# Parallel find on large directories
find . -type d | parallel find {} -maxdepth 1 -type f

# Use locate for filename-only searches (fast)
locate "*.py"  # much faster than find . -name "*.py"

Execution

find /etc -xdev -type f -name "*.conf" 2>/dev/null | wc -l

Output

-noleaf for NFS mounted directories
-xdev prevents crossing filesystem boundaries
locate database much faster for name-only searches
GNU parallel can distribute work across cores

Batch operations efficiently

Use + to batch files into one command for better performance.

Code

# Batch with + instead of separate calls with \;
find . -type f -exec chmod 644 {} +    # fast: 1 process/call
find . -type f -exec chmod 644 {} \;   # slow: 1 process/file

# Use xargs with parallel execution
find . -type f -print0 | xargs -0 -P 4 rm

# Combine sort and processing
find . -type f -printf "%s %p\n" | sort -rn | head -10

# Process in batches
find . -type f | head -100 | xargs tar czf batch1.tar.gz

Execution

find /tmp -maxdepth 1 -type f -exec ls -1 {} + 2>/dev/null | head -3

Output

/tmp/file1.txt
/tmp/file2.log
/tmp/file3.tmp

+ batches multiple files (one process/batch)
\\; calls process for each file (slow)
xargs -P uses multiple parallel processes
Sort by size for analysis with -printf

Find

Getting Started

What is Find

Accessibility

Best Practices

Common Errors

Keywords

Find command overview and basic syntax

Find vs other search tools

Installation and Setup

Accessibility

Best Practices

Common Errors

Keywords

Verify find installation

Install find on different systems

Basic Search

Simple Name Search

Accessibility

Best Practices

Common Errors

Keywords

Search for files by exact name

Name search with wildcards

Case-Insensitive Search

Accessibility

Best Practices

Common Errors

Keywords

Case-insensitive file name search

Mixed case pattern matching

Path Matching

Accessibility

Best Practices

Common Errors

Keywords

Search by full path pattern

Path matching with directory pruning

Type Matching

Accessibility

Best Practices

Common Errors

Keywords

Search by file type

Combining type with name search

File Size & Type

Size Filtering

Accessibility

Best Practices

Common Errors

Keywords

Find files by size

Find disk space hogs

File Type Tests

Accessibility

Best Practices

Common Errors

Keywords

Search by specific file types

Advanced type combinations

Empty Files

Accessibility

Best Practices

Common Errors

Keywords

Find empty files and directories

Cleanup empty files

Time-Based Search

Modification Time

Accessibility

Best Practices

Common Errors

Keywords

Find files by modification time

Archive old files

Access Time

Accessibility

Best Practices

Common Errors

Keywords