How to use the Linux find command

Linux is an open-source operating system that was created as a free al­tern­at­ive to UNIX. As with UNIX, the command line is a fun­da­ment­al tool to work in Linux. Here, the user enters a command on the command line which is then executed.

To find a file in Linux, you can use the Linux find command. This starts a recursive search, where a directory hierarchy is searched following certain criteria. The Linux find command is a precise tool for finding files and dir­ect­or­ies and is supported across pretty much all Linux dis­tri­bu­tions.

To use the find command in Linux, you’ll need to open the command line. Let’s have a look at the general structure of the Linux find command:

First, the command itself is written, followed by a directory path, and a variable number of search para­met­ers. A search parameter consists of a hyphen that is im­me­di­ately followed by the name of the parameter. This is followed by a space and the value of the parameter. Below, you’ll find an overview of the most commonly used search para­met­ers:

Several search para­met­ers can also be combined. Here, a logical AND operation is im­pli­citly assumed. This can be written out ex­pli­citly. Fur­ther­more, an OR link can be used or a condition can be negated:

Note that you must replace the <place­hold­ers> with actual values in the following code examples to run the examples.

Let’s see how we can limit the search to a specific directory. To search the current directory, we use the '.' item as the directory path:

To search through your own user folder, use the tilde '~' as the directory path:

You can also search the entire system with the Linux find command. However, due to the large number of files and the possibly deep hierarchy of dir­ect­or­ies, this can take a long time. To search the entire system, we use a forward slash '/' as the directory path:

The search results of the Linux find command may be extensive. That’s why it can be useful to influence how results are displayed. Here, it’s important not to use the command’s own para­met­ers, but make use of so-called pipes. In Linux, they’re useful to use the output of one command as the input of another command.

To output the results page by page, we pass the output of the find command to the less command:

To count the number of results, we pass the output of the find command to the wc command with the '-l' parameter:

To look at only the first or last n search results, we pass the output of the find command to the 'head' and 'tail' commands. In each case, we specify the parameter '-n' followed by the desired number of search results:

The following examples limit the search to the current directory and any sub­dir­ect­or­ies. Use the cd command on the command line to change to any directory. To test these examples, first change to your user folder:

To filter for file names, use the '-name' parameter. This requires an exact file name and is case sensitive:

Here we are looking for a file with the exact file name '.git­ignore'.

To not dif­fer­en­ti­ate between lowercase and uppercase letters we use the '-iname' parameter. The 'I' here stands for 'in­sens­it­ive', from 'case-in­sens­it­ive':

Usually, it’s more practical to search case-in­sens­it­ive first and use the '-name' parameter only if the search with '-iname' returns too many results.

If we don’t want to search for an exact file name, but want to use a pattern, we use the asterisk as a 'wild­card' place­hold­er and write the search pattern in quotes (the asterisk is in­tern­ally in­ter­preted as 'zero until ad­di­tion­al char­ac­ters have been added'). In our example, we search for files and dir­ect­or­ies whose names contain the text 'git':

A famous aspect of UNIX philo­sophy is the principle that ‘everything is a file’ – and the same applies under Linux. The term ‘file’ refers to files in a broader sense. In other words, dir­ect­or­ies are also mapped as files under Linux. But to avoid confusion, the more precise term ‘file descriptor’ is sometimes used.

When we speak of the ‘file type’ under Linux, we’re not talking about whether a document is an Excel file or a JPEG image. Instead, we dis­tin­guish between the different file descriptor types that exist under Linux. The Linux find command provides us with the search parameter ‘-type’ to filter by file type. For example, we can dis­tin­guish between files and dir­ect­or­ies when searching. Below, we’ve put together an overview of the most commonly used file types:

To include only files in the search results, we use the ‘-type’ parameter followed by the value ‘f’:

To include only dir­ect­or­ies in the search results, we use the '-type' parameter followed by the value 'd':

To filter by file extension, we make use of the '-iname' parameter and use the asterisk as a wildcard place­hold­er.

Find all files with the jpeg or JPEG extension:

Find all files with the jpeg/JPEG or jpg/JPG extension:

In Linux, the concept of the file links several pieces of in­form­a­tion. This usually includes at least the following:

• Name
• File type
• File size
• Timestamp
• Owner and group
• Access rights

All of these can be filtered by using the find command and the ap­pro­pri­ate para­met­ers. To filter by the size of a file, we use the '-size' parameter followed by a size spe­cific­a­tion.

The following find command returns files that are at least 700 megabytes in size:

The size spe­cific­a­tions consist of a number followed by a unit. Here is an overview of the available units:

The size spe­cific­a­tion is in­ter­preted as the exact file size. This is rarely practical, because often the exact size of a searched file is not known. What’s practical is the re­stric­tion to a certain size range. For this, the number is prefixed with an optional modifier:

The following command provides you with files that are smaller than 500 megabytes:

The following command provides you with files whose size ranges between 400 and 500 megabytes.

In addition to spe­cify­ing an exact size or size range, '-empty' is a separate parameter for searching for empty files:

This command also works for dir­ect­or­ies:

The operating system manages the file system and logs when files have been accessed. Various time stamps are generated in the process. Linux creates timestamps for the creation, the last modi­fic­a­tion, and the last access to a file. Using the find command, we can filter and find these timestamps. Here is an overview of the most used search para­met­ers:

To find files that were changed just a day ago, we use the search parameter '-mtime' followed by the value '1':

The displayed search para­met­ers with 'time' in the name interpret the following value as the number of days. The para­met­ers with 'min' in the name interpret the following value as the number of minutes.

Just like when filtering by file size, here we can also limit the number of past days to a range. Again, the plus and minus signs are used as modifiers:

To find files that were created more than 100 days ago we use the search parameter '-ctime' followed by the value '+100':

Just like when filtering by file size, the search para­met­ers can be combined to cover a range. To find files that were accessed between three and five days ago, we use the '-atime' search parameter twice, each time with the values '+2' and '-6'. The explicit com­bin­a­tion via the '-and' parameter is optional:

To find files whose changes are less than five minutes old, we use the search '-mmin' with the value '-5':

Under Linux, each file is assigned a user who acts as the owner. Fur­ther­more, each file belongs to a certain user group. Based on this, certain access rights (per­mis­sions) are defined for each file. Based to all this in­form­a­tion, we can use the find command to filter and find files under Linux. Here is an overview of the search para­met­ers used:

To search for files owned by the root user, we use the search parameter '-user' followed by the value 'root':

To search for files owned by the own user, we use the search parameter '-user' followed by the ex­pres­sion '$(whoami)'. The latter is resolved to the name of the logged-in user:

To search for further files that belong to the admin group, we use the search parameter '-group' followed by the value 'admin':

Besides filtering by owner and group, it’s also possible to filter by access rights. A triplet of octal numbers is used for this. Fre­quently used values include '644', '755' etc. The first number defines the access rights for the owner, the second for the group, the third for other users. Each of the three octal numbers is created by adding the in­di­vidu­al rights. We explain exactly how this works in greater detail in our article on assigning directory per­mis­sions with chmod.

To find files that are fully ac­cess­ible to any user, we use the search parameter '-perm' followed by the value '777':

To find files that are fully ac­cess­ible only to the owner, we use the search parameter '-perm' followed by the value '700':

We can also use the find command to find files under Linux that have, at minimum, the specified per­mis­sions. To do this, we im­me­di­ately prefix the octal number with a minus sign:

Normally, the Linux find command re­curs­ively goes through all sub­dir­ect­or­ies. However, it’s often useful to limit the depth of the recursion. For this, we use the search para­met­ers '-maxdepth' and '-mindepth':

To find among files larger than 50 megabytes, including only dir­ect­or­ies that are not more than two levels deeper than the current directory, we use the following command:

Among the files, to find those that are larger than 50 megabytes, including only dir­ect­or­ies that are at least three levels and no more than five levels deeper than the current directory, we use the following command:

So far, we’ve limited ourselves to finding files under Linux. However, many use cases require mass pro­cessing of the found files. Common scenarios include repairing access rights for web-based software like WordPress or deleting files after a hack. We also resort to the find command for these use cases.

Next, let’s look at the general pattern for running a command for each found file. We use the '-exec' parameter for this, followed by a Linux command and its para­met­ers. The whole command is ter­min­ated by the always constant text '{} \;':

Note that the execution of the command happens without prompting you! Depending on the search para­met­ers selected and the command given, executing the find command with the '-exec' parameter can cause severe damage to the system.

To limit the risk, there is the '-ok' parameter that is similar to the '-exec' parameter. This forces the in­ter­act­ive con­firm­a­tion of the pro­cessing of each in­di­vidu­al file found:

As a pre­cau­tion, we limit the recursion depth to only one sub­dir­ect­ory via '-maxdepth 1' in the following examples.

To set the owner and group of all files and dir­ect­or­ies to the value 'www-data' we use the following find command with the chown command:

To find files with rights '777' and set them to '664' we use the following find command with the chmod command:

To set the per­mis­sions of all dir­ect­or­ies to '755', we use the following find command with the chmod command:

You can also use the find command to delete found files and dir­ect­or­ies. As a pre­cau­tion, we’ll show this here only for empty files and dir­ect­or­ies. Fur­ther­more, instead of the '-exec' parameter, we use the '-ok' parameter to force the user to ex­pli­citly agree to the deletion.

To delete all empty Linux dir­ect­or­ies we use the following find command alongside the rmdir command:

To delete all empty Linux files, we use the following find command with the rm command: