find

LINUXLPIC1-101

3/5/2026

This looks at when the content of the file was last modified.

Trigger: You edited the text inside a file, or you wrote data to it.
Exam Context: This is the most common one. If you are looking for files that "changed" in the last 60 minutes, this is usually what you want.
Example: find . -mmin 60

The -perm flag for the find command is incredibly powerful because it allows you to search for files based on their security settings.

If you provide a mode without any symbol (like - or /), find looks for files that have exactly those permissions—no more, no less.

Command: find /etc -perm 644
What it does: Finds files where the owner has rw, and everyone else has r. If a file has 645, it will not show up.

This is the most common use case for security audits. It searches for files that have at least the bits you specify.

Command: find . -perm -222
What it does: Finds files that are writeable by everyone (User, Group, and Others).
Logic: It doesn't matter if they also have read or execute permissions; as long as all three "write" bits are set, the file is a match.

This is a "logical OR" search. It finds files where any of the bits you specify are set.

Command: find /bin -perm /111
What it does: Finds files that are executable by anyone.
Logic: If the User or the Group or Others have the execute bit (x), the file is returned. This is great for finding any kind of script or binary.

Example Logic Type Meaning

-perm 600 Exact Must be exactly rw-------.

-perm -600 AND Must have at least rw for the owner.

-perm /600 OR Must have either r or w (or both) for the owner.

While we previously mentioned numbers in octal, find also accepts symbolic notation.