KL007 – Searching Files in Kali Linux

find

The find command – which is the most complex and powerful in this category – searches for files in a directory hierarchy. Its capabilities go beyond a simple file search. You can search by file age, timestamp, permissions, size, owner, and many more. Look at these:

• find / – At minimum, find gets a path to find the files. Do you remember that / means root of the FHS? So find / displays every single file on your Kali Linux machine
• find . -name file1 – Here . means current path. It will find file1 in the current path recursively.
• find . -iname FiLe1 – Not case sensitive
• find . -empty – Finds empty files 

Acting on files

• Option -ls runs ls -dils on each file.
• Option -exec runs command on found files. You can point to the file with {} and finish your command with \;
• find . -empty -exec rm '{}' \;
• find . -name "*.htm" -exec mv '{}' '{}l' \;
• The -user and -group specifies a specific user & group.
• Or even find the files not belonging to any user or group with -nouser and -nogroup
• Or even find the files not belonging to any user / group with -nouser and -nogroup 
• Add a ! just before any phrase to negate it. So, this will find files not belonging to musetrmann:  find . ! -user mustermann

locate

The locate command is faster than find to find the files and directories. If you create a new file and search it by locate command, you will not be given any result unless you apply sudo updatedb command or wait for 1 day.

┌──(kali㉿kali)-[~]
└─$ locate wget.exe
/usr/share/windows-resources/binaries/wget.exe

which

The which command returns the pathnames of the files (or links) which are defined in the $PATH environment variable.

┌──(kali㉿kali)-[~]
└─$ echo $PATH
/usr/local/sbin:/usr/sbin:/sbin:/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games:/home/kali/.dotnet/tools

┌──(kali㉿kali)-[~]
└─$ which ping
/usr/bin/ping

External and Internal Commands

• External commands are typically stored in as binaries in /bin directory. To execute an external command, shell checks $PATH variable. If command presents in the location mentioned in $PATH variable, shell executes it, otherwise it returns an error.
• Internal commands are shell built-in. Shell does not start dedicated process to run them:

┌──(kali㉿kali)-[~]
└─$ which cd
cd: shell built-in command

┌──(kali㉿kali)-[~]
└─$ which echo
echo: shell built-in command

┌──(kali㉿kali)-[~]
└─$ which pwd
pwd: shell built-in command