Master Linux File Search: Powerful find Command Techniques and Examples

Linux File Search

1. Overview of find

The find utility lets you locate files when you forget their location, using criteria such as name, size, modification time, owner, group, permissions, and more. It is an essential tool for Linux users.

2. Basic syntax

find [path...] [options] [expression] [action]

Where path defaults to the current directory, expression defines the search criteria, and action specifies what to do with matching files (default is -print).

3. Common find examples

1) Name search

# Find a file named ifcfg-eth1 in /etc
find /etc -name "ifcfg-eth1"
# Case‑insensitive search
find /etc -iname "ifcfg-eth1"
# Wildcard search for any file starting with ifcfg-eth
find /etc -name "ifcfg-eth*"
find /etc -iname "ifcfg-eth*"

2) Size search

# Files larger than 5 MiB
find /etc -size +5M
# Files exactly 5 MiB
find /etc -size 5M
# Files smaller than 5 MiB
find /etc -size -5M

3) Type search

# Regular files
find /dev -type f
# Directories
find /dev -type d
# Symbolic links
find /dev -type l
# Block devices
find /dev -type b
# Character devices
find /dev -type c
# Sockets
find /dev -type s
# Named pipes
find /dev -type p

4) Time search

# Create test files (example, later covered in shell tutorials)
for i in {01..28}; do date -s 201904$i && touch file-$i; done
# Files modified more than 7 days ago (excluding today)
find ./ -iname "file-*" -mtime +7
# Files modified within the last 7 days (includes today)
find ./ -iname "file-*" -mtime -7
# Files modified exactly 7 days ago
find ./ -iname "file-*" -mtime 7
# Keep only recent backups (example)
find /backup -iname "*.bak" -mtime +7 -delete
find /backup -iname "*.bak" -mtime +90 -delete

5) Owner and group search

# Files owned by user jack
find /home -user jack
# Files belonging to group admin
find /home -group admin
# Files owned by jack and in group admin
find /home -user jack -group admin
# Files owned by jack or in group admin
find /home -user jack -o -group admin
# Files without an owner
find /home -nouser
# Files without a group
find /home -nogroup
# Files without owner or group
find /home -nouser -o -nogroup

6) Permission search

# Exact 644 permissions
find . -perm 644 -ls
# Any file with at least 444 permissions
find . -perm -444 -ls
# Files writable by everyone
find . -perm -222 -ls
# Files with set‑uid bit
find /usr/sbin -perm -4000 -ls
# Files with set‑gid bit
find /usr/sbin -perm -2000 -ls
# Files with sticky bit
find /usr/sbin -perm -1000 -ls

7) Action options

# Default action (print)
find /etc -name "ifcfg*" -print
# Long listing format
find /etc -name "ifcfg*" -ls
# Delete (only empty directories)
find /etc -name "ifcfg*" -delete
# Prompt before copying files
find /etc -name "ifcfg*" -ok cp -rvf {} /tmp \;
# Copy then delete using -exec
find /etc -name "ifcfg*" -exec cp -rvf {} /tmp \;
find /etc -name "ifcfg*" -exec rm -f {} \;

8) Using xargs with find

# Remove a file found by find
find . -name "file.txt" | xargs rm -f
# Copy each found file to /var/tmp
find . -name "file.txt" | xargs -I {} cp -rvf {} /var/tmp

9) Logical operators

# Files not owned by hdfs
find . -not -user hdfs
# Files owned by hdfs and larger than 300 bytes
find . -type f -a -user hdfs -a -size +300c
# Files owned by hdfs or ending with .xml
find . -type f \( -user hdfs -o -name "*.xml" \)

4. Search conditions reference

Search by name: -name, -iname, -regex Depth control: -maxdepth, -mindepth Owner/group: -user, -group, -uid, -gid, -nouser, -nogroup File type: -type f, -type d, -type l, -type s, -type b, -type c, -type p Empty files/dirs: -empty Size: -size with +, -, or exact value

Time: -atime, -mtime, -ctime (days) and -amin, -mmin, -cmin (minutes)

Logical operators: -a (and), -o (or), -not or ! (not)

Exclude paths:

-path

5. Sample exercises

# 1. Find files in /tmp not owned by root and not starting with "f"
find /tmp ! -user root ! -name "f*"
# 2. Find files in /var owned by root and group mail
find /var -user root -group mail
# 3. Find files in /var not owned by root, lp, or gdm
find /var ! -user root ! -user lp ! -user gdm
# 4. Find files in /var modified in the last week, not owned by root or postfix
find /var -mtime -7 ! -user root ! -user postfix
# 5. Find regular files in /etc larger than 1 MiB
find /etc -type f -size +1M
# 6. Copy only directories from /etc to /tmp preserving structure
find /etc -type d -exec cp -a {} /tmp/ \;
# 7. Set permissions: directories 777, files 666 in /var/tmp/etc
find /var/tmp/etc -type d -exec chmod 777 {} \;
find /var/tmp/etc -type f -exec chmod 666 {} \;
# 8. Keep logs from the last 7 days in /var/log, delete others
find /var/log -type f ! -mtime -7 -delete
# 9. Create 10 files, keep file9, delete the rest
touch file{1..10}
find . -type f ! -name "file9" -delete
# 10. Explain each command (omitted for brevity)