Traverse a file hierarchy beginning at pathname,
selecting files matching an expression, outputting the name and/or executing a command with the matching file names as an argument. expression is composed of the primaries and operands .
lsof |grep 'find '|grep cwd # may be bhelpful on a large directory tree with few matches.
-f pathnames
pathnames. May be specified following options.
-E
-regex and -iregex are extended regular expressions
-d
-depth
true. depth-first Traversal,
i.e., directories are visited in post-order and all entries in a directory will be acted on before the directory itself.
Ensures write permission while placing files in a directory, then sets the directory's permissions.
dir1
file11
dir2
file21
file22
file2
order is file11, file21,file22,file2, dir2, dir1
Useful when used with cpio to process files that are contained in directories with various permissions.
default: visit directories before their contents not a breadth-first traversal.
-maxdepth n
True. Limit the depth of the search into directories to no more than n.
-mindepth n
True. Do not apply any tests or actions at levels less thann
-xdev -x
prevents descending into directories that have a device number different than that of the file from which the descent began. eXclude volume crossing .
-s
Traverse the file hierarchies in alphabetical order within each directory. find -s and find | sort may give different results.
Symbolic Link handling:
-P
File information is of the link ( Pointer ). default.
-L
File information is for the file Linked to is used.
-H
Symbolic links on the command (example /etc)
is information for those of the files referenced by the link.
symbolic links not on the command is that of the link .
If the referenced file does not exist, information will be for the link .
-X
For use with xargs, files with names containing: ' " \ ␠
apostrophe , quotes , backslash, space, tab and newline are skipped and an error similar to: find: ./volvo RWS1.mobileconfig: illegal path
is output to standard error.
PRIMARIES
Primaries which take a numeric argument,
match when
equal unless
preceeded with a plus (+) more thann (older then)or
minus (-) less thann (eariler then)
-empty
True if the current file or directory is empty.
When empting directories: beware of .DS_Store which is not empty and not displayed using ls -l Use find . -name .DS_Store -delete # BEFORE -empty
time-stamp oriented
Relative times are base on time find was started. + more than ttt (before), - less than ttt (more recently than, since)
i.e. long ago +ttt; not too long ago -ttt
For example running find . -mtime -$((60*24)) this afternoon will NOT find files modified yesterday morning!
To find files modified since yesterday at this time use:
find . -mtime -`date +1d%Hh%Mm` -ls
current file was:
-mmin ±m
modified mminutes ago. find ~ -mmin +$((60*24*7)) -ls # display files modified more that a week ago.
-mtime [±]n[wdhms]
example
find . -name \*.c -mtime -ls|sedfind
-mnewer file
-Bmin [±]m
Born (created) … m minutes ago
-Btime [±]n[wdhms]
Bornn wdhms ago. Default ddays! (i.e. n*24 hours
-Bnewer file
Born before file was modified.
-amin [±]m
accessed access times may not be enabled see
-atime [±]n[wdhms]
-anewer file
-cmin [±]m
statuschanged
-ctime [±]n[wdhms]
-cnewer file
-newer file
-newerct ccyy-mm-dd
current file has a more recent
c access change modification
time than ccyy-mm-dd
date of the form understood by cvs
{} is replaced by the pathname of the current file.
True if util returns zero.
The expression must be terminated by a semicolon (;) escaped with a \. util will be executed from the directory from which find was executed. util and args are not subject to the further expansion of shell patterns and constructs.
-execdir util [args …] {} \;
util will be executed from the directory of the current file
-exec util [args …] {} +
{} is replaced with
as many pathnames as possible for each invocation of util
like xargs
-execdir util [args…] {} +
-ok util [args …] {} \;
Requests user affirmation for the execution of util. y executes the command, anything else skips the command and returns false.
/usr/bin/find . -iname "*~" -ok rm {} \;
"rm ./Applications/Album/CHRIS.HTM~"? n
"rm ./Documents/JackTheRiperCracker.html~"? n
"rm ./Documents/main.java~"? y
"rm ./Documents/MSU/585-01-security/Project/1-intro.txt~"?
-okdir util {} [args …];
-perm [±]mode
Tests file permissions. mode may be symbolic (see chmod) or octal .
-mmm
true if all bits in mmm are set in the file's mode bits.
+mmm
true if any bits in mmm are set in the file's .
mmm
true if the bits in mmm match the file's .
If symbolic, a starting value of 000 and the mode sets or clears permissions (ignoring the process' file mode creation mask).
If octal, only bits 07777 (SUID | SGID | STXT | U | G | O) of the file's mode bits participate in the comparison.
i.e. q, zzz is ignored
Those with the "no" prefix are notflags (except nodump). flags are checked to be set notflags are checked to be reset.
True if flags exactly match
the file's and none of the flags match those of notflags.
- flags: true if at least all of the flagsandnone
in notflags are set in the file's.
+ flags: true if any of the flags are set in the file's, or any of the notflags
are not set in the file's.
Different from -perm, which only allows specifing permission bits(mode) that are set.
Pattern matching
Special shell pattern matching characters ([,
], *, and ?) may be used as part of pattern.
These characters may be matched explicitly by escaping them with a backslash (\).
-iname pattern
the match is case insensitive.
-path pattern
True if the pathname matchespattern.
shell pattern matching characters ([, ], *, and
?) may be used as part of pattern,
in which case the entire pattern should be enclosed in "
To match these characters in the path escape them with a backslash (\).
Slashes (/) are treated as normal characters and do not have to be matched explicitly.
-ipath pattern
case insensitivepath,
-regex pattern
True if the whole path of the file matches pattern using regular expression.
To match ./foo/xyzzy, use: .*/[xyz]* or .*/foo/.*,
not xyzzy or /foo/.
-iregex pattern
case insensitive regex,
-size [+]n[ckMGTP]
True if the file's size, rounded up, in 512-byte blocks
is EQUAL TO n. Use +n for greater than or equal. c, size is characters, kilobytes, Mega, Giga, Tera, Peta.
pseudo-types: local matches any file system physically mounted on the system where the find is being executed rdonly matches any file system which is mounted read-only.
-user uname|UID
True if owner is uname or UID
-group group
True if the file belongs to group name or ID.
-nouser
True if the file belongs to an unknown user.
For example if a tar
file from another system was extracted.
-nogroup
True if the file belongs to an unknown group.
Effect output (which are always true )
-print
Outputs the pathname of
the current file to standard output.
If none of -exec, -ls,-print0, or -ok is specified, the given expression shall be
replaced by ( expression ) -print.
-print0
Outputs the pathname of the current file followed NULL .
Useful when filenames contain
or spaces or other special characters espically with xargs
For block or character special file, the major and minor numbers will be displayed .
For symbolic link, the pathname of the linked-to file will be displayed preceded by ->.
To removed everything before the bytes use:
sed "s/^[[:digit:]]\{1,18\} \{1,9\}[[:digit:]]\{0,6\} .......... \{0,5\}[[:digit:]]\{0,4\} [[:alpha:]]\{1,7\} [[:alpha:]]\{1,7\} //"
-delete
files and directories.
This executes from the current working directory as find recurses down the tree.
It will not delete a filename with a / in its pathname relative to . for security reasons.
Processing is a Depth-first traversal
-prune
Don't descend into the current file.
Ignored with -d (Depth first)
OPERATORS
Primaries may be combined using these operators, listed in order of decreasing precedence.
\(† expression\) evaluates to true if the parenthesized expression evaluates to true.
\! expression; -false expression; -not expression
expression -and expression expression expression default operator is -and
if the first expression is false, the second expression is not evaluated.
expression-orexpression
if the first expression is true, the second expression is not evaluated.
Operands and primaries must be separate arguments to find.
Primaries which take arguments expect each argument to be a separate argument .
Examples
Names do not end in .c.
find mysrclib \! -name "*.c" -print
Newer than ttt and owned by user wnjfind mysrclib -newer ttt -user wnj -print
Are not both newer than ttt and owned by wnj.
find mysrclib \! \( -newer ttt -user wnj \) -print
Either owned by wnj or newer than ttt.
find mysrclib \( -newer ttt -or -user wnj \) -print
Recent than the current time minus one minute.
/usr/bin/find . -newerct '1 minute ago' -print
Single character options -iname, -inum, -iregex,
-print0, -delete, -ls, and -regex are extensions to IEEE Std 1003.2
-h -depth, -follow, are evaluated true.
Some expressions have unexpected results.
An example is the expression <>code> -print -or -depth.
As -print evaluates to true, the order of evaluation results that -depth would never be evaluated.
This is not the case.
The -or was implemented as -o, and -and was implemented as -a.
of the -exec and -ok did not replace
{} in the utility name or the utility arguments if it had
preceding or following non-whitespace characters. This version replaces
it no matter where in the utility name or arguments it appears.
The -E was implemented on the analogy of grep(1) and sed(1).
BUGS
The special characters used by find are also special characters to shell programs.
In particular, the characters *, [, ],
?, (, ), !, \ and ; may have to be escaped from the shell
(i.e. use find . -name file\*
As there is no delimiter separating options and file names or file names
and the expression,
it is difficult to specify files named -xdev or !.
These problems are handled by -f and the getopt(3) -- construct.
STANDARDS
a superset of the syntax specified by the IEEE Std 1003.2 (POSIX.2) standard.
single character options and -iname, -inum, -iregex, -print0, -delete, -ls, and -regex primaries are extensions to IEEE Std
1003.2 (POSIX.2).
-d, -h and -x were implemented using the primaries -depth, -follow, and -xdev and evaluated true. As global variables that took effect before the
traversal began, some expressions could have unexpected results.
An example -print -o -depth. As -print
evaluates to true, depth would not be evaluated. This is not the case.
-or was implemented as -o, and the operator -and was implemented as -a.
In some implementations -exec and -ok did not replace
{} if it had preceding or following non-whitespace .
This version replaces it whereever utility name or arguments .
-E was implemented on the analogy of grep(1) and sed(1).
Reminder: *, [, ],
?, (, ), !,
\ and ; may have to be escaped from the shell.
There is no delimiter separating options, names and expression,
making it difficult to specify files named -xdev or !.
Use -f and the getopt-- construct.
-delete does not interact well with other options that cause the filesystem tree traversal options to be changed.
-mindepth and -maxdepth are actually global options (as documented above). They
should probably be replaced by options which look like options.