Chapter 7: Finding Files

©Copyright Network Development Group 2013.

 The locate Command
• Useful for fast searches of a filesystem for a
file(s)
• Uses a database which is updated once a day
• Database updated by administrator using the
updatedb command
• Syntax:
$locate filename

©Copyright Network Development Group 2013.

 The locate Command
• The locate command only will return results of
files that the current user would normally have
access to
• The locate command will display all files that
has the search term anywhere in the file name
• The locate command is case sensitive, To have
the locate command not be case sensitive, use
the -i option.

©Copyright Network Development Group 2013.

new file called lostfile isn't initially found by the locate command.

sadmin@localhost:~$ touch lostfile

sadmin@localhost:~$ locate lostfile

er the database is updated by the su -c updatedb command, the locate command can find
e lostfile file.

sadmin@localhost:~$ su -c updatedb
ssword:
sadmin@localhost:~$ locate lostfile
ome/joe/lostfile

fter the lostfile file has been deleted, the locate command will still report that the file "exists".

ysadmin@localhost:~$ rm lostfile
ysadmin@localhost:~$ locate lostfile
home/joe/lostfile

©Copyright Network Development Group 2013.

 The locate Command
• Advantages
- Fast. Searches a database of all files on
the computer verses the live filesystem
the find command uses
• Disadvantages:
- The database is only updated once per day so
new files are not in the database
- You can only search for files by name verses
other search criteria the find command supports

©Copyright Network Development Group 2013.

 The find Command
• Searches a live filesystem for specified file(s)
• Supports different search criteria options
• Searches the live filesystem which can take a
large amount of time
• Slower than the locate command
• Example: find / -name file_name(s)

©Copyright Network Development Group 2013.

If multiple criteria are specified, then all criteria must match as
the find command automatically assumes a logical "and"
condition between criteria (which could be explicitly stated by
using -a between criteria). For example, the folder
Downloads must also be owned by sysadmin in order for find to
produce a result:
sysadmin@localhost:~$ find . -user sysadmin -a -name
Downloads./Downloads
Logical "or" conditions can also be specified between criteria
with the -o option as well as logical groupings of criteria using
the parentheses. The following output lists files that are either
named Downloads or owned by sysadmin.
sysadmin@localhost:~$ find . -user sysadmin -o -name
Downloads

©Copyright Network Development Group 2013.

 The find Command Options
Example Meaning
-iname Case insensitive search by name
LOSTFILE
-mtime -3 Files modified less than three days ago
-mmin -10 Files modified less than ten minutes ago
-size +1M Files larger than one megabyte
-user joe Files owned by the user joe
-nouser Files not owned by any user
-empty Files that are empty
-type d Files that are directory files
-maxdepth 1 Do not use recursion to enter subdirectories; only search
primary directory

©Copyright Network Development Group 2013.

 The whereis Command
• Displays the directory location and man page
for the specified command
• Searches only the directories defined by the
$PATH variable
• Example:
$ which grep
grep: /bin/grep /usr/share/man/man1/grep.1.gz

©Copyright Network Development Group 2013.

 The which Command
• Displays the directory location(s) of the specified
command or script
• Returns the location of the real command
• Searches only the directories defined by the $PATH
variable
• The -a option is used to locate multiple executable
files. Useful to know if an executable script was
inserted maliciously to override an existing
command.

©Copyright Network Development Group 2013.

 Introduction to FHS
• The Filesystem Hierarchy Standard (FHS) is
standard that specifies standard directories and
their content for use with a filesystem
• Helps to know what directories to expect to find
and what to find in them
• Allows programmers to write programs that will be
able to work across a wide variety of systems that
conform to this standard

©Copyright Network Development Group 2013.

 History of FHS
• First known as known as the Filesystem
Standard (FSSTND)
• Renamed in 1997 with series 2
• Final series 2 (2.3) published in 2004
• Draft version of series 3 published in 2001
- Still under review
- Unofficial changes ongoing

©Copyright Network Development Group 2013.

 Recent unofficial changes
• New directory additions:
/run to contain volatile data that changes at
runtime
/sys to hold files related to the kernel
• Directory merging:
/bin merged into /usr/bin
/sbin merged into /usr/sbin
/lib merged into /usr/lib

©Copyright Network Development Group 2013.

 Directory classifications

• If a directory structure is classified as shareable, then it

typically does not contain anything that would be unique
to a particular system like a configuration file
• If a directory structure is classified as static it means that it
usually doesn't change and may suggest that it might be
mounted read-only
• If a directory structure is classified as variable, it is likely to
change and would have to be available for both read and
writes

©Copyright Network Development Group 2013.

 Important directories
• FHS standard details many directories
• Administrators should know those on the
next three slides

©Copyright Network Development Group 2013.

 Important directories
Directory Purpose
/ The root of the primary filesystem hierarchy
/bin Contain essential user executables
/boot Contain the kernel and bootloader files
/dev Populated with files representing attached devices
/etc Configuration files specific to the host
/home Common location for user home directories
/lib Essential libraries to support /bin and /sbin executables
/mnt Mount point for temporarily mounting a filesystem
/opt Optional third party add-on software
/root Home directory for the root user
/sbin Contains system or administrative executables

©Copyright Network Development Group 2013.

 Important directories (cont.)
Directory Purpose
/srv May contain data provided by services of the system
/tmp Location for creating temporary files
/usr The root of the secondary filesystem hierarchy
/usr/bin Contains the majority of the user commands
/usr/include Header files for compiling C-based software
/usr/lib Shared libraries to support /usr/bin and /usr/sbin
/usr/local The root of the third filesystem hierarchy for local
software
/usr/sbin Non-vital system or administrative executables
/usr/share Location for architecturally-independent data files
/usr/share/dict Word lists

©Copyright Network Development Group 2013.

 Important directories (cont.)

Directory Purpose
/usr/share/doc Documentation for software packages
/usr/share/info Information pages for software packages
/usr/share/locale Locale information
/usr/share/man Location for man pages
/usr/share/nls Native language support files

©Copyright Network Development Group 2013.

 Types of File System in Linux
• Ext2, Ext3,Ext4
• JFS
• XFS
• BtrFS
Ext2. ext3, or third extended filesystem, is a journaled file system that is commonly used by
the Linux kernel. ... Its main advantage over ext2 is journaling, which improves reliability and
eliminates the need to check the file system after an unclean shutdown. Its successor is ext4.
Ext4 is the evolution of the most used Linux filesystem, Ext3. In many ways, Ext4 is a deeper
improvement over Ext3 than Ext3 was over Ext2. Ext3 was mostly about adding journaling to Ext2,
but Ext4 modifies important data structures of the filesystem such as the ones destined to store the
file data.
JFS. Stands for "Journaled File System." ... The initial version of JFS (also called JFS1) was
developed for IBM's AIX operating system and was released in 1990. In 2001, IBM released JFS2
(the Enhanced Journaled File System), as well as a version of JFS that is compatible with
the Linux operating system.
XFS is a 64-bit, highly scalable file system that was developed by Silicon Graphics Inc. ... The
community subsequently merged XFS into the kernel of the Linux OS, making the file system
available as an option for Linux distributions. XFS supports large files and large file systems.
Btrfs is a modern copy on write (CoW) filesystem for Linux aimed at implementing advanced
features while also focusing on fault tolerance, repair and easy administration. Jointly developed at
multiple companies, ©Copyright Network Development Group 2013.
8 Ways to Determine the File System Type in Linux

• blkid – Find Filesystem Type.

• df -(Disk Free) Command – Find Filesystem Type.
• du -(Disk Usage)
• file – Identifies Filesystem Type.
• fsck – Print Linux Filesystem Type.
• Fstab – Shows Linux Filesystem Type.
• lsblk – Shows Linux Filesystem Type.
• Mount – Show Filesystem Type in Linux.

©Copyright Network Development Group 2013.

1. The blkid program is the command-line interface to working with libblkid(3) library. It
can determine the type of content (e.g. filesystem, swap) a block device holds, and
also attributes (tokens, NAME=value pairs) from the content metadata (e.g. LABEL
or UUID fields).
2. df (abbreviation for disk free) is a standard Unix command used to display the
amount of available disk space for file systems on which the invoking user has
appropriate read access.
3. The Linux “du” (Disk Usage) is a standard Unix/Linux command, used to check the
information of disk usage of files and directories on a machine. ... The du
command also displays the files and directory sizes in a recursively manner.
4. The system utility fsck (file system consistency check) is a tool for checking the
consistency of a file system in Unix and Unix-like operating systems, such as Linux,
macOS, and FreeBSD. A similar command, CHKDSK exists in Microsoft Windows.
5. The /etc/fstab File. fstab is a system configuration file on Linux and other Unix-like
operating systems that contains information about major filesystems on the system. It
takes its name from file systems table, and it is located in the /etc directory.
6. lsblk lists information about all or the specified block devices. The lsblk command
reads the sysfs filesystem to gather information. The command prints all block
devices (except RAM disks) in a tree-like format by default.
7. About mount and umount. The mount command mounts a storage device or
filesystem, making it accessible and attaching it to an existing directory structure.
The umount command "unmounts" a mounted filesystem, informing the system to
complete any pending read or write operations, and safely detaching it
©Copyright Network Development Group 2013.
• A file system is a way of storing, organizing and accessing the files on a
computer disk (hard disk, floppy disk, CDROM, etc.) or on a partition on a
hard disk. Each type of filesystem has its own set of rules for controlling the
allocation of disk space to files and for associating data about each file
(referred to as meta data) with that file, such as its filename, the directory in
which it is located, its permissions and its creation date.
• A journaling file system is a file system that keeps track of changes not yet
committed to the file system's main part by recording the intentions of such
changes in a data structure known as a "journal", which is usually a circular
log.
• A block device is a computer data storage device that supports reading
and (optionally) writing data in fixed-size blocks, sectors, or clusters.
These blocks are generally 512 bytes or a multiple thereof in size.

©Copyright Network Development Group 2013.