How to find files on Linux

Remembering where a particular file is located in your Linux installation can be quite difficult and manually searching through a massive directory tree is a very labor intensive process. So, how do you do searches on Linux? Fortunately, Linux offers some very easy to use tools to find files throughout your entire distribution.

DIFFICULTY Basic - 1 | Medium - 2 | Advanced - 3
TIME REQUIRED 15 min
RELATED PRODUCTS Linux-based VPS or dedicated servers
Linux-based shared hosting with SSH enabled

How to Find Files in Linux

The find command is the primary tool used to locate files anywhere on your machine. At the most basic, find is executed using the following syntax:

find [path] [flags]

path and flags are both optional, so by default find will recursively return the path of all files within your current directory and sub-directories:

./.bashrc
./.ssh
./.ssh/authorized_keys
./.monit.state
./.aptitude
./.aptitude/cache
./.aptitude/config
./.profile
./.psql_history
./.gem
...

Finding by Name

To look for files with a particular name use the -name flag followed by the search text. For example:

find -name foo
./misc/foo

That finds all the files in the current directory with the exact name foo. In this case it found only one file in my misc directory. Using the -iname flag instead uses a case-insensitive search:

find -iname FoO
./misc/foo

Using an asterisk (*) allows you to search using wildcards:

find -name foo*
./misc/foobar.txt
./misc/foobar.sh
./misc/foo
./misc/foobar

Finding by Location

Searching outside of your current directory is often mandatory and can easily be accomplished using the path option immediately following the find command.

For example, to look for files across the entire system, use a / path option:

find / -name foo*
/root/misc/foobar.txt
/root/misc/foobar.sh
/root/misc/foo
/root/misc/foobar
/usr/lib/node_modules/npm/node_modules/semver/foot.js
/usr/share/automake-1.14/am/footer.am
/usr/share/doc/xml-core/examples/foo.postrm
...

You can narrow the search path down as necessary, in this case finding those same files located within the root/misc directory:

find ~/misc -name foo*
/root/misc/foobar.txt
/root/misc/foobar.sh
/root/misc/foo
/root/misc/foobar

You can even use multiple paths within your command to search in two or more specific locations. Here we are searching in both the root/misc and the /usr/share/doc directories:

find ~/misc /usr/share/doc -name foo*
/root/misc/foobar.txt
/root/misc/foobar.sh
/root/misc/foo
/root/misc/foobar
/usr/share/doc/xml-core/examples/foo.postrm
/usr/share/doc/xml-core/examples/foo.xmlcatalogs
/usr/share/doc/xml-core/examples/foo.postinst
/usr/share/doc/xml-core/examples/foo.prerm
/usr/share/doc/m4/examples/foo

Finding by Type

Another common flag to narrow down your search is -type, which allows you to find files based on the Unix-based identifiers associated with all files.

For example, you can use the -type d flag to search for only directories that match your criteria:

find / -type d -name foo*
/root/misc/foobar

The full list of identifiers used to follow the -type flag can be found on the man page, but a few of the most common are:

  • -type d for directories
  • -type f for files
  • -type l for symbolic links

Finding by Time

Searching for files based on the time they were created or modified can be a very useful tool for analyzing logs or changes in a particular directory.

There are three categories of time-based search commands: access, change, and modification. All three time categories also have two sub-categories to determine the timespan you are searching: min to search by minutes and time to search by days.

The numeric argument (n) for time-based flags can be negative, positive, or neutral:

  • n searches for a time period that exactly matches n.
  • +n searches for time periods greater than n.
  • -n search for time periods less than n.

For example, using the -atime flag allows you to search for files based on the time the file was last read from or written to. To find all foo-named files that were accessed less than 1 day ago enter:

find / -atime -1 -name foo*
/root/misc/foobar.txt
/root/misc/foobar.sh
/root/misc/foo
/root/misc/foobar

To find all foo-named files access within the last 45 minutes use the -amin flag instead:

find / -amin -45 -name foo*
/root/misc/foo

You may also use the -cmin and -ctime flags in the same fashion to find files based on the last time the file's inode data was changed (generally when the file was moved to a new location within the system).

After moving the foobar.txt file it is now among the search results for all foo-named files that were changed within the last10 minutes:

mv /root/misc/foobar.txt /root/other/foobar.txt
find / -cmin -10 -name foo*
/root/other/foobar.txt

The final time flags of -mmin and -mtime allow you to find files based on the last time the content of the file was modified.

After using the cat > command to add some new text to the foobar.txt file, it is now located when searching for files that were modified within the last 5 minutes:

cat > ~/other/foobar.txt
This is a new line.
ctrl+c
find / -mmin -5 -name foo*
/root/other/foobar.txt

Finding by File Contents

If you wish to search for files based on the actual text content within the file you may combine the find command with other unix commands using the -exec flag.

For example, by combining -exec with the very powerful grep tool, you can find all foo-named files as before that also contain particular text:

find / -type f -name foo* -exec grep -i "My favorite foods are" /dev/null {} +
/root/misc/foobar.sh:My favorite foods are:
/root/misc/foo:My favorite foods are:
/root/other/foobar.txt:My favorite foods are:

The entire command seems quite daunting but it really only consists of two basic chunks:

find / -type f -name foo*

That is the basic functionality of the find command covered so far in this tutorial, so here we're searching for all files of the typefile with names beginning with foo.

-exec grep -i "My favorite foods are" /dev/null {} +

The latter half of the command uses the new -exec flag, immediately followed by the unix command you wish to execute on thefind results. In this case the key component is:

grep -i "My favorite foods are"

This will search the contents of your files (ignoring case due to the -i flag) for the text "My favorite foods are."

Now running the same command but instead searching for "apple" we see there are only two files that have apple listed as one of the favorite foods:

find / -type f -name foo* -exec grep -i "apple" /dev/null {} +
/root/misc/foobar.sh:apple
/root/other/foobar.txt:apple

While this is just a brief overview of using -exec grep flag within your find search, it offers you an extremely high level of versatility and power within your searches.

Now go forth and find those files!


Was This Article Helpful?
Thank You For Your Feedback
Glad we helped! Anything more we can do for you?
Sorry about that. How can we be more helpful?