Chapter 29 — Finding things: `find`, `locate`, `which`, `grep -r`

In one sentence

find searches the filesystem live (slower, always accurate, endlessly flexible), locate searches a pre-built index (instant, can be stale), and which/type tell you exactly which program a command name actually resolves to — different tools for genuinely different questions.

Why this matters

"Where is this config file," "which binary actually runs when I type this command," and "what changed on this box in the last hour" are all real, constant, and each has a specific right tool.

How it actually works

   find /path -name "*.log"          # search BY NAME, live, recursive
   find /path -type f                # only regular files (-type d = dirs)
   find /path -mtime -1               # MODIFIED in the last 1 day
   find /path -size +100M             # LARGER than 100 megabytes
   find /path -perm -4000             # has the SUID bit set (Chapter 25)
   find /path -name "*.tmp" -delete    # find AND act -- delete matches
                                      # (careful -- test without -delete
                                      # first!)

   locate filename                    # instant, but reads a PRE-BUILT
                                     # INDEX (usually updated once daily
                                     # via a cron job, `updatedb`) --
                                     # can miss recently-created files

   which command                      # shows the FULL PATH of the
                                     # executable that would run, based
                                     # on your $PATH
   type command                        # similar, but also reveals if
                                     # it's a SHELL BUILTIN, alias, or
                                     # function, not just a file on disk

   grep -r "TODO" /path               # search file CONTENTS recursively
                                     # (different from `find`, which
                                     # searches by NAME/metadata, not
                                     # content)

Real-world example

   `find` with time-based filters is a genuine, standard, real
   FIRST STEP in incident-response and intrusion-investigation
   workflows -- documented extensively across security and forensics
   guidance (including this wiki's own security guides): when
   investigating "was this box compromised, and when," a very common
   early command is something in the spirit of:
     find / -mtime -1 -type f 2>/dev/null
   ("show me every regular file modified in the last day") -- because
   an attacker who has planted a webshell, modified a config, or added
   a persistence mechanism (a cron job, a new SSH key, a systemd unit)
   has, almost by definition, MODIFIED FILES, and time-based `find`
   filters are one of the fastest ways to narrow "the entire filesystem"
   down to "the small number of things that actually changed recently"
   -- a genuinely practical, real application of a command that looks,
   on the surface, like a simple file-search utility.

Try it yourself

cd ~/lab/playground

# Create some files with different ages (simulated) and sizes
touch old_file.txt
dd if=/dev/zero of=big_file.bin bs=1M count=5 2>&1 | tail -1
mkdir subdir && touch subdir/nested.txt

find . -type f                       # everything
find . -name "*.txt"                 # by name pattern
find . -size +1M                     # by size
find . -mtime -1                     # modified in the last day (should
                                     # be everything you just created)

which ls; type ls                    # compare the two
which cd; type cd                    # `which` may find nothing or be
                                     # confusing -- cd is a shell BUILTIN,
                                     # not a file on disk; `type` shows
                                     # this clearly

grep -r "TODO" . 2>/dev/null || echo "(no TODOs found, as expected)"

rm -rf big_file.bin old_file.txt subdir

Common mistakes

Using locate and expecting it to find a file created five minutes ago. Its index is only as fresh as the last updatedb run — use find when you need certainty about the CURRENT filesystem state.
Confusing find's name search with content search. find -name "*.log" finds files whose NAME matches; grep -r "pattern" finds files whose CONTENT matches — genuinely different questions.
Running find ... -delete without testing the search first. Always run the find WITHOUT -delete first, read the output carefully, THEN add -delete once you're certain.

Check yourself

What's the key trade-off between find and locate?
What's the difference between what which and type each tell you?
Why is a time-based find search a standard early step in incident investigation?

Chapter 29 — Finding things: find, locate, which, grep -r