Project20.File Finding Tips

Project 20. File Finding Tips

What other criteria can I use when searching for files?

This project will add to your arsenal of find techniques, with some powerful tips and suggestions for more nuanced searches. Projects 15, 17, and 18 show you how to use the command find.

Find Files Since

These tips use the find command's ability to compare the timestamps of different files. Primary -newerXY is used to compare the timestamp of each file found to see whether it is newer than a reference file. Both X and Y can be a for access time or m for modification time. X is the found file, and Y is the reference file. Primary -newer is equivalent to -newermm. (You can also specify c for creation time, but this always seems to be equivalent to modification time.) Some examples will clarify the use of newer.

Since Last Restart

List all files modified/created since the last restart. This example finds all files in your home directory that are newer than /mach.sym. (/mach.sym is a file that's created anew each time OS X boots.)

$ find ~ -newer /mach.sym

Since a Marker File

Create a file at the start of the day to keep track of all files you have edited. This example also shows how to check file modification and access times against a marker file.

First, create two files that will be older than the marker file.

$ touch old1 old2

Now create the marker file.

$ touch ref

Note

Read the man page for the command touch.

Finally, create a file that is newer than the marker file.

$ touch new

Let's find all files that have a modification time later than the modification time of the marker file . . .

$ find . -newermm ref ./new

. . . and all files that have an access time later than that of the marker file.

$ find . -neweram ref ./new

Now modify old1 by using command touch -m, and you see that its modification time is now later than that of the marker file.

$ touch -m old1 $ find . -newermm ref ./new ./old1 $ find . -neweram ref ./new

Now access old2 using command touch -a, and you see that its access time is now later than that of the marker file.

$ touch -a old2 $ find . -newermm ref ./new ./old1 $ find . -neweram ref ./new ./old2

Find Empty Files

The following command finds all empty files and directories.

$ find . -empty

To remove them use:

$ find . -empty -delete

The delete option removes files and directories. If a directory contains just empty files, the files will be deleted; then the directory, which is now empty, will also be deleted. Nice!

Tip

The command line

$ find . -size 0

will not find empty directories because an empty directory does not have a zero sizejust no files in it.

Remove the Full Pathname

The primary -execdir will execute its command from the directory that holds the current file. In contrast, -exec executes its command from the directory in which find was launched. Therefore, -execdir need not, and does not, pass the full pathname of current file when it invokes its command, in exactly the same way that you are able to avoid passing the full pathname when you execute a command from the directory containing the file you pass to it. You can use this feature in other ways, too, as in the following example, which uses echo to show exactly what -execdir passes to its command.

$ find ~/Pictures -name "*.psd" -execdir echo {} \; ferdi-coll3.psd ferdi-cool.psd ferdi-gala.psd

Compare this with the usual form.

$ find ~/Pictures -name "*.psd" /Users/saruman/Pictures/complete/ferdi-coll3.psd /Users/saruman/Pictures/complete/ferdi-cool.psd /Users/saruman/Pictures/complete/ferdi-gala.psd

Follow Symbolic Links

Make find follow symbolic links. /etc is a symbolic link to /private/ etc, and if you use find on /etc, it will not follow the link.

Learn More

Project 19 helps you understand Unix links.

Rather unexpectedly, the following finds no files.

$ find /etc /etc

Use either

$ find -L /etc /etc /etc/6to4.conf /etc/afpovertcp.cfg ...

or

$ find /private/etc /private/etc /private/etc/6to4.conf /private/etc/afpovertcp.cfg ...

Option -H will work too. It's slightly different in that it tells find to follow the symbolic link given on its command line, rather than the symbolic links found during the search.