Linux find — advanced file discovery

find recursively walks a directory tree and evaluates each file against one or more conditions. The basic structure is: find <path> <conditions> <actions>. Multiple conditions can be combined to build precise searches.

-name performs case-sensitive filename matching while -iname ignores case. Wildcards should normally be quoted so the shell does not expand them before find receives them.

-type restricts results to a specific filesystem object. The most common values are f for regular files, d for directories and l for symbolic links.

-size searches by file size. Prefix + means larger than the specified size and - means smaller. Common suffixes include c for bytes, k for KiB, M for MiB and G for GiB.

-user and -group locate files associated with a specific account or group. -nouser and -nogroup are useful for identifying files whose original UID or GID no longer maps to an existing account.

-perm allows searches using Unix permission bits. An exact mode matches only that permission set, while the - prefix means all specified bits must be present.

-writable checks whether the current process can write to an object. This is often more practical than manually interpreting permission bits because ACLs and the current identity may also affect access.

-mtime works in 24-hour units. -mmin uses minutes and is more useful when investigating recent system activity.

-mtime tracks content modification time, -atime tracks access time and -ctime tracks inode metadata changes such as permissions or ownership. ctime is not the file creation time.

-newer compares modification timestamps against a reference file. This is useful when investigating everything changed after a known event.

-maxdepth prevents find from descending too deeply. -mindepth can exclude the starting directory itself or shallow results.

-prune prevents find from descending into matching directories. This is useful for excluding large or irrelevant trees such as proc, sys or node_modules.

find supports logical operators. -a means AND, -o means OR and ! negates a condition. AND is implicit when conditions are written consecutively.

-exec runs another command using each matching path. {} represents the current result. Ending with \; executes once per result, while + groups multiple paths into fewer command executions.

-ls produces detailed metadata directly from find. -printf allows custom output, making it useful for scripts and investigations.

Some searches are especially useful during Linux administration and authorised security assessments: privileged binaries, writable configuration files, SSH keys, backups and recently modified files.