You are here:  Home  >  Linux  >  Current Article

Linux how to find a file – be like a ninja, find it in split second!

By   /   May 13, 2012  /   No Comments

Q: How can you find a file under Linux or Unix-like Operating Systems?
A: Use find command.

Good prose is the selection of the best words; poetry is the best words in the best order; and journalese is any old words in any old order

Alan Brewer
Just like a good selection of the words makes good prose, good selection of search pattern makes your search results good. Just like a good order of the words makes a poetry, good order of your search patterns makes it faster. As far as a journalese part goes, well lets just say it is not worth of explanation.

find – command syntax

If you need more detailed syntax type man find or find –help.
In most cases you need to know the following:


find – examples of usage

find a file

If you want to find a file called “example.txt” type the following:

find / -name example.txt


  • find – is name of a command, type find –help or man find for more help
  • / – is a directory to start a search from, if you know that a file is located in specific directory replace with it, it will cut down time
  • name – is a type of search, in this case we are searching for a filename

find and execute on result

You can also be more creative and lets say you want to find all files that start with “TheTechTavern” and delete it, list it first, make sure this is what you want to delete first:

find / - name 'TheTechTavern*' -exec ls -l {\}\ \;

If it looks goo go ahead and delete it (or do whatever you want):

find / - name 'TheTechTavern*' -exec rm {\}\ \;

find files smaller than 3000kB

find /home/thetechtavern -size -3000k

Where the last part can be replaced by:

  • -3000k – size is less than 3000kB
  • 3000k – size is equal to 3000kB
  • +3000k – size is more than 3000kB

find files with given extension

find /home/thetechtavern -name  "*.ttt"

find files that were last accessed 30 days ago

find /home/thetechtavern -atime +30

Where the last part can be replaced by:

  • +30 – files that were accessed more than 30 days ago
  • 30 – files that were accessed exactly 30 days ago
  • -30 – files that were accessed less than 30 days ago

find files modified 1 day ago

This could be useful if you are wondering what files you have edited yesterday.

find /home/thetechtavern -mtime -1

By now you should get how the last part works. You are basically replacing “-” by “” or “+”.

find more recently modified files

find  /etc/file1.conf -newer /etc/file2.conf

find most recent version of a file

find / -name snmp.conf -newer /etc/snmp.conf

find files that belong to user thetechtavern, modified 10 days ago, bigger than 10MB, accessed exactly 7 days ago, with extension *.mp3 and save report with date stamp

This one is the most creative so far, I hope you will like it:

find / -user thetechtavern -mtime +10 -size 10M -atime 7 -name "*.mp3" > /home/thetechtavern/report-`date +%F`.txt

find and delete files in given directory older than 30 days

find . -type f -mtime +30 -delete


find . -mtime +30 | xargs rm

Find files modified 1-10 days age and make report

[root@localhost backdoor]# for i in {0..10};do echo "$i days ago:" ;find . -mtime $i ;done;
0 days ago:
1 days ago:
2 days ago:
3 days ago:
4 days ago:
5 days ago:
6 days ago:
7 days ago:
8 days ago:
9 days ago:
10 days ago:

find file using locate

locate "*.php"

find file using whereis

This works for binary, source and manual page files only. It is usefull when you need to know full path to the command because you want to use it in a cron where path environment may be unavailable:

whereis rsync

find using ls and grep

Imagine you are in the given directory and you just want to list all files with php extension.

 ls |grep "php"


ls *.php
    Print       Email

Leave a Reply