How to Find a File in Linux: Commands, Options, and When to Use Each

Knowing how to locate files efficiently is one of the most practical Linux skills you can develop. Whether you're tracking down a config file buried in /etc, searching for a log you haven't touched in weeks, or hunting down duplicate files across a mounted drive, Linux gives you several powerful tools to get the job done — each suited to different situations.

The Core Command: find

The find command is Linux's most versatile file-search tool. It searches the filesystem in real time, directory by directory, and supports a wide range of filters.

Basic syntax:

find [starting directory] [options] [expression] 

Common examples:

find /home/username -name "report.txt" find / -name "*.log" find /var -type f -name "error*" 

• -name matches by filename (case-sensitive)
• -iname matches by filename (case-insensitive)
• -type f limits results to files (not directories)
• -type d limits results to directories

You can also filter by modification time, file size, and permissions:

find /home -mtime -7 # modified in the last 7 days find /var/log -size +10M # files larger than 10MB find /etc -perm 644 # files with exact permission 644 

find is thorough but can be slow on large filesystems because it scans in real time without using an index.

Faster Searches with locate

The locate command searches a pre-built database of filenames rather than crawling the filesystem live. This makes it significantly faster for simple name-based searches.

locate report.txt locate -i report.txt # case-insensitive 

The trade-off:locate only knows about files that existed when the database was last updated. On most Linux systems, the database is refreshed daily via a scheduled job (updatedb). If you've just created or moved a file, locate may not know about it yet.

You can manually update the database:

sudo updatedb 

locate is ideal when you need a quick answer and the file is unlikely to be brand new. find is better when freshness matters or when you need to filter by attributes beyond just the name.

Searching by File Content with grep

Sometimes you don't know the filename — you know something inside the file. That's where grep comes in. 🔍

grep -r "database_host" /etc/ grep -rl "TODO" /home/username/projects/ 

• -r searches recursively through directories
• -l returns only filenames (not matching lines)
• -i makes the search case-insensitive

grep is particularly useful for config files, source code, and log files where the content is more identifiable than the name.

Comparing the Main Search Tools

Additional Tools Worth Knowing

which and whereis — These are specialized for locating executables and binaries, not general files.

which python3 whereis gcc 

which returns the path of the command your shell would execute. whereis goes further and finds related man pages and source files.

fd — A modern alternative to find, written in Rust. It's faster in many real-world scenarios, uses more intuitive syntax, and respects .gitignore rules by default. It's not installed by default on most distributions but is available through standard package managers.

fd report.txt fd -e log /var 

If you're doing a lot of file-searching on large codebases or filesystems, fd is worth exploring.

Practical Search Patterns

Find files modified in the last 24 hours:

find /home -mtime -1 -type f 

Find and list large files taking up space:

find / -type f -size +500M 2>/dev/null 

The 2>/dev/null suppresses permission-denied errors, which keeps output clean when searching system directories.

Find files owned by a specific user:

find /var -user www-data -type f 

Combine find with exec to act on results:

find /tmp -type f -name "*.tmp" -exec rm {} ; 

This deletes every .tmp file in /tmp. Be deliberate with -exec — there's no undo.

Variables That Change Which Approach Makes Sense 🗂️

Several factors shape which tool is actually right in a given situation:

• Filesystem size — On large filesystems, locate or fd may be noticeably faster than find
• File age — Newly created files won't appear in locate's database until it's updated
• Search criteria — Name only, content, permissions, ownership, and size all call for different approaches
• User permissions — Searching system directories often requires sudo; without it, many paths will return permission errors
• Distribution and installed packages — Tools like fd aren't available by default everywhere; locate may be provided by mlocate or plocate depending on the distro

A developer searching a codebase for a function name has a very different workflow than a sysadmin tracking down a misconfigured service file or a user looking for a document they saved months ago. The same Linux system, the same question — different answers depending on what you're actually trying to do and where you need to look.