How to use the Linux find command

Linux is an open-source operating system that was created as a free alternative to UNIX. As with UNIX, the command line is a fundamental tool to work in Linux. Here, the user enters a command on the command line which is then executed.

To find a file in Linux, you can use the Linux find command. This starts a recursive search, where a directory hierarchy is searched following certain criteria. The Linux find command is a precise tool for finding files and directories and is supported across pretty much all Linux distributions.

To use the find command in Linux, you’ll need to open the command line. Let’s have a look at the general structure of the Linux find command:

First, the command itself is written, followed by a directory path, and a variable number of search parameters. A search parameter consists of a hyphen that is immediately followed by the name of the parameter. This is followed by a space and the value of the parameter. Below, you’ll find an overview of the most commonly used search parameters:

Several search parameters can also be combined. Here, a logical AND operation is implicitly assumed. This can be written out explicitly. Furthermore, an OR link can be used or a condition can be negated:

Note that you must replace the <placeholders> with actual values in the following code examples to run the examples.

Let’s see how we can limit the search to a specific directory. To search the current directory, we use the “.” item as the directory path:

To search through your own user folder, use the tilde “~” as the directory path:

You can also search the entire system with the Linux find command. However, due to the large number of files and the possibly deep hierarchy of directories, this can take a long time. To search the entire system, we use a forward slash “/” as the directory path:

The search results of the Linux find command may be extensive. That’s why it can be useful to influence how results are displayed. Here, it’s important not to use the command’s own parameters, but make use of so-called pipes. In Linux, they’re useful to use the output of one command as the input of another command.

To output the results page by page, we pass the output of the find command to the less command:

To count the number of results, we pass the output of the find command to the wc command with the “-l” parameter:

To look at only the first or last n search results, we pass the output of the find command to the “head” and “tail” commands. In each case, we specify the parameter “-n” followed by the desired number of search results:

The following examples limit the search to the current directory and any subdirectories. Use the cd command on the command line to change to any directory. To test these examples, first change to your user folder:

To filter for file names, use the “-name” parameter. This requires an exact file name and is case sensitive:

Here we are looking for a file with the exact file name “.gitignore”.

To not differentiate between lowercase and uppercase letters we use the “-iname” parameter. The “I” here stands for “insensitive”, from “case-insensitive”:

Usually, it’s more practical to search case-insensitive first and use the “-name” parameter only if the search with “-iname” returns too many results.

If we don’t want to search for an exact file name, but want to use a pattern, we use the asterisk as a “wildcard” placeholder and write the search pattern in quotes (the asterisk is internally interpreted as “zero until additional characters have been added”). In our example, we search for files and directories whose names contain the text “git”:

A famous aspect of UNIX philosophy is the principle that “everything is a file” – and the same applies under Linux. The term “file” refers to files in a broader sense. In other words, directories are also mapped as files under Linux. But to avoid confusion, the more precise term “file descriptor” is sometimes used.

When we speak of the “file type” under Linux, we’re not talking about whether a document is an Excel file or a JPEG image. Instead, we distinguish between the different file descriptor types that exist under Linux. The Linux find command provides us with the search parameter “-type” to filter by file type. For example, we can distinguish between files and directories when searching. Below, we’ve put together an overview of the most commonly used file types:

To include only files in the search results, we use the “-type” parameter followed by the value “f”:

To include only directories in the search results, we use the “-type” parameter followed by the value “d”:

To filter by file extension, we make use of the “-iname” parameter and use the asterisk as a wildcard placeholder.

Find all files with the jpeg or JPEG extension:

Find all files with the jpeg/JPEG or jpg/JPG extension:

In Linux, the concept of the file links several pieces of information. This usually includes at least the following:

• Name
• File type
• File size
• Timestamp
• Owner and group
• Access rights

All of these can be filtered by using the find command and the appropriate parameters. To filter by the size of a file, we use the “-size” parameter followed by a size specification.

The following find command returns files that are at least 700 megabytes in size:

The size specifications consist of a number followed by a unit. Here is an overview of the available units:

The size specification is interpreted as the exact file size. This is rarely practical, because often the exact size of a searched file is not known. What’s practical is the restriction to a certain size range. For this, the number is prefixed with an optional modifier:

The following command provides you with files that are smaller than 500 megabytes:

The following command provides you with files whose size ranges between 400 and 500 megabytes.

In addition to specifying an exact size or size range, “-empty” is a separate parameter for searching for empty files:

This command also works for directories:

The operating system manages the file system and logs when files have been accessed. Various time stamps are generated in the process. Linux creates timestamps for the creation, the last modification, and the last access to a file. Using the find command, we can filter and find these timestamps. Here is an overview of the most used search parameters:

To find files that were changed just a day ago, we use the search parameter “-mtime” followed by the value “1”:

The displayed search parameters with “time” in the name interpret the following value as the number of days. The parameters with “min” in the name interpret the following value as the number of minutes.

Just like when filtering by file size, here we can also limit the number of past days to a range. Again, the plus and minus signs are used as modifiers:

To find files that were created more than 100 days ago we use the search parameter “-ctime” followed by the value “+100”:

Just like when filtering by file size, the search parameters can be combined to cover a range. To find files that were accessed between three and five days ago, we use the “-atime” search parameter twice, each time with the values “+2” and “-6”. The explicit combination via the “-and” parameter is optional:

To find files whose changes are less than five minutes old, we use the search “-mmin” with the value “-5”:

Under Linux, each file is assigned a user who acts as the owner. Furthermore, each file belongs to a certain user group. Based on this, certain access rights (permissions) are defined for each file. Based to all this information, we can use the find command to filter and find files under Linux. Here is an overview of the search parameters used:

To search for files owned by the root user, we use the search parameter “-user” followed by the value “root”:

To search for files owned by the own user, we use the search parameter “-user” followed by the expression “$(whoami)”. The latter is resolved to the name of the logged-in user:

To search for further files that belong to the admin group, we use the search parameter “-group” followed by the value “admin”:

Besides filtering by owner and group, it’s also possible to filter by access rights. A triplet of octal numbers is used for this. Frequently used values include “644”, “755” etc. The first number defines the access rights for the owner, the second for the group, the third for other users. Each of the three octal numbers is created by adding the individual rights. We explain exactly how this works in greater detail in our article on assigning directory permissions with chmod.

To find files that are fully accessible to any user, we use the search parameter “-perm” followed by the value “777”:

To find files that are fully accessible only to the owner, we use the search parameter “-perm” followed by the value “700”:

We can also use the find command to find files under Linux that have, at minimum, the specified permissions. To do this, we immediately prefix the octal number with a minus sign:

Normally, the Linux find command recursively goes through all subdirectories. However, it’s often useful to limit the depth of the recursion. For this, we use the search parameters “-maxdepth” and “-mindepth”:

To find among files larger than 50 megabytes, including only directories that are not more than two levels deeper than the current directory, we use the following command:

Among the files, to find those that are larger than 50 megabytes, including only directories that are at least three levels and no more than five levels deeper than the current directory, we use the following command:

So far, we’ve limited ourselves to finding files under Linux. However, many use cases require mass processing of the found files. Common scenarios include repairing access rights for web-based software like WordPress or deleting files after a hack. We also resort to the find command for these use cases.

Next, let’s look at the general pattern for running a command for each found file. We use the “-exec” parameter for this, followed by a Linux command and its parameters. The whole command is terminated by the always constant text “{} \;”:

Note that the execution of the command happens without prompting you! Depending on the search parameters selected and the command given, executing the find command with the “-exec” parameter can cause severe damage to the system.

To limit the risk, there is the “-ok” parameter that is similar to the “-exec” parameter. This forces the interactive confirmation of the processing of each individual file found:

As a precaution, we limit the recursion depth to only one subdirectory via “-maxdepth 1” in the following examples.

To set the owner and group of all files and directories to the value “www-data” we use the following find command with the chown command:

To find files with rights “777” and set them to “664” we use the following find command with the chmod command:

To set the permissions of all directories to “755”, we use the following find command with the chmod command:

You can also use the find command to delete found files and directories. As a precaution, we’ll show this here only for empty files and directories. Furthermore, instead of the “-exec” parameter, we use the “-ok” parameter to force the user to explicitly agree to the deletion.

To delete all empty Linux directories we use the following find command alongside the rmdir command:

To delete all empty Linux files, we use the following find command with the rm command: