VMware ESXi and vSphere Cluster Management

Search for Files with the Linux find Command on Raspberry Pi

Learn to use Linux find on Raspberry Pi OS to locate files and directories by name, type, size, permissions, owner, group, and modification criteria.

The find command searches a directory tree recursively. It begins at a location you choose, examines that directory and its nested subdirectories, and evaluates each entry against conditions you provide. It can identify regular files, directories, symbolic links, and other filesystem entries.

Common search criteria include filename, entry type, file size, permissions, user ownership, group ownership, and modification time. This lesson focuses on the most useful searches for Raspberry Pi OS.

Basic find command structure

find PATH EXPRESSION

PATH is the starting directory, or directories, that find should inspect. An expression is a test, operator, or action that determines which entries match and what happens to them.

For example:

find /home/pi/files -type f -name 'new*'

This starts in /home/pi/files, selects regular files with -type f, and then tests their names with -name 'new*'. Matching paths are written to standard output, which normally means the terminal.

When several tests appear next to each other, find combines them as logical AND by default. An entry must pass every test to be displayed.

Choosing the starting path

Absolute and relative paths

An absolute path begins at the root directory, represented by /. A relative path is interpreted from your current working directory.

find /home/pi/files
find .

The dot, ., means the current directory. Use pwd to see that directory and ls to inspect it before searching.

Searching from the root directory examines almost the entire system:

find / -name 'example.conf'

This broad search can take longer and may produce Permission denied messages because ordinary users cannot enter every system directory. Prefer the narrowest practical starting path, such as /home/pi or a project directory.

A path is not the same as a shell wildcard

Give find a directory as its starting path and use a test to match names. For example, use:

find /home/pi/files -name 'new*'

Do not rely on a shell-expanded path such as find /home/pi/files/* -name ... when you intend one recursive tree. The shell expands * before find starts, potentially passing only the directory's immediate children as starting paths and changing the search behavior.

Find files by name

Case-sensitive name matching

-name compares an entry's filename with a pattern and is case-sensitive. A prefix search for names beginning with new is:

find /home/pi/files -name 'new*'

The quotes are important. They prevent shell expansion, so find receives the pattern and applies it to every name in the directory tree.

Common filename pattern characters include:

• * matches any sequence of characters, including an empty sequence.
• ? matches one character.
• [abc] matches one character from the listed set.
• [0-9] matches one character in the specified range.

For example:

find . -name 'report?.txt'
find . -name '[Tt]est*'

These patterns are also quoted because the shell treats wildcard characters specially. This shell behavior is called shell expansion: the shell interprets patterns and other special syntax before launching the command.

Case-insensitive name matching

Use -iname when uppercase and lowercase differences should not matter:

find /home/pi/files -type f -iname '*.txt'

This can match names such as notes.txt, NOTES.TXT, and Notes.Txt.

Find by file type

Use -type to restrict results to a particular kind of filesystem entry.

To find directories named projects:

find /home/pi -type d -name 'projects'

To find regular files whose names start with new:

find /home/pi/files -type f -name 'new*'

Adding -type f prevents a directory with a similar name from appearing in a file search.

Find files by size

The -size test compares an entry's size with a numeric value and unit suffix.

find /home/pi/files -type f -size +60c

This finds regular files larger than 60 bytes. The comparison prefix and unit are separate parts of the expression.

For example, to find files larger than 10 MiB:

find /home/pi/files -type f -size +10M

For k, M, and G, find uses blocks based on kibibytes, mebibytes, and gibibytes. Size comparisons use rounded unit blocks rather than behaving like a display that shows every exact byte. Consequently, a file near a unit boundary may appear to have an unexpected result. Use c when an exact byte-based threshold is important.

Find by ownership

Every file has an associated user owner and group owner. This association is called ownership and is separate from the user currently running the command.

Find regular files owned by the user named pi:

find /home/pi/files -type f -user pi

Find entries belonging to a group:

find /home/pi/files -group developers

Use ls -l to view ownership and permissions:

ls -l /home/pi/files

Protected locations may require elevated privileges to inspect. Do not routinely use sudo for searches in your personal directories. Use it only when you are authorized to inspect a protected system location and the extra access is genuinely needed.

Find by permissions

Unix permissions control whether the owner, group, and other users may read, write, or execute an entry. The -perm test matches permission bits.

Octal notation writes permissions as three digits: one for the owner, one for the group, and one for everyone else. For example, 755 means owner permissions of read/write/execute and group and other permissions of read/execute.

To find regular files with exactly mode 644:

find /home/pi/files -type f -perm 644

Permission matching changes depending on the form used:

• -perm 755 matches an exact permission mode.
• -perm -644 requires all bits in 644 to be set, though additional bits may also be set.
• -perm /111 matches when any of the execute bits is set.

To locate executable regular files:

find /home/pi -type f -perm /111

Symbolic permission notation can express permissions by role and operation, such as u+x for execute permission for the owner. Octal notation is often clearer for an exact mode; the important point is to choose exact, all-bits, or any-bits semantics deliberately.

Combine search conditions

Adjacent tests are AND conditions by default. This example finds regular files whose names end in .log and whose size is greater than 60 bytes:

find /home/pi/files -type f -name '*.log' -size +60c

Use -o for logical OR. Parentheses group conditions, but parentheses have a special meaning to the shell, so escape them with backslashes or quote them.

find /home/pi/files -type f \( -iname '*.txt' -o -iname '*.md' \)

This matches regular files ending in either .txt or .md. Without grouping, the shell or find could interpret the conditions in an unintended order.

Read results safely

Normally, each match is printed as a path to standard output. A path can contain spaces, tabs, newlines, or other unusual characters, so do not assume that each line can always be safely treated as one filename by another command.

When machine-processing results, use null-character separators:

find /home/pi/files -type f -name '*.log' -print0 | xargs -0 ls -l

-print0 separates results with a null character, and xargs -0 reads that format safely. Before using any action that changes or deletes files, first run a search that only displays results, inspect the paths, and confirm that the conditions are correct.

Search scope, permissions, and performance

A recursive search can be slow when its starting path contains many files. It can also be noisy when the current user cannot traverse some directories. Improve searches by:

• Starting in the narrowest useful directory.
• Adding early filters such as -type f and -name.
• Using a size or ownership condition when it reduces the result set.
• Redirecting permission errors only when hiding them is appropriate.

find /home/pi -type f -name '*.log' 2>/dev/null

Here, 2>/dev/null redirects standard error, including permission messages, to a device that discards the output. This does not grant access and can hide useful diagnostic information, so use it knowingly.

For an authorized search of protected system locations, elevated access may be appropriate:

sudo find / -type f -name 'example.conf'

Using sudo can expose more of the filesystem, but it does not make an overly broad search efficient. A specific starting path and precise tests are still preferable.

Troubleshooting common find problems

The wildcard was expanded before find ran

If a pattern was not quoted, the shell may have expanded it before find received it. Quote wildcard patterns:

find . -name 'new*'

Similar names do not match

-name is case-sensitive. Use -iname when capitalization can vary:

find . -iname '*.txt'

The search uses the wrong location

Check the current directory with pwd, verify a directory with ls, and pass that directory itself as the starting path. A missing path, a typo, or an incorrectly placed wildcard can lead to no results or an unexpected search.

Permission denied messages appear

The current user cannot inspect one or more directories. Search a directory you can access, redirect errors when appropriate, or use sudo only for an authorized protected search.

A size search misses an expected file

Check the unit and comparison prefix. c means bytes; + means larger than; - means smaller than; and no prefix requests an exact unit-based size match. Rounded block behavior affects k, M, and G searches.

Directories appear in a file search

Add -type f. Similarly, use -type d when only directories are wanted.

Quick reference