How to Find Files on Linux

Linux gives you several powerful tools for tracking down files: the venerable find, the index-based locate, and the modern fd. Each has its sweet spot. find is exhaustive and scriptable; locate is near-instant for name searches; fd is fast, intuitive, and respects .gitignore. This guide covers all three with practical examples you can adapt immediately.

find — The Swiss Army Knife

find is part of GNU findutils and ships on every Linux system. It walks a directory tree in real time, matching files against expressions you build up left to right.

Basic Syntax

The general form is:

find [starting-path] [expression...]

Omit the path and find searches the current directory. Expressions are filters (-name, -size, -mtime) and actions (-print, -delete, -exec). Without an explicit action, -print is implied.

Search by Name

# Exact name, case-sensitive
find /home -name "report.pdf"

# Wildcard glob — quotes are required to prevent shell expansion
find /var/log -name "*.log"

# Case-insensitive
find /home -iname "readme*"

Filter by Type

# Files only
find /etc -type f -name "*.conf"

# Directories only
find /usr/local -type d -name "bin"

# Symbolic links
find /usr/bin -type l

Search by Size

Units: c bytes, k kilobytes, M megabytes, G gigabytes. Prefix + means greater than, - means less than.

# Larger than 100 MB
find /var -type f -size +100M

# Between 1 MB and 50 MB
find /home -type f -size +1M -size -50M

# Empty files
find /tmp -type f -empty

Search by Modification Time

-mtime n matches files modified exactly n days ago; +n is more than n days ago; -n is within the last n days. Use -mmin for minutes.

# Modified in the last 7 days
find /home -type f -mtime -7

# Modified more than 30 days ago — common for cleanup scripts
find /tmp -type f -mtime +30

# Modified in the last 60 minutes
find /var/log -type f -mmin -60

Running Actions on Results

-exec runs a command on each match. The literal {} is replaced by the filename, and \; terminates the command. Use + instead of \; to batch arguments (like xargs), which is faster on large result sets.

# Print file details for every .log over 10 MB
find /var/log -type f -name "*.log" -size +10M -exec ls -lh {} \;

# Delete files older than 90 days (test with -print first!)
find /tmp -type f -mtime +90 -delete

# Change permissions on all shell scripts under a project
find ~/projects -type f -name "*.sh" -exec chmod 755 {} +

Safety tip: Always run with -print first to preview matches before using -delete or a destructive -exec.

Combining Filters with Logic

# NOT: find files that are NOT .log
find /var/log -type f ! -name "*.log"

# OR: find .jpg or .png
find ~/Pictures -type f \( -name "*.jpg" -o -name "*.png" \)

# Limit depth to avoid descending too deep
find /etc -maxdepth 2 -name "*.conf"

locate — Instant Index-Based Search

locate queries a pre-built database of filenames rather than walking the filesystem. It is dramatically faster for simple name searches but cannot reflect files created since the last database update.

Install and Update the Database

The database is usually updated nightly by a systemd timer. Update it manually after installing or creating files you want to find immediately.

# Debian/Ubuntu
sudo apt install plocate

# Fedora / RHEL family
sudo dnf install mlocate

# Arch
sudo pacman -S mlocate

# Update the index
sudo updatedb

On modern systems, plocate (Debian/Ubuntu) is preferred over the older mlocate; it uses a compressed index and is several times faster.

Basic Usage

# Find all paths containing "nginx"
locate nginx

# Case-insensitive
locate -i readme

# Limit results
locate -l 20 "*.conf"

# Only show paths that currently exist on disk (skips stale index entries)
locate -e "*.sock"

locate matches the pattern anywhere in the full path, so locate nginx returns /etc/nginx/nginx.conf, /usr/sbin/nginx, and anything else containing that string.

Check When the Database Was Last Updated

stat /var/lib/plocate/plocate.db
# or for mlocate:
stat /var/lib/mlocate/mlocate.db

fd — A Modern find Alternative

fd is written in Rust, uses regex by default, respects .gitignore, and is often 5–10× faster than find on warm cache. It is not a full replacement for find in scripts (the interface differs), but it is excellent for interactive use.

Install fd

# Debian/Ubuntu (package is fd-find; binary is fdfind or fd via alias)
sudo apt install fd-find
ln -s $(which fdfind) ~/.local/bin/fd   # optional convenience symlink

# Fedora / RHEL
sudo dnf install fd-find

# Arch
sudo pacman -S fd

Basic Usage

# Find files matching a pattern (regex by default)
fd report

# Plain string search, starting from /var
fd -F "access.log" /var

# Case-insensitive (fd is smart-case by default — case-insensitive unless you use uppercase)
fd readme

# Files only, specific extension
fd -e py

# Directories only
fd -t d node_modules

fd by Size and Time

# Larger than 50 MB
fd -S +50m

# Modified in the last 2 days
fd --changed-within 2d

# Modified more than 1 week ago
fd --changed-before 1w

Running Commands with fd

# Run a command on each result (like find's -exec ... \;)
fd -e log -x ls -lh

# Batch execution (like -exec ... +)
fd -e sh -X chmod 755

fd skips hidden files and .gitignore-listed paths by default. Pass -H to include hidden files and -I to ignore .gitignore rules.

Verification

After any search command, confirm you are getting real, expected results:

# Verify a find result exists and check its details
find /etc -name "sshd_config" -type f -exec stat {} \;

# Confirm locate results are still on disk
locate -e "nginx.conf"

# Count matches to sanity-check a large result set
find /var/log -name "*.log" | wc -l

Troubleshooting

find: Permission denied errors

You will see these when traversing directories you cannot read. Suppress them with stderr redirection, or run as root for system-wide searches.

find / -name "secret.key" 2>/dev/null

locate returns stale or missing results

The database has not been updated since the file was created. Run sudo updatedb and search again. On systems with plocate, verify the systemd timer is active:

systemctl status plocate-updatedb.timer

fd ignores files I know exist

The file is likely hidden (dotfile) or listed in a .gitignore. Use fd -H -I pattern to disable both filters.

find is very slow on large filesystems

Use -maxdepth to limit the search scope, switch to locate for name-only searches, or use fd which parallelises directory traversal automatically.