Tips For Finding Files In Linux: Part 2

In the last part, we looked at how you can find files on your filesystem using the locate command. As we highlighted then, this command lets you search by using full or partial file names to find the file you want. There may be other times, however, when you have other details about a file you want to search by instead of the name. Here is where the find command comes in useful, as it allows searching by other file attributes.

Using find

Find usage differs slightly from locate. While locate uses a database of the file system to search for files quickly, find searches the filesystem directly, which can be slower. In addition, rather than searching the whole filesystem every time, find searches within the current working directory and its subdirectories, unless you specify another directory.
There are lots of flags you can use to specify the files that you wish to search for. Let’s look at a quick list of these:
   name     Searches for files where the name matches the string following this flag.
   type     Searches for files or directories matching the given type “f” for files and “d” for directories.
   mmin     Searches for files modified the given number of minutes ago. When just the number is provided the time must match exactly. If the time is prefixed with a hyphen “-” the file must have been modified less than the given number of minutes ago, if the time is prefixed with a plus “+” then it will search for files modified more than the given number of minutes ago.
   mtime    As above, but searches in terms of days rather than minutes.
   cmin     As with mmin but checks against file creation time.
   ctime    As with mtime but checks against file creation time.
   amin     As with mmin but checks against file accessed time.
   atime    As with mtime but checks against file accessed time.
   user     Searches for files owned by the user matching the following string.
   group    Searches for files owned by the group matching the following string.
   size     Similar to the mmin and mtime options, it will search for files matching a given size in bytes. Prefixing with “-” or “+” will allow searching for files less than or more than the given size respectively. You can also suffix the number with “k” for kibibytes, “M” for mebibytes, “G” for gibibytes.
   perm     Searches for files that match the given 3-digit file permission mask. This can be an exact match, or by prefixing with a hyphen “-” you can search for permissions that exceed a given mask.
   not      This flag can go in front of another flag to allow you to search for the opposite of the following flag.

Find Flag Examples

That’s quite a lot of information to take on board, and there are more options available if you have a look through the man page for find. That said, from my experience I would say we have covered most of the commonly used flags. To make this somewhat more transparent, we’ll run through some example commands and what they mean:
   find -type f -user hayden -name file*
So this first command searches for files in the current working directory, and any subdirectories owned by the user hayden where the filename begins with “file”.
   find /var/log -type f -size +1G
The above command searches through the /var/log directory and subdirectories for files larger than 1GB in size.
   find /home/shared -user hayden -size +250M -ctime -30
This finds files in the /home/shared directory, and its subdirectories owned by the user hayden, larger than 250MB and created less than 30 days ago.
   find / -type f -size +2G -atime +7
Finally, this example finds files anywhere on the filesystem greater than 2GB that haven’t been accessed for more than seven days.
Hopefully, these examples have given a good idea of how to use the command and how it can be used to find files over a multitude of criteria. Between locate and find you should now be able to track down even the most elusive files.