Skip to main content

Find by file name

To perform a find command in terminal use

find / -name php.ini -type f

find / -name {filename} {type parameters}

Note there are many parameters in the commands, so I'll cover a couple regular expressions here.  Such as, 

-name matches the string being searched and is case sensitive
-iname matches the string being searched and is case insensitive
-type f means to find a file with the name being searched.  In this instance php.ini
-type d find a directory
-type l find a symbolic link
-type c find a character devices
-type b find a block devices
-type p find a named pipe
-type s find a socket

If you want to perform a file all files that end in .php

find / -name '*.php'

Find files with the word "laravel" in the name.

find / -name '*laravel*'

Regex match, more flexible. Find both .php files and files with the word "laravel" in the name.

find / -regex '.*laravel.*\|.*\.php'

Note, with regex you can also make the search insensitive through using -iregex

find / -iregex '.*laravel.*\|.*\.php'

A great resource list is on ss64

 

Find text in a file

grep -iRl "text-to-find" ./

grep {switches} "text" {directory}

What do the switches do...

-i ignore text case
-R recursively search files in subdirectories
-l show file names instead of file contents portions
-n show the line number
-w match the whole word

./ - the last parameter is the path to the folder containing files you need to search for your text.  Working from root directory, you will scan your entire server.  If that is a little too heavy, you can change it to the full path of the folder such as /var/www/vhosts/

 

Expressions

There are, however, other expressions you can use:

-amin n The file was last accessed n minutes ago
-anewer The file was last accessed more recently than it was modified
-atime n The file was last accessed more n days ago
-cmin n The file was last changed n minutes ago
-cnewer The file was last changed more recently than the file was modified
-ctime n The file was last changed more than n days ago
-empty The file is empty
-executable The file is executable
-false Always false
-fstype type The file is on the specified file system
-gid n The file belongs to group with the ID n
-group groupname The file belongs to the named group
-ilname pattern Search for a symbolic line but ignore the case
-iname pattern Search for a file but ignore the case
-inum n Search for a file with the specified node
-ipath path Search for a path but ignore the case
-iregex expression Search for an expression but ignore the case
-links n Search for a file with the specified number of links
-lname name Search for a symbolic link
-mmin n The file data was last modified n minutes ago
-mtime n The file data was last modified n days ago
-name name Search for a file with the specified name
-newer name Search for a file edited more recently than the file given
-nogroup Search for a file with no group id
-nouser Search for a file with no user attached to it
-path path Search for a path
-readable Find files that are readable
-regex pattern Search for files matching a regular expression
-type type Search for a particular type
-uid uid The file numeric user id is the same as the uid
-user name The file is owned by the user that is specified
-writable Search for files that can be written to

 

Examples of the find command in action

To find all the files within your home folder accessed more than 80 days ago:

find ~ -atime 80

To find all the empty files and folders in your system:

find / -empty

To find all the executable files on your computer:

find / -executable

To find all the files that are readable:

find / -readable

 

Find by date

find . -maxdepth 1 -newermt "2021-06-09"

 

Find by time - recent period

To find all files modified in the last 24 hours (last full day) in a particular specific directory and its sub-directories:

find / -mtime -1 -ls

Alter the slash '/' to restrict the query to the directories you want to target

To query the last three hours use

find / -mmin -180 -ls

Combining with an earlier query you can use

find / -name php.ini -type f -mmin -180 -ls

 

Related articles

Andrew Fletcher18 Mar 2024
Resolving CVE-2022-48624 less issue
To resolve the CVE-2022-48624 vulnerability on Ubuntu using Nginx, it's crucial to understand that the issue lies within the "less" package, not Nginx itself. The vulnerability affects "less" before version 606, where close_altfile in filename.c in less omits shell_quote calls for LESSCLOSE,...