Linux: find command most used cases

Find command is one of the most valuable commands; it can find files and directories based on many criteria like age, size, and name. Let’s explore the most commonly used cases. Note that all the examples i present can be combined, for example you can do a single search to find files filtered by name and size and date.

Find files modified in the past

$ find /home -mmin -60 -type f 
/home/kpatronas/.motd_shown

• -mmin -60 : Files modified in the last 60 minutes.
• -type f: search for files only.
• /home : the path to search.

To search hours before, you can use the following trick, -$((26*60)) evaluates to 120 minutes.

$ find / -mmin -$((26*60)) -type f 
/home/kpatronas/.motd_shown 
/etc/hosts 
/etc/timezone 
/etc/ld.so.cache 
/etc/hostname 
/etc/ld.so.conf.d/ld.wsl.conf 
/var/cache/ldconfig/aux-cache

If you wanted to search for files n*24 hours ago, use the -mtime parameter; note that rounding affects the interpretation of the file modification times.

$ find / -mtime -3 -type f 
/home/kpatronas/.landscape/sysinfo.log 
/home/kpatronas/.sudo_as_admin_successful 
/home/kpatronas/.bash_history 
/home/kpatronas/.motd_shown 
/home/kpatronas/.profile 
/home/kpatronas/.bash_logout

To find files modified between two timestamps, use the -newermt parameter.

• -newermt finds files newer than the timestamp, the! before the parameter negates the results

$ find / -type f -newermt "2022-11-22 00:00:00" ! -newermt "2022-11-22 00:41:00" 
/home/kpatronas/.motd_shown 
/etc/hosts 
/etc/timezone 
/etc/ld.so.cache 
/etc/hostname 
/etc/ld.so.conf.d/ld.wsl.conf 
/var/cache/ldconfig/aux-cache

What about directories?

All the above examples can be used with directories using -type d instead of -type f. If -type is omitted, it searches for both files and directories.

$ find / -mmin -60 -type d 
/ 
/home/kpatronas 
/etc 
/mnt/wsl 
/sys 
/dev 
/run 
/proc 
/var/cache/ldconfig

Find files by size

To find files equal to a specific size use the -size parameter

$ find / -size 1M

The suffix M denotes megabytes; other available suffixes are

• b — 512-byte blocks (this is the default if no suffix is used)
• c — bytes
• w — two-byte words
• k — Kilobytes
• M — Megabytes
• G — Gigabytes

To find files with size greater/less than a specific size use the +/- signs in front of the value

Greater than 1 MB

find / -size +1M

Less than 1 MB

find / -size -1M

To find files between sizes you can combine both, the following will search for files between 10MB and 20MB

find / -size +10M -size -20M

Find files by name pattern

Using the name parameter, we can search with file patterns, this will return every file in every directory with the name hosts

find / -type f -name 'hosts'

Wild cards are also accepted, this will return every file starts with host

find / -type f -name 'hosts*'

Some useful tips

Limit search depth, find by default searches on all directories recursively, we can limit the minimum and maximum search depth using the -mindepth and -maxdepth parameters.

The bellow command will limit search to sub-directory levels 3 and 5

$ find / -mindepth 4 -maxdepth 6

You can also apply a command to files found using the -exec parameter, this example will delete any files match the *.test pattern in the home directory.

$ find ~ -name '*.test' -exec rm {} +

Assume that you want to search only for files in the / partition but in the same time you have another partition mounted at /test ; you can exclude the /test partition you can use the -mount parameter. this will limit the results only in partition mentioned as starting point of search.

$ find / -mount -name '*.test'

I hope you found this article useful :)