In this article, we explain how to search for files in Linux from the Command Line Interface (CLI), using the basic Linux commands find, locate and which with their most frequently used command options.
What is Linux?
Linux is a family of open-source operating systems based on the Linux kernel. The first Linux system kernel was released on September 17, 1991, by Linus Torvalds.
Read more
Popular Linux distributions include Debian, Fedora, and Ubuntu, and the commercial distributions include Red Hat Enterprise Linux and SUSE Linux Enterprise Server.
There are also quite a number of customized Linux distributions, such as Kali Linux, REMnux etc. Kali Linux is a Debian-based distribution developed, funded and maintained by Offensive Security for ethical hackers for the purposes of Penetration Testing, Security Research & Assessment, and Computer Computer Forensics & Reverse Engineering. REMnux, on the other hand, is a Linux distro curated for reverse-engineering and malware analysis purposes.
All operating systems sucks, but Linux just sucks less.
Linus Torvalds
Read more educational and inspirational cyber quotes at our page 100+ Best Cyber Security & Hacker Quotes.
How to Search for Files in Linux
In Linux, files can be searched from the Command Line Interface (CLI) with three commands: find, locate and which. Though they have similarities, each of these commands have slightly different functionalities and returns different results.
Searching for Files with the find Command
Search for files in a directory hierarchy rooted at each given STARTING-POINT by evaluating the given EXPRESSION. Basic usage:find [STARTING-POINT ...] [EXPRESSION]Use-nameto specify file name,-permto specify file permissions, and-user to define owner of the file searched for.
The find command is the most well-known and the powerful of all these three commands. It takes optional parameters of a path as its starting point in which to recursively search for files and a search expression. When run without the optional parameters, it returns all the files recursively starting from the present working directory, similar to the functionality of the ls -R command.
$ find
the same with (identifying the starting point as the present working directory)
$ find .
Find by Name
To search for files by name, use the -name option for case sensitive searches, and -iname option for case insensitive searches.
$ find -name pattern
$ find -iname pattern
To search for files by a pattern (such as starting or ending with a string), use the * character as a placeholder to match zero or more characters in the file name.
$ find -name "filename*"
Find by Type
To search for files by type, use the -type option with a file type identifier. Commonly used file type identifiers are:
b: Block (buffered)c: Character (unbuffered)d: Directoryf: Regular filel: Symbolic links: Socket
$ find -type identifier
Find by File Size
To search for files with n units of size (less than, more than or equals to n units of space), use the -size option. Commonly used size unit identifiers are:
b: 512-byte blocks (Default if an identifier is not used)c: Bytesk: KiB (1024 bytes)M: MiB (1024 * 1024 bytes)G: GiB (1024 * 1024 * 1024 bytes)
$ find -size n
Figure 5 shows a search query to find files that are greater than 50 bytes and less than 100 bytes in size.
Find by File Modification Date
To search for files by their age, i.e., modification date (less than, more than or equals to n number of days), use the -mtime option.
$ find -mtime n
Figure 6 shows a search query to find files that were modified more than 2 days ago.
To search for files that are newer than a file, use the -newer option with a reference file.
$ find -newer reference
Find by Ownership and File Permissions
To search for files owned by a user, use the -user option.
$ find -user uname
To search for files by their permission bits, use the -perm option.
$ find / -user root -perm -u=s -ls 2> /dev/null
Figure 8 shows a search string to find files that are owned by the root user and have their setuid bit set.
Run a Command Against Found Files
Use -ls to apply ls command on each of the found items, and -exec command {} \; to run a command against all the files that are found.
$ find -name pattern -ls
the same with
$ find -name pattern -exec ls {} \;
ls Command Against All the Files Found$ find -name pattern -exec command {} \;
file Command Against All the Files FoundSearching for Files with the locate Command
Locate and return files matching at least one of the PATTERNs from one or more databases prepared byupdatedb. Basic usage:locate [OTPION] ... PATTERN ...
The locate command lists files that match a pattern and is very similar to the find command with respect to the returned results. For the differences, it is faster than the find command as it returns its results by querying a database updated periodically. However, its results are not in real time and may not locate the files created after the last update of the database. For another difference, the locate command is not as flexible as the find command with respect to available search options.
Also note that, locate command returns results that contain a search pattern in their names while the find command returns results that exactly match a pattern.
$ locate pattern
Searching for Files with the which Command
Return pathnames of the files by searching the $PATH environment variable for executable files matching the names of the arguments. Basic usage:which [-a] FILENAME ...Use-aoption to print all matching pathnames of each argument.
The which command searches directories that are defined in the $PATH environment variable and returns pathnames of the searched files.
$ which filename
To explore more on these commands, please visit the man pages by typing $ man followed by the command (find, locate, which) on the terminal.
To learn more on Linux, you could also visit our Linux Resources Page.
