How To Use The All Knowing Find Command

How search works.

find [/path/to/directory] [search_parameters]

If you don't specify a directory, it searches the working directory.

Find Commands

Search For Folder Or File

Find a directory named "Music" in your home directory.

find ~ -type d -name "Music"

This searches everything for the file "linux.conf".

find / -name linux.conf

Find both "bear" and "Bear".

find -iname bear

The Or Operator

Use -o as an "or" operator to find either stallone or brucewillis.

find -name stallone -o -name brucewillis

Search For By Permissions

Find files with exactly 664 permissions.

find /etc -perm 664

Find files with at least 664 permissions.

find /etc -perm -664

Find files where the SUID bit is set.

find /usr/bin -perm -4000

Find files in the home directory where "others" don't have at least read permission.

find ~ \! -perm -o=r

Find files where at least "owner", "group" and "others" had read permissions.

find -perm /u=r,g=r,o=r

Find files with any of these permissions.

find /etc -perm /664

Find files where the "group" has at least write permission and "others" don't have read and write access.

find /var/log/ -perm -g=w ! -perm /o=rw

Search For By Size

The following options exist for size.

• Bytes = c

• Kilobytes = k

• Megabytes = M

• Gigabytes = G

Find files that are larger than 100M.

find / -type f -size +100M

Find tiles that are smaller than 1000 bytes. find /etc/ -type f -size -1000c

Copy Found Items

You can execute for example, cp, mv, rm, etc., for anything the file command finds.

Find all files under "/etc" named hosts and copy them to "/tmp".

find /etc/ -name "hosts" -exec cp {} /tmp \;

Find Based On Date and Time

Find all files that have been modified in the last five minutes in the "dev" directory. Think about "mm" as "modified minute". The second command finds everything that was modified more than five minutes ago.

find /dev/ -mmin -5

find /dev/ -mmin +5

To search for modified files in 24 hour blocks. This command finds all files modified in my "Documents" directory in the last 24 hours. 0 stands for the last 24 hours. 1 stands for between 24-48 hours and so on.

find Documents/ -mtime 0

Find Based On Changed Metadata

Modification time reflects when something is created or edited. Change time is not modified time. Change time reflects changed Metadata. For example if someone changes the permission. We can find that information with the following command. This finds all changed metadata within the last 5 minutes in the Documents directory.

find Documents/ -cmin -5