In this tutorial, we’re going to show you how to find a file in Linux. This tutorial will focus on the command-line way of finding a file. You can of course just use the Search option in your GUI to find a file visually.
To find a file in Linux, you can use 2 commands: find and locate. We’ll feature both commands in this tutorial.
Let’s start with the find command.
Syntax and a basic example of the find command
The syntax of the find command is:
find [OPTIONS] [PATH] [EXPRESSION]
You can use several options/flags to control how the find command executes
The [PATH] is the location/path where you want to find the command to search for a file. So if you use /etc/ the command will start searching for a file in that directory and all other subdirectories. It’s the starting path.
The [EXPRESSION] is the “criteria” you want to use to find the file. This can be a string, or anything else. You’ll see more examples below.
A most basic example of the find command is:
find -iname “example.txt”
This command will output a list of all locations where a file named “example.txt” is located. This is known as “searching by name”
“-iname” is used to find a file based on its name. If you used “-name”, the name of the file the command finds would be case-sensitive. So if there was a file named “Example.txt” it wouldn’t find it. We’re using -iname to ignore the case of the file, so it finds all instances of the file name, including “eXample.txt”, “EXAMPLE.TXT”, “ExaMpLE.txt”, etc.
We’ll go into more specific details of the find command below.
How to find files in Linux that don’t match certain criteria
If you want to find files that DON’T match certain criteria, just use the option -not. Example:
find -not -iname “example.txt”
will find all files that are not “example.txt”. The “-not” option is pretty self-explanatory and can always be used with the find command.
How to find files by file type
If you want to find and filter files by their file type, you need to use the “-type” option.
The types you can use are:
“f” for regular files
“d” for directories
“b” for block devices
“l” for symbolic links (symlinks)
“c” for character devices
For example, if you want to find all symlinks in the /var directory, you can use this command:
find /var -type l
How to combine multiple options and criteria in the find command
You can combine the options in one single command. For example, if you want to find all symlinks that contain “example” in them, you can use:
find /var -type l -iname “*example*”
By default, when you combine options, they are joined together by the “-and” operand, which means that both criteria must be true. You can use the “-or” operand to get results that return either of the options. For example:
find -type -d -or -iname “example”
This command will output all directories AND all files that are named “example”. If you didn’t use the “-or” option, you would get all directories that are named “example”.
How to find files by size
Another useful option to use with the find command is the “-size” option. You can filter the files you find by size.
The size filters you can use:
“k” for kibibytes (KiB, units of 1024 bytes)
“M” for mebibytes (MiB, units of 1024 * 1024 = 1048576bytes)
“G” for gibibytes (GiB, units of 1024 * 1024 * 1024 =1073741824 bytes)
“b” for 512-byte blocks (this is the default if nosuffix is used)
“c” for bytes
“w” for two-byte words
So, for example, to find all files that are larger than 1 GB in the /home directory, you can use the following command:
find /home -size +1G
If you want to find files that are smaller than 1 GB, you can use:
find /home -size -1G
And to find all files that are exactly 1 GB, you can use:
find /home -size 1G
How to find files by time
You can find and filter files with the find command by time. More specifically, you can use these options:
“-atime” – to find the files based on the last time they were read or written to (Access Time)
“-mtime” – to find files based on the last time they were modified (Modification Time)
“-ctime” – to find files based on the last time the files inode metadata was changed (Change Time)
By default, the parameters these options use are days. For example, to find files in the /var directory that were modified within the last 2 days, you can use this command:
find /var -mtime 2
Similarly to the size option, you can use the plus and minus operands. For example, to find the files that were modified less than 2 days ago, you can use:
find /var -mtime -2
To find files that were modified more than 2 days ago, you can use:
find /var -mtime +2
You can also use minutes instead of days. To do that, you need to use the “-mmin” option. For example, to find all files in the /var directory that were modified within the last 5 minutes, you can use:
find /var -mmin 5
How to find files based on permissions
To find files that have certain permissions, you can use the “-perm” option. For example, to find all files that have “777” permissions in the /var directory, you can use the following command:
find /var -perm 777
To find all files in the /var/ directory that have at least 644 permissions, run this command:
find /var -perm -644
This will return files that have permissions higher than 644, like 744, 777, etc.
Run commands on the files that the find command finds
If you want to run (execute) commands on the files that the find command finds, you can use the “-execute” option, like so:
find [CRITERIA] -exec [COMMAND] {} \;
In this case, [CRITERIA] is just whatever you would use in the find command as we showed in the previous examples. [COMMAND] is the command you’d like to execute on the files that the find command finds. Make sure to include {} (which is a placeholder for the results of the find command) and “\;” (which marks the end of the command)
An example that combines previous examples would be to find all files in the /var directory that have 777 permissions and update their permissions to 744:
find /var -perm 777 -exec chmod 744 {} \;
Other useful options you can use with the find command
We won’t go into detail with these, but you can easily find more information about them in the man page or just google.
“-maxdepth” sets the maximum level of directories the find command will look for files in. So if you have multiple subdirectories, you can limit the find command to 2 subdirectories, for example.
“-delete” deletes the files that the find command finds. You can add “-delete” at the end of the find command and it will delete all files that it finds.
“-O3” sets the optimization level to 3 – it will make the searching the fastest. The default level is “-O1”
“-user” and “-group” are used to filter the files based on ownership
“-empty” finds empty files
“-read” finds readable files
Now that you learned about the find command, let’s move on to the locate command, which is a relatively faster command than find.
How to find files with the locate command
The locate command may not be available by default in your distro. To install it, just install the “mlocate” package.
For Ubuntu/Debian:
sudo apt install mlocate
For CentOS/Fedora:
sudo dnf install mlocate
The locate command runs based on its database. The database gets updated once a day. The fact that locate uses a database makes it faster than the find command. To update the database, just run the following command:
sudo updatedb
The locate command has a simple syntax:
locate term
Where “term” is the word you want to search for in the file names. For example:
locate -i example
Will find all files named “example”. The “-i” option makes the command ignore the case (no case sensitivity), so both the files named “ExAmPlE” and “example” will be found.
Count the number of files with the locate command
To count the number of files instead of finding files with the locate command, you can use the following command:
locate -c example
This will output the number of files named “example”.
It’s very important to update the database before using the locate command because if any files were added or deleted after the database has been updated, it won’t affect your searches with the locate command.
Now that you learned how to use the find and locate commands to find files in Linux, what’s the first example you used? Any other examples you’d like to share?
