Unix Find Command Cheatsheet And Usage

Last updated: 2020-05-29

Find files on Unix using regex in find command

Find command has regex utility which is very robust.

-regextype <type>    # Where type can be any one of the 'findutils-default', 'awk', 'egrep’, 'ed', 'emacs', 'gnu-awk', 'grep', 'posix-awk', 'posix-basic', 'posix-egrep', 'posix-extended', 'posix-minimal-basic', 'sed'
-regex <regex exp>   # Takes regular expression which is case sensitive
-iregex <regex exp>  # Takes regular expression which is case insensitive
-name   <file_name>  # Base of the file name.

One major difference between -name and -regex or -iregex is that -name matches the pattern with leading directories removed, where as -regex or -iregex requires the whole path to be matched in the directories or files name. 

Example -regex

Let us do an example. I have file name test1.txt in my current directory and test1.txt inside directory test as shown below.

ls test1.txt test/test1.txt
> test1.txt  test/test1.txt

To find the file test1.txt using -regex, I can use following regex.

find . -regextype egrep -maxdepth 1 -regex "^\.\/t.*1.txt$" 
> ./test1.txt

As we see above in expression, to find the files in current directory, i have used -maxdepth 1. Since my file path ./test1.txt, I will have to match the path also that is why, in the regular expression above you see i am matching ./ also which is the file path. Another thing to notice here is that I have -regextype <type> as egrep here. You can choose any other possible options such as emacs, grep etc.

Lets us remove -maxdepth 1 and see if we can find our 2nd file test1.txt which is inside the test directory.

find . -regextype egrep -regex "^\.\/t.*1.txt$"  
> ./test1.txt
> ./test/test1.txt

Yes indeed that is the case.

Example -name

As I explained earlier, if you don't want to match the path in the file name, then use -name switch. Let us try again the above example but with -name.

find . -name 'test1.txt'
> ./test1.txt
> ./test/test1.txt

Find files on Unix using timestamp

-atime

-atime 0           # Files which are accessed today
-atime +0          # Files which are accessed more than 24 hours ago
-atime 1           # Files which are accessed between 24 hours and 48 hours ago
-atime +1          # Files which are accessed more than 48 hours ago

-mtime

-mtime 0           # Files which are modified today
-mtime +0          # Files which are modified more than 24 hours ago
-mtime 1           # Files which are modified between 24 hours and 48 hours ago
-mtime +1          # Files which are modified more than 48 hours ago

-ctime

-ctime 0           # Files which status have changed today
-cmin  1           # Files which status have changed 1 minutes ago  
-cmin  -60         # Files which have changed in last 1 hour
-amin  1           # Files which are accessed 1 minutes ago

Example: ctime

Let us create a file using touch command.

touch test.txt

We can see Access, Modify and Change time stamp using stat command.

stat test.txt
File: ‘test.txt’
  Size: 0         	Blocks: 0          IO Block: 4096   regular empty file
Device: 902h/2306d	Inode: 115233265   Links: 1
Access: (0664/-rw-rw-r--)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2020-05-12 03:39:41.121967975 -0400
Modify: 2020-05-12 03:39:41.121967975 -0400
Change: 2020-05-12 03:39:41.121967975 -0400

Now to find the file which has changed in last 1 minute. If I do find -ctime 1

find -cmin 1
> ./test.txt

Find files on unix using file size

-size 8            # Exactly 8 512-bit blocks 
-size -128c        # Smaller than 128 Bytes
-size 1440k        # Files Exactly 1440Kilo Bytes in size
-size +10M         # Files Larger than 10Mega Bytes in size
-size +2G          # Files Larger than 2Gega Bytes in size

Example: -size

Let us create a size of file 0 size.

touch test1.txt

Now let us use the command find -size 0. This command will find files of size of 0 bytes.

find -size 0
> ./test1.txt

Find files and directories on unix using Find Command

-type f            # Only Files
-type d            # Only Directories
-type l            # Only Symlinks

Example: -type d

Let us say we want to find only directories. Use find command with switch -type d. Note we can use another swith -maxdepth to tell "find" how deep or recursive, we want to find the directories. For 1 level down you can use -maxdepth 1 as shown below.

find -type d -maxdepth 1

Print time stamp of a files with Find command

find -name <file_name> -printf <>             #Prints the time stamp of file with printf command
find -name <file_name> -exec ls -lrt {} +     #Prints the time stamp of file with ls command

Example -exec

Lets us try to print the time stamp of the file using ls -lrt command.

find -name 'test3.txt' -exec ls -lrt {} +
> -rw-rw-r-- 1 root root 5 May 17 15:53 ./test3.txt

Example -printf

find -name 'test3.txt' -printf '%Tc %p\n'
> Wed 13 May 2020 02:27:25 AM EDT ./test3.txt