How to Find a File in Linux: The Ultimate Terminal Cheat Sheet

The complete Linux file search toolkit: find, fd, grep, ripgrep, and fzf with real examples for name, content, size, time, permissions, and safe deletion.

Ekin Yalgın

April 5, 2025·5 min read

How to Find a File in Linux: The Ultimate Terminal Cheat Sheet

Staring at an endless stream of permission denied errors after triggering a clumsy search across your root directory wastes precious development time. Locating a misplaced configuration file or a specific error log requires surgical precision rather than brute force.

Search by exact file name: find . -name file.txt
Scan text inside files: grep -r error_code .
Locate massive files instantly: find . -type f -size +1G
Modern lightning-fast alternative: fd config

Search by Name and Extension (find vs fd)

The Classic Method: find Command Basics

The find utility exists on every Unix system by default. You give it a starting path and a name pattern to begin scanning immediately. Appending 2>/dev/null at the end of your command hides those annoying permission warnings. This keeps your terminal output perfectly clean and readable.

find . -name "app.log"

Case-sensitive by default. Use -iname to match regardless of capitalization:

find . -iname "notes.txt"

To search by extension across all subdirectories:

find /home -name "*.py"

For locating directories specifically, add -type d. A practical example: finding a backup folder anywhere in your home directory.

find . -type d -name "backup"

Once you locate one, you may also need to find a directory's full path to use it in scripts.

The Modern Alternative: Using fd for Faster Searches

The fd tool, written in Rust, operates significantly faster than find on most workloads. It automatically ignores hidden files and respects your .gitignore patterns out of the box. No flags needed for the common case.

# Install on Debian/Ubuntu
sudo apt install fd-find

# On Arch
sudo pacman -S fd

# Basic usage (replaces find . -name "*config*")
fd config

The default behavior handles what most developers actually need: recursive search from the current directory, case-insensitive matching, and .git folder exclusion. Use find when you need precise control over permissions, timestamps, or execution.

Search Inside File Contents (grep and ripgrep)

Scanning Text with grep -r

Sometimes you forget the file name but remember a specific function or variable inside it. The grep -r command recursively checks the contents of every file within a directory tree.

grep -r "connectDatabase" /var/www/html

Useful flags:

-n: show the exact line number where the match appears
-l: list only filenames, not the matched text
-w: match whole words only (avoids partial matches)

Why Developers Switch to ripgrep (rg)

Searching through a large codebase with grep -r takes noticeably longer on projects with thousands of files. ripgrep (rg) respects .gitignore rules, skips binary files, and handles large directories in milliseconds.

# Install
sudo apt install ripgrep

# Search recursively (same as grep -r but much faster)
rg "connectDatabase"

For live log monitoring after you locate the file, the Linux tail command picks up where grep leaves off.

Interactive Live Search: Finding Files with fzf

Static command outputs feel restrictive when you are not exactly sure what you are looking for. The fzf utility provides an interactive, fuzzy text filter right inside your terminal.

sudo apt install fzf

Press Ctrl+T in your shell to open a live search interface where results update instantly as you type. Combine it with find for a fully interactive file picker:

find . -type f | fzf

This becomes especially useful when navigating unfamiliar project structures or searching across multiple potential filename variations.

Filter by Size, Time, and Permissions

Locating Large Log Files (-size)

Servers slow down when runaway log files consume available disk space. Run this to find everything over 500MB in your log directory:

find /var/log -type f -size +500M

For a size range between 50MB and 100MB:

find . -type f -size +50M -size -100M

Filtering by Modified Time (-mtime)

Debugging an incident requires knowing exactly which files changed right before the crash.

# Files modified in the last 24 hours
find . -mtime -1

# Files modified exactly 7 days ago
find . -mtime 7

# Files modified more than 30 days ago
find . -mtime +30

Finding World-Writable Files (-perm)

Sensitive files left open to everyone are a security risk. This command reveals every file with unrestricted permissions:

find . -perm 777

To also find files owned by a specific user:

find /home -user john -type f

Advanced: Execute Commands on Found Files

Performance: xargs vs -exec

Passing search results to another command like chmod requires a choice between two approaches.

# -exec spawns a new process per file (slower with many files)
find . -name "*.log" -exec rm {} \;

# xargs batches files together (one process handles all)
find . -name "*.log" | xargs rm

For thousands of files, xargs is noticeably faster. The -exec {} + variant is a middle ground that also batches files:

find . -name "*.log" -exec rm {} +

Dry-Run Before Deleting

Wiping out the wrong directory is a permanent mistake. Always test destructive commands with echo first:

# Safe preview
find . -name "*.tmp" -exec echo rm {} \;

# Only run this after confirming the list is correct
find . -name "*.tmp" -exec rm {} \;

To delete the directory once you confirm it is safe to remove the directory, use rm -rf with the path.

Find System Files Instantly with locate

Crawling the entire hard drive from scratch takes too long for common administrative tasks. The locate command queries a pre-built database, returning file paths in milliseconds.

sudo apt install mlocate
sudo updatedb
locate my_secret_file.txt

locate returns results instantly, but it will miss files created after the last updatedb run. For recent files or anything where accuracy matters, find is the right choice.

If you are running Linux through WSL on Windows, the same commands apply, though setting up WSL2 on Windows correctly first avoids path issues between the two filesystems.

When to Use Which Command

locate: instant results for stable system files
find: precision filters, recent files, permissions, timestamps
grep / rg: forgot the filename but remember what is inside
fd: daily development use, faster than find with sane defaults
fzf: interactive, exploratory search across large project trees

FAQ

Frequently Asked Questions

Use the find command with the -name flag: find . -name "filename.txt". For case-insensitive matching use -iname. If you know only part of the name, wrap it in wildcards: find . -name "*config*". The dot means start from the current directory; replace it with a path like /home to search a specific location.

Use grep -r "search_term" /path to recursively search file contents. Add -n to show line numbers and -l to list only filenames without the matched text. For large codebases, ripgrep (rg) is a faster alternative that respects .gitignore rules and skips binary files automatically.

fd is a modern, Rust-based alternative to find that is significantly faster on most workloads. It ignores hidden files and .gitignore patterns by default, which makes it ideal for daily development use. Basic usage is simply fd pattern with no required flags. Install it with sudo apt install fd-find on Debian/Ubuntu.

Always do a dry run first. Add echo before the deletion command to preview what will be removed: find . -name '*.tmp' -exec echo rm {} \;. Only replace echo rm with rm after confirming the file list is correct. For thousands of files, pipe to xargs instead of using -exec, as xargs batches the operations into fewer process calls.

find searches the actual filesystem in real-time and is always accurate, while locate queries a pre-built index database and returns results instantly. The trade-off: locate will not find files created after the last updatedb run, while find will always reflect the current state of your disk. Use locate for stable system files and find for recent work or when you need precise filters.

Run find . -mtime -1 to list all files modified within the last 24 hours. Change the number to adjust the window: -mtime -7 covers the last week, and -mtime +30 finds files older than 30 days. This is useful for debugging incidents, finding recently edited configs, or identifying which logs were written during a specific event.

Both methods pass find results to another command. The -exec flag runs the command once per file: find . -name '*.log' -exec rm {} \;. Piping to xargs is faster with large file sets because it batches the files into a single command call: find . -name '*.log' | xargs rm. Use -exec {} + as a middle ground that also batches but stays within the find command itself.

Published in

Operating Systems