How To Use Find and Locate to Search for Files

How To Use Find and Locate to Search for Files

Searching for files on a Linux system can be a cumbersome task, especially when dealing with a large number of files and directories. Fortunately, Linux provides powerful command-line tools like find and locate that can simplify the process and help you locate files efficiently. In this article, we will explore how to use these tools effectively, along with examples showcasing various search options.

Finding by Name

The most obvious way of searching for files is by their name. To find a file by name with the find command, you would use the following syntax:

find -name "cloudchase"

This will be case sensitive, meaning a search for cloudchase is different from a search for Cloudchase. To find a file by name but ignore the case of the query, use the -iname option:

find -iname "cloudchase"

If you want to find all files that don’t adhere to a specific pattern, you can invert the search with -not:

find -not -name "query_to_avoid"

Alternatively, we can invert the search using an exclamation point (!), like given below:

find \! -name "query_to_avoid"

Note that if you use !, you must escape the character with a backslash (\) so that the shell does not try to interpret it before find can act.

Finding by Type

You can specify the type of files you want to find with the -type parameter. It works like below

Here are some of the descriptors you can use to specify the type of file:

  • f: regular file
  • d: directory
  • l: symbolic link
  • c: character devices
  • b: block devices

For instance, if you wanted to find all of the character devices on your system, you could issue this command:

find /dev -type c

Filtering by Time and Size

find gives you a variety of ways to filter results by size and time.

Size

You can filter files by their size using the -size parameter. To do this, you must add a special suffix to the end of a numerical size value to indicate whether you’re counting the size in terms of bytes, megabytes, gigabytes, or another size. Here are some commonly used size suffixes:

the following command will find every file in the /usr directory that is exactly 50 bytes:

find /usr -size 50c

o find files that are less than 50 bytes, you can use this syntax instead:

find /usr -size -50c

Time

Linux keeps track of the access, modification, and change times for each file on the system.

  • Access Time: The most recent read-write operation on a file.
  • Date Modified: The most recent time the file’s contents were changed.
  • Change Time: The most recent alteration to the file’s inode metadata.

You can use the -atime, -mtime, and -ctime arguments to base your find searches on these criteria. You must specify how many days in the past you want to search when using any of these options by passing a value. Similar to the size options described above, you can add the plus or minus signs to these selections to indicate “greater than” or “less than.”

For example, to find files in the /usr directory that were modified within the last day, run the following command:

find /usr -mtime 1

If you want files that were accessed less than a day ago, you could run this command:

find /usr -atime -1

Finding by Owner and Permissions

We can also search for files by the user or group that owns the file using the -user and -group parameters, respectively. To find every file in the /var directory that is owned by the syslog user run this command:

find /var -user syslog

Similarly, you can specify files in the /etc directory owned by the shadow group by typing:

find /etc -group shadow

You can also search for files with specific permissions.

If you want to match an exact set of permissions, you use can this syntax specifying the permissions using octal notation:

find / -perm 644

Finding Files Using locate

An alternative to using find is the locate command. This command is often quicker and can search the entire file system with ease. We can install the command on Debian or Ubuntu with apt by updating your package lists and then installing the mlocate package:

sudo apt update
sudo apt install mlocate

On Rocky Linux, CentOS, and other RedHat derived distributions, you can instead use the dnf command to install mlocate:

sudo dnf install mlocate

The reason locate is faster than find is because it relies on a database that lists all the files on the filesystem. This database is usually updated once a day with a cron script, but you can update it manually with the updatedb command. Run this command now with sudo privileges:

sudo updatedb

Remember, the locate the database must always be up-to-date if you want to find new files. If you add new files before the cron script is executed or before you run the updatedb command, they will not appear in your query results.

locate allows you to filter results in a number of ways. The most fundamental way you can use it to find files is to use this syntax:

locate cloudchase

This will match any files and directories that contain the string cloudchase anywhere in their file path.

You can retrieve statistics about the information that locate has cataloged using the -S option:

locate -S
Output
Database /var/lib/mlocate/mlocate.db:
    210 directories
    1367 files
    67763 bytes in file names
    64413 bytes used to store database
Tags: ,

Leave a Reply