A Practical Linux find Workflow: Locate, Filter, and Safely Act on Files

When searching for a file on a Linux system, the `find` command examines the entire filesystem, not just file contents or a separate filename index. To locate a specific file, provide a starting directory, add filters to narrow results, and the command will display matching paths. For instance, `find ./project -type f -name config.yaml` searches the `./project` directory and its subdirectories for regular files named `config.yaml`.

The starting directory is crucial: a focused search usually yields faster and easier review than a system-wide search from `/`.

A helpful mental model for constructing searches is: `find starting-path tests actions`. The starting path dictates where the search begins, tests filter paths by name, type, size, age, and other attributes, and actions determine what happens to matching paths. If you omit an action, `find` prints the paths instead. Begin with a path and a single test, adding filters only when necessary to avoid unexpected results.

For example, `find . -type f -name README.md` finds a file named `README.md` in the current directory tree, while `find /etc -type f -name hosts` searches a specific system directory. To restrict the search to just the current directory, use `find . -maxdepth 1 -type f -maxdepth`. This option is available on most Linux systems, but check the target system's man page for `find` to ensure portability.

Name matching can be case-sensitive using `-name` or case-insensitive using `-iname`. Patterns like `*.log` should be quoted to prevent the shell from expanding them prematurely. To match a name without considering capitalization, use `find . -type f -iname readme.md`. To locate directories named `cache`, use `find . -type d -name cache`. Symbolic links can be found with `find . -type l`.

The `-type` argument specifies the file type, with `f` for regular files, `d` for directories, and `l` for symbolic links. `-name` checks the base name, while `-path` matches a path component, such as `find . -path */vendor/* -type f`. To filter by size or modification time, use `-size` and `-mtime`. For example, `find . -type f -size +100M` finds files larger than 100 MiB, and `find . -type f -mtime -1` finds files modified within the last 24 hours.

Note that `-mtime` counts whole 24-hour periods, not calendar dates. For checking disk usage, consider using `du` instead.