Searching Files

kali-linux
Locating files on Kali Linux with find, locate, and which, and telling external commands apart from shell built-ins.
Published

Apr 5, 2022

find

The find command - which is the most complex and powerful in this category - searches for files in a directory hierarchy. Its capabilities go beyond a simple file search. You can search by file age, timestamp, permissions, size, owner, and many more. Look at these:

  • find / - At minimum, find gets a path to find the files. Do you remember that / means root of the FHS? So find / displays every single file on your Kali Linux machine
  • find . -name file1 - Here . means current path. It will find file1 in the current path recursively.
  • find . -iname FiLe1 - Not case sensitive
  • find . -empty - Finds empty files

Acting on files

  • Option -ls runs ls -dils on each file.
  • Option -exec runs command on found files. You can point to the file with {} and finish your command with \;
  • find . -empty -exec rm '{}' \;
  • find . -name "*.htm" -exec mv '{}' '{}l' \;
  • The -user and -group specifies a specific user & group.
  • Or even find the files not belonging to any user or group with -nouser and -nogroup
  • Add a ! just before any phrase to negate it. So, this will find files not belonging to musetrmann: find . ! -user mustermann

locate

The locate command is faster than find to find the files and directories. If you create a new file and search it by locate command, you will not be given any result unless you apply sudo updatedb command or wait for 1 day.

┌──(kali㉿kali)-[~]
└─$ locate wget.exe
/usr/share/windows-resources/binaries/wget.exe

which

The which command returns the pathnames of the files (or links) which are defined in the $PATH environment variable.

┌──(kali㉿kali)-[~]
└─$ echo $PATH
/usr/local/sbin:/usr/sbin:/sbin:/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games:/home/kali/.dotnet/tools

┌──(kali㉿kali)-[~]
└─$ which ping
/usr/bin/ping

External and Internal Commands

  • External commands are typically stored in as binaries in /bin directory. To execute an external command, shell checks $PATH variable. If command presents in the location mentioned in $PATH variable, shell executes it, otherwise it returns an error.
  • Internal commands are shell built-in. Shell does not start dedicated process to run them:
┌──(kali㉿kali)-[~]
└─$ which cd
cd: shell built-in command

┌──(kali㉿kali)-[~]
└─$ which echo
echo: shell built-in command

┌──(kali㉿kali)-[~]
└─$ which pwd
pwd: shell built-in command
Back to top