find Command Cheat Sheet: Search, Filter, and -exec Examples

find walks a directory tree and matches files against expressions: name, type, size, time, owner, permission, or anything you can compose. The expression language is its own micro-DSL with order-sensitive operators, NUL-safe output via -print0, and a handful of macOS BSD versus GNU divergences that catch out scripts shipped between platforms. This page is the reference I keep open while writing batch-rename, cleanup, and pre-deploy scripts.

What does the find command do?

find recursively searches a directory tree and prints the paths of files (and directories) that match an expression. It is the canonical tool for "find every file under X that matches Y" on Unix systems. Common uses: locate files by name (-name, -iname), filter by type (-type f, -type d, -type l), filter by size (-size +100M) or modification time (-mtime -7), then act on the results with -exec, -execdir, -delete, or by piping -print0 into xargs -0. The expression is parsed left to right; tests like -type f filter, while actions like -print or -delete operate on the matches. macOS ships BSD find, which differs from GNU find in regex defaults, the absence of -regextype, and slightly different -mtime rounding. On Windows, PowerShell's Get-ChildItem covers most of the same ground with different syntax.

Time and size reference

Keep these two tables in view while you set the inputs below. find measures time in days (-mtime) or minutes (-mmin), and size with a one-letter unit suffix.

Time filters:

Size units (-size suffix):

+ before the value means "larger than", - means "smaller than", no sign means "exactly" (rounded up to the next whole unit).

Find by task (jump table)

Skim by intent and jump straight to the section. Every command updates with the values you set above.

Find files by name

Match every file whose name matches a pattern. This is what 80% of find invocations do.

find :search_path -name ':pattern'

Case-insensitive match (matches .log, .LOG, .Log all the same):

find :search_path -iname ':pattern'

PowerShell's -Filter is case-insensitive by default, matching Windows' filesystem behavior. On Linux/macOS, -name is case-sensitive (-iname is the insensitive variant).

Limit how deep find recurses (avoid running away into a huge tree):

find :search_path -maxdepth 2 -name ':pattern'

-maxdepth N is a GNU extension that BSD find also supports, despite being non-POSIX. Both macOS and Linux accept it.

Find files by type

find :search_path -type f -name ':pattern'

Find empty files or empty directories:

find :search_path -type f -empty

Find files by size

Set the Size value and Size unit in the panel above (the unit table is in Time and size reference). + means larger than, - means smaller than.

find :search_path -type f -size +:{size_value}:{size_unit}

For "smaller than", flip the + to -: find :search_path -type f -size -:{size_value}:{size_unit}.

Find the biggest log files on disk, sorted largest first:

find :search_path -type f -name ':pattern' -printf '%s %p\n' | sort -rn | head -20

-printf is GNU only. On BSD use -exec stat with the BSD stat format flags. That difference is one of the most common scripts-fail-on-macOS surprises.

Find files modified in the last N days

Pick a window from the Modified within dropdown above. The dropdown shows the find expression each option maps to (the time reference table explains the syntax).

find :search_path -type f :time_filter

To find files older than a window and delete them (typical cleanup script), flip the leading - in the expression to +. The full -mtime and -mmin reference, including the off-by-one rounding rule, is in Find files modified in the last 7 days:

find :search_path -type f -mtime +30 -delete

Subtle macOS difference: BSD find -mtime -N rounds the time differently than GNU. GNU rounds the file's age down to 24-hour units; BSD treats fractional days differently in some edge cases. For scripts that need exact behavior, use -newerXY (BSD) or -mmin (both) with explicit minutes.

Find files by owner or permission

find :search_path -type f -perm 0644

Find anything world-writable (security hygiene check):

find :search_path -xdev -type f -perm -o+w 2>/dev/null

Find files owned by a specific user:

find :search_path -user www-data -type f

Run a command on every match

-exec runs a command for each match. The {} placeholder is replaced with the path; the command must end with \; (escaped semicolon).

find :search_path -type f -name ':pattern' -exec grep -l 'ERROR' {} \;

Replace \; with + to batch arguments into fewer command invocations (much faster on large trees):

find :search_path -type f -name ':pattern' -exec grep -l 'ERROR' {} +

-execdir runs the command in the directory of the matched file. Safer when paths have spaces or weird characters because the {} is just the basename:

find :search_path -type f -name ':pattern' -execdir rm {} \;

-delete is the shortest form. Use with extreme care: there is no confirmation, no dry run, and order matters (always test with -print first):

find :search_path -type f -name ':pattern' -delete

A safe pattern for any destructive find: write it with -print first, eyeball the list, then change -print to -delete.

Pipe find safely into another command

find ... | xargs command looks innocent but breaks the moment a filename contains a space, newline, or quote. The fix is NUL-delimited output: -print0 from find, -0 on xargs.

find :search_path -type f -name ':pattern' -print0 | xargs -0 gzip

Why this matters: filenames on Unix can contain literally any byte except / and NUL. -print separates with newlines, but newlines are valid in filenames. The only safe separator is NUL (\0).

This pattern is the safe equivalent of find ... -exec cmd {} +, useful when you need shell features (piping, redirection) that -exec cannot give you. It pairs with the grep cheat sheet for the most common find-then-grep pipelines.

macOS BSD vs GNU find

The divergences that matter, in order of how often they bite.

The single most common cross-platform script failure is -printf on macOS. There is no clean BSD equivalent; either guard with if command -v gfind, or install GNU find via Homebrew (brew install findutils) and use gfind explicitly.

brew install findutils
alias find='gfind'
alias xargs='gxargs'

If your shell scripts need to run on both Linux and macOS, stick to the POSIX-ish intersection: -name, -iname, -type, -size, -mtime, -mmin, -perm, -newer, -print, -print0, -exec, -execdir, -delete. Everything outside that set risks BSD/GNU drift.

Common find gotchas

1. Forgetting to quote the pattern. find . -name *.log lets the shell expand *.log first. If a matching file exists in the current directory, that gets passed as the pattern; if none does, you get a confusing "paths must precede expression" error. Always quote: find . -name '*.log'.

2. -print is unsafe in pipelines. Filenames with spaces or newlines break xargs by default. Use -print0 | xargs -0 for any pipeline that handles arbitrary paths.

3. The -exec ... {} \; semicolon is shell metacharacter. Always escape with backslash or quote: \; or ';'. Without it, the shell ends the find command at the semicolon.

4. -exec ... {} + versus -exec ... {} \;. The + form batches arguments into a single command invocation (fast). The \; form forks once per match (slow on large trees). Use + unless the command can only accept one path at a time.

5. -delete happens depth-first but order can surprise you. If you want to delete files and then empty directories, find . -depth -type d -empty -delete after the file delete pass. The -depth flag forces children before parents.

6. -maxdepth and -mindepth must come BEFORE other tests. Putting them after -name or -type is technically legal but evaluated left to right, which can produce surprising results. Place depth restrictions first.

7. -name matches the basename only, not the path. find . -name 'src/*.ts' will never match because the slash makes it a path, not a basename. Use -path '*/src/*.ts' instead.

8. find / with no filters scans the whole filesystem. Including network mounts, /proc, /sys. Always scope with a real start path or add -xdev to stay on one filesystem.

What to do next

Deep dives by task (each one is the dedicated reference for a specific find use case):

• Find files modified in the last N days: the -mtime and -mmin reference, with the off-by-one rule
• Find files not modified since N days: the inverse +N direction, for stale-file detection
• Find files larger than a size: the -size reference for thresholds
• Find the largest files on disk: the ranked "what is eating my disk" workflow
• Find and delete files safely: the -delete playbook with the safe two-step pattern
• Find empty directories and files: -empty, and the -depth deletion-order trap
• Find files by extension: one extension or many, with the grouping-parens rule
• Find files by owner or permission: -user, -perm, and the SUID/world-writable audits
• Exclude a directory with -prune: the -prune -o ... -print pattern explained
• find -regex vs -name: when to use a regex, and the whole-path matching surprise
• find -exec vs xargs: when to use each, with the {} + trick that beats both
• Run find in parallel with xargs -P: the parallelism deep-dive
• Find files containing text (find + grep): the most common find-then-tool pipeline
• Archive find results with tar: the safe -print0 | tar --null pipeline
• rsync only the files find selected: selective sync by time, type, or curated list
• BSD find vs GNU find: every macOS vs Linux divergence that matters
• find vs locate vs mlocate: live-walk vs database search, and when to use each

Related cheat sheets:

• grep cheat sheet: the classic pairing for find. find ... -print0 | xargs -0 grep is one of the most common pipelines.
• SSH cheat sheet: for running find against remote hosts.
• curl cheat sheet: for downloading lists of files that find generates.
• Bash for loop: when you need to loop over find output with logic that does not fit in -exec.
• Bash while loop: the safe while IFS= read -r -d '' file; do ...; done < <(find ... -print0) pattern for processing files line by line.
• How to zip multiple directories into individual files: a worked example of find ... -print0 | xargs -0 zip.
• How to increase Google Cloud VM disk size without rebooting: uses find for the cleanup pass before resizing.
• External: GNU findutils manual, FreeBSD find(1), PowerShell Get-ChildItem.

FAQ