Working with the `find`

The find command searches for files and directories recursively based on different criteria like name, size, permissions, owner, timestamps, etc. It is powerful, flexible, and real-time, unlike locate which relies on a database.

Basic Syntax


find [path] [expression] [action]

path – Starting directory (e.g., /, ., /home/user)
expression – Conditions (e.g., -name, -size)
action – What to do when a match is found (e.g., -print, -exec, -delete)

1. Find by File Properties

1.1 Find by Name (Exact Match)


find . -name file.txt

1.2 Case-insensitive Search


find . -iname readme.md

1.3 Find Files with Extension


find /etc -name "*.conf"

2. Find by Time

2.1 Last Modified Time (`-mtime`)

Files modified n days ago:


find /var/log -mtime 2

+2 → more than 2 days ago
-2 → less than 2 days ago

2.2 Last Access Time (`-atime`)


find /home -atime -1

Files accessed in the last 24 hours.

2.3 Last Status Change (`-ctime`)


find /etc -ctime +5

Changed (metadata) more than 5 days ago.

3. Find by Size

Examples:


find . -size +10M

Find files larger than 10MB


find . -size -1k

Find files smaller than 1KB

Units:

k = kilobytes
M = megabytes
G = gigabytes

4. Find by Ownership

4.1 By User


find /var/www -user apache

4.2 By Group


find /srv -group admin

4.3 By User ID (UID)


find . -uid 1001

5. Find by Permissions

5.1 Numeric Permissions


find /opt -perm 755

Files with exact 755 permissions.

5.2 Symbolic Permissions


find /etc -perm -u=rwx

User has read, write, execute

5.3 All Permission Bits Must Match


find /home -perm -222

All write bits must be present.

5.4 Any Permission Bit Matches


find /home -perm /222

At least one write bit (user, group, or others) is set.

5.5 Exact Symbolic Match


find . -perm -g=w

6. Performing Actions

6.1 Default Action: Print


find . -name "*.sh"

6.2 Delete Files


find . -name "*.bak" -delete

Warning: No confirmation. Use with caution.

6.3 Execute Commands on Found Files


find . -name "*.log" -exec rm {} \;

6.4 Move Files


find . -name "*.pdf" -exec mv {} /backup/pdf/ \;

6.5 Copy Files


find . -name "*.txt" -exec cp {} /tmp/ \;

6.6 List in Long Format


find . -type f -exec ls -lh {} \;

6.7 Print Only Filenames (not paths)


find . -type f -exec basename {} \;

7. Other Common Filters

7.1 By File Type


find . -type f   # regular files
find . -type d   # directories
find . -type l   # symbolic links

7.2 By Depth


find . -maxdepth 1 -name "*.sh"

7.3 Exclude Directory


find . -path "./backup" -prune -o -name "*.log" -print

8. Sample Output Explanation


find . -type f -perm 644

Output:


./report.txt
./data/summary.csv

Each line represents a file path that matches the condition:

Type = file
Permission = 644 (rw-r—r—)

Summary (Keynotes)

Criteria	Flag	Example
File name	`-name`	`-name "*.txt"`
Modified time	`-mtime`	`-mtime +7`
Access time	`-atime`	`-atime -1`
Size	`-size`	`-size +10M`
User	`-user`	`-user root`
Group	`-group`	`-group staff`
Permissions (exact)	`-perm 755`	Exact match
All permission match	`-perm -755`	All bits must match
Any permission match	`-perm /222`	At least one match
File type	`-type`	`-type f`, `-type d`, `-type l`
Delete files	`-delete`	`-name "*.tmp" -delete`
Execute command	`-exec`	`-exec rm {} \;`, `-exec ls -l {} \;`
Exclude paths	`-prune`	`-path "./dir" -prune`

Let’s break down the command:


find . -name "*.pdf" -exec mv {} /backup/pdf/ \;

This is a powerful Linux command that finds all .pdf files in the current directory (and all subdirectories) and moves them to the /backup/pdf/ directory.

Detailed Explanation

Part	Meaning
`find`	The command to search for files and directories.
`.`	The starting location (dot `.` means current directory).
`-name "*.pdf"`	Match all files ending in `.pdf`. This is a glob-style pattern.
`-exec`	For every file found, execute the following command.
`mv`	The command to move files.
`{}`	Placeholder for each found file (i.e., the `.pdf` file found).
`/backup/pdf/`	Target directory where the matched files will be moved.
`\;`	Required to end the `-exec` clause (`;` escaped to avoid shell expansion).

Example Scenario

Suppose your directory looks like this:


.
├── notes.pdf
├── resume.pdf
├── docs
│   ├── invoice.pdf
│   └── report.docx
└── backup/
    └── pdf/

Now run:


find . -name "*.pdf" -exec mv {} /backup/pdf/ \;

Output (what happens):

notes.pdf → moved to /backup/pdf/
resume.pdf → moved to /backup/pdf/
docs/invoice.pdf → moved to /backup/pdf/
docs/report.docx → ignored (not a .pdf)

Notes

Make sure /backup/pdf/ exists before running this, or you’ll get an error.
If multiple files have the same name in different folders (e.g., report.pdf in multiple locations), they may overwrite each other unless handled carefully.
-exec is flexible: you can also use -exec cp {} to copy, rm {} to delete, etc.

Key Takeaways

find is recursive by default.
-name uses shell-style globbing.
-exec allows you to take immediate action on search results.
{} represents each matching file.
\; ends the -exec command and must be escaped.

Working with the find