Master Linux ‘find’: Powerful File Search Techniques and Real-World Examples

Overview

This article provides a practical reference for the find command on Linux, covering its syntax, common file‑type symbols, and a variety of search criteria such as name patterns, size ranges, inode numbers, and timestamps. It also demonstrates how to combine conditions with logical operators and how to feed the results into other commands using xargs, -exec, and command substitution.

Common File‑Type Symbols

f   # regular file
d   # directory
l   # symbolic link
c   # character device
b   # block device (e.g., /dev/sda)

Device Files

/dev/urandom – a character device that continuously outputs random bytes; generally not useful for regular scripting.

# ll /dev/urandom
crw-rw-rw- 1 root root 1, 9 Nov 16 12:29 /dev/urandom

/dev/null – a black‑hole file that discards any data written to it. Useful for silencing command output.

# echo "test" > /dev/null
# ping -c1 -W1 www.example.com &>/dev/null
# echo $?
0

/dev/zero – produces an endless stream of zero bytes, often used with dd to create files of a specific size.

# dd if=/dev/zero of=1GB.bin bs=1M count=1000
1000+0 records in
1000+0 records out
1048576000 bytes (1.0 GB) copied, 16.6 s, 63.3 MB/s

Finding Files

By Type

# find ./ -type f          # regular files only
# find ./ -type d          # directories only
# find ./ -type f -o -type d   # files OR directories

By Name

# find ./ -name "1.txt"          # exact match (case‑sensitive)
# find ./ -iname "1.txt"          # case‑insensitive
# find ./ -name "[0-9].txt"      # pattern with character class
# find ./ -name "?.txt"          # single‑character wildcard
# find ./ -name "*.txt" -o -name "*.log"

Logical Combinations

# find ./ -type f -a -name "1.txt"          # AND (default)
# find ./ -type f -o -type d                # OR
# find ./ -maxdepth 1 -name "*.txt" -o -name "*.log"

By Inode Number

# ll -i
102615330 -rw-r--r-- 1 root root 0 Nov 13 11:36 12.txt
# find ./ -inum 102615330
./12.txt
# find ./ -inum 102615330 | xargs rm   # delete by inode

By Size

# find ./ -size +10M   # larger than 10 MiB
# find ./ -size 10M    # exactly 10 MiB
# find ./ -size -10M   # smaller than 10 MiB
# find ./ -type f -a -size +5M -a -size -15M   # between 5 MiB and 15 MiB

By Time

# find ./ -mtime +30   # modified more than 30 days ago
# find ./ -mtime -7    # modified within the last 7 days
# find ./ -mtime 0     # modified in the last 24 hours

Three timestamps are relevant: atime (last access), mtime (last content modification), and ctime (last metadata change).

Using find Results with Other Commands

With xargs

# find ./ -name "3.txt" | xargs cat
# find ./ -name "3.txt" | xargs rm
# find ./ -name "1.txt" | xargs -i cp {} /opt/
# find ./ -name "*.txt" | xargs -i cp {} /opt

With -exec

# find ./ -name "1.log" -exec cat {} \;
# find ./ -name "1.log" -exec cp {} /opt \;
# find ./ -name "*.log" -exec rm {} \;
# find ./ -name "*.TXT" -exec tar -zcvf test.tar.gz {} \;

Note: Using -exec with tar compresses only the last matched file; xargs should be preferred for archiving multiple files.

With Command Substitution

# cp `find ./ -name "*.txt"` /opt
# ll $(find ./ -name "1.txt")
# cat `find ./ -name "2.txt"`
# cp $(find ./ -size +10K) /root
# rm -f $(find ./ -size -10M)

Practical Exercise

Find all regular files under /data that were modified more than 30 days ago and delete them:

# find /data -type f -mtime +30 -exec rm {} \;