Use find to locate files. find provides several filter and action options. The minimal invocation of find requires the command and one starting location which will be a directory in either absolute or relative path form.

find [-P|-L|-H] search_start_point[s] [filters] [actions]

Example :
find /

find will generate a list of all files found under the specified directory and will indicate their location relative to the specified directory. The above example will generate a list of all files on the system including their absolute location from the root directory. Don't try this as it could generate a list of more than 10000 files and take about 5 minutes or more.

Exercise : #( Run find on your home directory. Try both of these forms : ) find $HOME find .

Note that both lists contain the same files. However, the find run with $HOME generates an absolute path qualified listing, while the find run with the current directory symbol "." generates a listing qualified from that point. The major restriction of find is that the directories encountered in its search must be read and execute accessible to the user invoking the find. If a directory is not accessible, an error is generated. find will continue to search until all paths are exhausted by either traversal or restriction.

Options :

-P
(default) Do not follow symbolic link. If the file represents a link to a directory, find will not follow it. This prevents generated redundant data or getting into a loop.

-L
Do follow the symbolic link if it represents a directory. Needed if a particular link links to a directory outside of the current tree and user wishes to treat it as part of the tree to be searched. Use with care.

-H
Follow link to directory only if it was named as on the command line as one of the search starting points.

Although searches commonly start in a single place, most versions of find will take more than one search starting point. This can be useful if you know what you are looking for may exist only in certain directories.

Example :

find assn1 assn3 assn4 -name "crunch.h"

This will search only directories assn1, assn3, assn4 and any sub-directories within them. for the file crunch.h.

The most common use of find is a simple search to locate a file of interest. However, find provides a number of filters to further focus the search criteria. Filters allow you to specify a specific aspect of the file[s] of interest or limit the search path or condition on which to report a valid find.

-depth
This will cause find to process the contents of the directory before the directory itself.

-follow
This is the same as the -L. Follow the symbolic link if it points to a directory. This option is often available on versions of find that don't recognize -L.

-mount
This restricts the search to the partition on which the starting directory is located on. For example, it is common for the administrator to have all user files stored under a directory such as /home that is actually located on a separate drive or partition but mounted under root. If a search were started from / (root) without the -mount option, find would search the contents of all directories and files under /home. If the searcher knows the file of interest is in the main system partition, the search can be limited with the -mount options.

#( Search only root's partition for file )
find / -mount -name "httpd.conf"

-maxdepth #
#( where # is an unsigned number.) Limits the depth of the search or number of sub-directories to go down. This may not be available older versions.

#( Search only $HOME directory for c files. 0 = no subdirectories.)
find $HOME -maxdepth 0 -name "*.c"

The following filters test for specified condition. Some can take signed numeric arguments that specify a range less than (-n), equal to n (n), or greater than n (+n).

Find also support the negation function (!). ! (sometimes called the bang) inverts the result of the test condition.

This is not a complete listing but a sample grouped by type of filter action.

-name "name
#( where name is a filename. ) Probably the most used filter option, -name is followed by the name of the file to look for. Filename wildcards may be used to make the match more flexible, but remember to quote to prevent filename expansion before command is executed. find itself does the filename expansion, so you may find the rules are a little different.

#( Find all c source code files that start with assn : )
find $HOME -name "assn*.c"

-inum n
#(where n is the unsigned inode number of interest). This will search for all filenames linked to a particular file by its inode (hard link). This can be useful if you know more than one name is linked to a file, but you don't remember where this is. The numbers specified refers to an actual inode number is cannot be signed.

-iname filename
This is similar to -inum only this will look up the inode number of the filename provided for you. This may not be available on older systems.

-links [+/-]n
#(where n is the number of links to the file). Find all files that have specified number of links. n may be signed to represent the less than or more than syntax.

( Find all files that have a link count more than one : )
find . -links +1

-uid n
-uname user
Find all files belonging to the user ided by either user id number of login name.

-gid n
-group group_name

Find all files belonging to the group ided by either group id number of group name.

#( Find all files under the groupprojects directory belonging to group 330s1 : )
find groupprojects -group 330s1

-nouser
-nogroup
Find all files that indicate owner or group association to user or group not recognized by the system. This is often used by the administrator to check for stay files after a user or group has been removed from the system or to check to see if the system has been hacked into.

-size [+/-]n[bcwkMG]
#(where n is a integer. ) Find all files of specified size. Signed argument supports the less than, equal to, or greater than syntax. The size option also supports size units.

b = 512 byte block (default sector size on most storage devices). Also, block is default if no letter specified after number.

c = 1 byte character

w = 2 byte word

k = 1024 byte block

M = 2^20 byte

G = 2^30 bytes

#( Find all files not less than 204800 bytes (>= 204800) : )
find . ! -size -20k

-type {bcdprls}
Find all files of specified type.

b = block special

c = character special

d = directory

f = regular file # affected by the -L and -follow options.

p = named pipe

l = symbolic link

s = socket

#( Find and list only regular files : )
find $HOME -type f

#( Find and list all files except directories : )
find $HOME ! -type d

-atime n
-amin n
-ctime n
-cmin n
-mtime n
-mmin n

Find files where specific time stamp has changed. The numeric value may be signed and follows the less than n (-n), equal to n (n), or greater than n (+n) rules.

-atime and -amin tests file access time stamp. -ctime and -cmin tests for inode or status changes such as a move or change in hard links. -mtime and -mmin tests for modification of data.

-atime, -ctime, and -mtime test in 24 hour increments and -amin, -cmin, and -mmin test in minutes.

-anewer file
-cnewer file
-newer file

tests files' timestamps against specified file's timestamp and identifies files newer than specified file. This is useful when developing software to test to see if certain modules need recompiling.

-perm mode
-perm +mode
-perm -mode

Find files with certain permission configuration. All three variations support octal or symbolic mode.

-perm mode (no + or - ) requires all permission fields to exactly match mode argument.

#( Find all files that have only group execute permissions on (0010). All permission fields will be examined : )
find . -perm g=x
find . -perm 0010

-perm -mode requires that the specified permissions match mode argument. However, permissions not specified will be ignored in test.

#( Find all files where BOTH the execute permission for user and group are on. Ignore all other permissions )

find . -perm -u=x,g=x find . -perm -0110

-perm +mode requires that at least one the specified permissions match mode argument. However, permissions not specified can be ignored in test. #( Find all files where group permission for EITHER user or group are on. Ignore all other permissions - they can have any value. )

find . -perm +u=x,g=x find . -perm -0110

find provides a number of action options to be applied to a file matching the search and filter criteria.

-print Print found file. By default, current versions of find will invoke this option whether it is specified or not IF no other action is specified. However, if multiple actions are to be invoked, you must specify

#( List all files found under current directory. If file is a regular file, remove it if user confirms action. (-ok) )

find . -print -type f -ok rm {} \;

Newer versions of find may support one or more of the following print variations.

-print0 (GNU) Print(zero) terminates each file listing with a null rather than a line feed. This can be useful if output is being feed to another program rather than the display.

-printf Provides formatted printing. Modeled after the C printf function but designed specifically for information related to files. See man page for specifics.

-fprint file (-fprint0, -fprintf) Sends listing to specified file. File specified will be created or overwritten even if not output generated. /dev/stdout and /dev/stderr are valid files.

-ls Lists files as if listed with ls -dils.

-delete Deletes files found. This will delete all files and directories from starting point without confirmation. Be very careful.

-exec cmd
-ok cmd
(cmd specifies an actual command.) Apply command to each file found. -exec runs without further intervention by user, -ok will prompt user for confirmation for each invocation of cmd.

# Find all core dump files and delete after getting permission :

find . -name core -ok rm {} \;

Note the {} and \; {} will cause the path and name found to be appended to the specific command being invoked. The semi-colon is needed to indicate the end of the command sequence and \ is needed to prevent the command interpreter from interpreting the semi-colon.

If you wish to apply multiple commands to located file, place the command sequence in a file (shell script). Then specify the shell script as the program to run.

The specified command will be invoked each time a file is found. The command is run from the directory the find was invoked in.

Operators :

Operators allow you to specify compound filters or actions.

-a (-and) and operator. The -a operator allows you to string multiple filters or actions together. If used between filter conditions, all must be true to invoke action. The and operator is implied by default if multiple filter or action options are specified. It may be needed if the filters also involve an "or" condition.

( Display Found : and long listing on same line for each file. )
find . -exec echo -e "Found : \c" -ls
find . -exec echo -e "Found : \c" -a -ls
find . -exec echo -e "Found : \c" -and -ls

-o (-or) Or operator allows you to state alternative filters or filter/action pairs.

( Find any files that are directories or symbolic links and give long listing : )
find . -type d -ls -o -type l -ls

() Parenthesis allows grouping and precedence.

In the example above, we had to state the action option (-ls) once for each filter condition. If we try :

find . -type d -o -type l -ls

This will only generate output if symbolic file found. Although the -type d filter may flag a true condition, it has no action to take. To run both type tests on each file, use parenthesis :

find . \( -type d -o -type l \) -ls