Linux / Unix find command

Quick links

About find
Syntax
ExamplesRelated commandsLinux / Unix main page

About find

Finds one or more files assuming that you know their approximate filenames.

Syntax

find path expressions

path	A path name of a starting point in the directory hierarchy.
-atime n	True if the file was accessed n days ago. The access time of directories in path is changed by find itself.
-cpio device	Always true; write the current file on device in cpio format (5120-byte records).
-ctime n	True if the file's status was changed n days ago.
-depth	Always true; causes descent of the directory hierarchy to be done so that all entries in a directory are acted on before the directory itself. This can be useful when find is used with cpio to transfer files that are contain edin directories without write permission.
-exec command	True if the executed command returns a zero value as exit status. The end of command must be punctuated by an escaped semicolon. A command argument {} is replaced by the current path name.
-follow	Always true; causes symbolic links to be followed. When following symbolic links, find keeps track of the directories visited so that it can detect infinite loops; for example, such a loop would occur if a symbolic link pointed to an ancestor. This expression should not be used with the -type l expression.
-fstype type	True if the filesystem to which the file belongs is of type type .
-group gname	True if the file belongs to the group gname. If gname is numeric and does not appear in the /etc/group file, it is taken as a group ID.
-inum n	True if the file has inode number n.
-links	True if the file has n links.
-local	True if the file system type is not a remote file system type as defined in the /etc/dfs/fstypes file. nfsis used as the default remote filesystem type if the/etc/dfs/fstypes file is not present.
-ls	Always true; prints current path name together with its associated statistics. These include (respectively): inode number  size in kilobytes (1024 bytes)  protection mode number of hard links user group size in bytes modification time. If the file is a special file the size field will instead contain the major and minor device numbers. If the file is a symbolic link the pathname of the linked-to file is printed preceded by `->'. The format is identical to that of ls -gilds ls Note: Formatting is done internally, without executing the ls program.
-mount	Always true; restricts the search to the file system containing the directory specified. Does not list mount points to other file systems.
-mtime n	True if the file's data was modified n days ago.
-name pattern	True if pattern matches the current file name.  Normal shell file name generation characters (see sh) may be used. A backslash (\) is used as an escape character within the pattern. The pattern should be escaped or quoted when find is invoked from the shell.
-ncpio device	Always true; write the current file on device in cpio -c format (5120 byte records).
-newer file	True if the current file has been modified more recently than the argument file.
-nogroup	True if the file belongs to a group not in the /etc/group file.
-nouser	True if the file belongs to a user not in the /etc/passwd file.
-ok command	Like -exec except that the generated command line is printed with a question mark first, and is executed only if the user responds by typing y.
-perm [-]mode	The mode argument is used to represent file mode bits. It will be identical in format to the operand described in chmod, and will be interpreted as follows. To start, a template will be assumed with all file mode bits cleared. An op symbol of: + will set the appropriate mode bits in the template; - will clear the appropriate bits; = will set the appropriate mode bits, without regard to the contents of process' file mode creation mask. The op symbol of - cannot be the first character of mode; this avoids ambiguity with the optional leading hyphen. Since the initial mode is all bits off, there are not any symbolic modes that need to use - as the first character. If the hyphen is omitted, the primary will evaluate as true when the file permission bits exactly match the value of the resulting template. Otherwise, if mode is prefixed by a hyphen, the primary will evaluate as true if at least all the bits in the resulting template are set in the file permission bits.
-perm [-]onum	True if the file permission flags exactly match the octal number onum see chmod). If onum is prefixed by a minus sign (-), only the bits that are set in onum are compared with the file permission flags, and the expression evaluates true if they match.
-print	Always true; causes the current path name to be printed.
-prune	Always yields true. Do not examine any directories or files in the directory structure below the pattern just matched. If -depth is specified, -prune will have no effect.
-size n[c]	True if the file is n blocks long (512 bytes per block). If n is followed by a c, the size is in bytes.
-type c	True if the type of the file is c, where c is b, c, d, D, f, l, p, or s for block special file, character special file, directory, door, plain file, symbolic link, fifo (named pipe), or socket, respectively.
-user uname	True if the file belongs to the user uname . If uname is numeric and does not appear as a login name in the /etc/passwd file, it is taken as a user ID.
-xdev	Same as the -mount primary.

When using find to determine files modified within a range of time, one must use the ?time argument before the -print argument; otherwise, find will give all files.

Examples

find -name 'mypage.htm'

In the above command the system would search for any file named mypage.htm in the current directory and any subdirectory.

find / -name 'mypage.htm'

In the above example the system would search for any file named mypage.htm on the root and all subdirectories from the root.

find -name 'file*'

In the above example the system would search for any file beginning with file in the current directory and any subdirectory.

find -name '*' -size +1000k

In the above example the system would search for any file that is larger then 1000k.

find . -size +500000 -print

Next, similar to the above example, just formatted differently this command would find anything above 500MB.

Reference: http://www.computerhope.com/unix/ufind.htm