« Back to Cheat sheets

find cheat sheet

Basic options

Find has many options, but here are the ones that are commonly used. Often in combination to gain a better search job.

Long optionShort optionWhat the option does
-exec VALUEPerform some command on the search rules
-group GROUPiSearch by ownership (group)
-printJust show the search results
-size VALUELimit by file size, with minus being smaller than, plus is bigger than specified size
-type dOnly search for directories
-type fOnly search for files
-user USERNAMESearch by ownership (user)
-xdevDo not cross between different file systems (e.g. NFS)

Creating a shell script? Use the long format option, as this improves the readability. For quick use of find on the command-line consider using the short notation of the related option.

Directories

Searching for a directory with a specific name, can be done by specifying the type and name.

find / -type d -name etc

To find all empty directories under the current work directory, use the -empty option.

find . -type d -empty

By permissions

The find command has the option to limit the search to the specific [file permissions](/filesystems/file-permissions/ of a file.

Find files with setuid (SUID)

To see what files have the setuid bit, use the

find . -perm -4000

Another notation to do the same:

find . -perm /u=s

Find files with setgid (SGID)

find . -perm -2000

Similar to setuid, we can use an alternative notation and search for the ’s’ in the group:

find . -perm /g=s

By ownership: user or group

To find all the files owned by a specific user, define the username.

find . -user michael

Another option is searching all files selected by a specific group:

find . -group adm

By file size

Smaller than 1 megabyte:

find . -size -1M

Search files bigger than a specific size:

find . -size +1M

The -size option can also be combined to find a file with a minimum size and maximum size.

By modification time

Want to find the files for which the content was recently changed? Use the modified time and select the time in minutes:

find . -type f -mmin -15

When looking for files that are changed for a longer period, change the minus into a plus and specify the period (e.g. older than 1 week).

find . -type f -mtime +1w

By modification date

Looking for files that are changed after a specific date?

find . -type f -newermt 2024-05-01

To find files modified in a specific date range, set the begin and end. For example to define a specific week:

find . -type f -newermt 2024-05-01 ! -newermt 2024-05-08

By access date

Like the modification date, we can search for files that are recently accessed. To define a specific day, tell find the start date and the stop date.

find . -type f -newerat 2024-05-08 ! -newerat 2024-05-09

By depth

Sometimes you don’t want to go multiple levels deep into the underlying subdirectories. Specify the depth to search, so that find knows when to stop.

find . -maxdepth 1 -print

Applying changes to files found

Correcting file permissions

Change all files that have file permissions of ‘777’ to more a sane value of ‘644’:

find . -type f -perm 777 -print -exec chmod 644 {} \;

For directories that would most likely be 755:

find . -type d -perm 777 -print -exec chmod 755 {} \;

Relevant articles using find command

The following articles include an example on how to use find and might be worth further exploring.

Liked this cheat sheet? There are more!

Feedback

Small picture of Michael Boelen

This article has been written by our Linux security expert Michael Boelen. With focus on creating high-quality articles and relevant examples, he wants to improve the field of Linux security. No more web full of copy-pasted blog posts.

Discovered outdated information or have a question? Share your thoughts. Thanks for your contribution.

Mastodon icon