How to find lost file in Linux using ‘find’ Command

Lost file can be searched different ways in Linux/Unix System. Linux ‘find’ command can use to locate files in Linux/Unix systems effectively.

Many users use the find tool with just the basic parameters. They get the results that they were looking for. Unfortunately most of the users don’t spend time to learn all about find. If they do, they can make excellent use of this tool and I am sure you would be surprised at the possibilities.

You can search for files by name, owner, group, type, permissions, date, and other criteria. The search is recursive in that it will search all sub-directories too. The syntax looks like this:

find where-to-look criteria what-to-do

All arguments to find are optional, and there are defaults for all parts. (This may depend on which version of find is used. Here we discuss the freely available Gnu version of find, which is the version available on YborStudent.) For example, where-to-look defaults to . (that is, the current working directory), criteria defaults to none (that is, select all files), and what-to-do (known as the find action) defaults to ‑print (that is, display the names of found files to standard output). Technically, the criteria and actions are all known as find primaries.

Search file with name in the whole system:

$ find / -name file_name

This command search for “file_name” in the whole system. The “/” tell the console to search in the whole system. You should run this command as root. If you want to search in your current directory use:

$ find . -name file_nam

Thus the use of “/” searches in the whole system starting from the root directory and must be run as a root. The use of “.” search in the current working directory.

Search file with the specific extension:

$ find . -name “*.txt”

This command search for the files with the extension .txt.

Finding a particular file in your system

$ find / -name ‘filename’ 2>/dev/null
$ find / -name ‘filename’ 2>errors.txt

/ – Start searching from the root directory (i.e / directory)

-name - Given search text is the filename rather than any other attribute of a file ‘filename’. Always enclose the filename in single quotes…

NOTE: 2>/dev/null is not related to find tool as such. 2 indicates the error stream in Linux, and /dev/null is the device where anything you send simply disappears. So 2>/dev/null in this case means that while finding for the files, in case any error messages pop up simply send them to /dev/null i.e. simply discard all error messages.

Alternatively you could use 2>error.txt where after the search is completed you would have a file named error.txt in the current directory with all the error messages in it.

$ find -name ‘met*’

The above command would start searching for the files that begin with the letters ‘met‘ within the current directory and the directories that are present within the current directory.

If no paths are given, the current directory is used. If no expression is given, the expression ‘-print’ is used.

Search based on modification time:
“-mtime” is used to search the files based on modification time. Let’s take a example for a day.

$ find . -mtime 1(find all the files modified exact 1 day)
$ find . -mtime -1(find all the files modified less than a day)
$ find . -mtime +1(find all the files modified more than a day)

Searching with respect to type of the file (-type)

$find . -name ‘temp’
./keepout/temp
./temp
$find . -name ‘temp’ -type d
./temp

Where d – directory, p – named pipe (FIFO), f – regular file and so on

Ignoring case-sensitivity (-iname)

$ find /home/temp -iname ‘index*’

This command searchs for a file starting with string ‘index’ without considering the case of the filename. So all files starting with any combination of letters in upper and lower case such as INDEX or indEX or index would be returned.

Searching for a file based on size

$ find /home/songs -name ‘*.mp3′ -size -5000k
$ find / -size +10000k

First command finds within a directory called /home/songs, only those mp3 files that have a size less than 5000 Kilobytes.

$ find / -mount -name ‘win*’

This command searches for files starting with the letters ‘win’ in their filenames. The only difference is that the mounted filesystems would not be searched for this time. This is useful when you have your Windows partitions mounted by default. And a search for ‘win’ might return many files on those partitions, which you may not be really interested in. This is only one use of -mount parameter.

$ find /mp3-collection -name ‘Metallica*’ -and -size +10000k
$ find /mp3-collection -size +10000k ! -name “Metallica*”
$ find /mp3-collection -name ‘Metallica*’ -or -size +10000k

Boolean operators such as AND, OR and NOT make find an extremely useful tool.
The 1st command searches within the directory /mp3-collection for files that have their names beginning with ‘Metallica’ and whose size is greater than 10000 kilobytes (> 10 MB).
The 2nd command searches in the same directory as above case but only for files that are greater than 10MB, but they should not have ‘Metallica’ as the starting of their filenames.
The 3rd command searches in the same directory for files that begin with ‘Metallica’ in their names or all the files that are greater than 10 MB in size.

How to apply a unix command to a set of files (-exec) ?

$ find . -name ‘*.sh’ -exec chmod o+r ‘{}’ \; -print

This command will search in the current directory and all sub directories. All files ending with .sh extension will be processed by the chmod -o+r command. The argument ‘{}’ inserts each found file into the chmod command line. The \; argument indicates the exec command line has ended.

The end results of this command is all .sh files have the other permissions set to read access (if the operator is the owner of the file).

Searching for a string in a selection of files (-exec grep …).

$ find . -exec grep “hello” ‘{}’ \; -print

Prints all files that contain the string ‘hello’ will have their path printed to standard output.

If you want to just find each file then pass it on for processing use the -q grep option.

$ find . -exec grep -q “hello” ‘{}’ \; -print

Finding Empty files (-empty)

$find . -empty

To delete empty files in the current directory:

$ find . -empty -maxdepth 1 -exec rm ‘{}’ \;

Find Files Under Users & Groups
Users
To locate files belonging to a certain user:

$ find /etc -type f \! -user root -exec ls -l {} \;
-rw——- 1 lp sys 19731 2002-08-23 15:04 /etc/cups/cupsd.conf
-rw——- 1 lp sys 97 2002-07-26 23:38 /etc/cups/printers.conf

Groupies
find can locate files that belong to a specific group – or not, depending on how you use it.
This is especially suited to tracking down files that should belong to the www group but don’t:

$ find /www/ilug/htdocs/ -type f \! -group www

The -nogroup argument means there is no group in the /etc/group file for the files in question.

Locate command

The locate command is often the simplest and quickest way to find the locations of files and directories on Linux and other Unix-like operating systems.

For example, the following command uses the star wildcard to display all files on the system that have the .c filename extension: