> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/working-with-files/finding-files.md).

# Finding files

## Finding files in Linux

### locate

The `locate` command is the quickest way to find the location of files or directories in Kali. To provide a much shorter search time, `locate` searches a built-in database named **locate.db** rather than the entire hard disk itself. This database is automatically updated regularly by an automated task.

Let's use `locate` to find the path to the **whoami.exe** binary on kali.

```bash
kali@kali:~$ locate whoami.exe
/usr/share/windows-resources/binaries/whoami.exe
```

### find

The `find` program enables us to walk a file hierarchy recursively to search for files and directories. It takes many arguments and the usage can be very complex. Some of its key options are:

* **-name** - Search by filename or directory name (case sensitive).
* **-iname** - Search by filename or directory name (case insensitive).
* **-type f/d/l/s** - Search by type which can be (files, directories, links, or sockets)
* **-size** - Search by file or directory size.
* **-mtime** - Search using the last modified date criteria.
* **-o** - Allows us to combine multiple values of the same argument.
* **-user** - Find files and directories based on their owner.

Let's review a few examples of use cases for find.

To search for a file named offsec.txt in the root directory recursively, we would use:\
`find / -name offsec.txt -type f`

To search for a JPG file in the current directory recursively, we would use:\
`find . -name "*.jpg"`

To search for all .txt files owned by the kali user that are more than 1MB in size:\
`find / -user kali -size 1M -type f -name "*.txt"`

To search for all `*.doc` or `*.csv` files:\
`find / -type f ( -iname *.doc -o -iname *.csv )`

Include example of use with `-exec`

## Finding files in PowerShell

### Get-ChildItem

Search for KeePass-databases (.kdbx files) recursively from C:\ and ignore errors

```powershell
Get-ChildItem -Path C:\ -Include *.kdbx -File -Recurse -ErrorAction SilentlyContinue
```

Search for sensitive information in configuration files (\*.txt and \*.ini) of XAMPP installed in C:\xampp

```powershell
Get-ChildItem -Path C:\xampp -Include *.txt,*.ini -File -Recurse -ErrorAction SilentlyContinue
```

Search for documents and text files in the home directory of the user `dave`

```powershell
Get-ChildItem -Path C:\Users\dave\ -Include *.txt,*.pdf,*.xls,*.xlsx,*.doc,*.docx -File -Recurse -ErrorAction SilentlyContinue
```

## Finding files in Windows

### forfiles.exe

**forfiles** selects and runs a command on a file or set of files.

### tree.com

**tree** displays the directory structure of a path or of the disk in a drive graphically.

The Linux version of the command lists both directories and files as default.

```bash
┌──(kali㉿kali)-[/mnt/hgfs/Wargames/WeChall/Challenges/Training]
└─$ tree .                                                                                                                                                                   
.
├── Training-ASCII
│   ├── Challenge.txt
│   ├── flag.txt
│   ├── Solution.txt
│   └── solve.py
├── Training-Crypto-Caesar_I
│   ├── Challenge.txt
│   ├── flag.txt
│   └── Solution.txt
├── Training-Get_Sourced
│   ├── Challenge.txt
│   ├── flag.txt
│   └── Solution.txt
├── Training-Stegano_I
│   ├── Challenge.txt
│   ├── flag.txt
│   ├── Solution.txt
│   └── stegano1.bmp
└── Training-WWW-Robots
    ├── Challenge.txt
    └── Solution.txt

6 directories, 16 files

```

The Windows version lists only directories.

```batch
D:\Training\Wargames\WeChall\Challenges\Training>tree .
Folder PATH listing for volume Data
Volume serial number is 8003-72C1
D:\TRAINING\WARGAMES\WECHALL\CHALLENGES\TRAINING
├───Training-ASCII
├───Training-Crypto-Caesar_I
├───Training-Get_Sourced
├───Training-Stegano_I
└───Training-WWW-Robots
```

To also display files in the Windows version use `tree /F`.

### where.exe

**where** displays the location of files that match the given search pattern.

Search for flag files recursively in the entire C:\\

```batch
where.exe /R C:\ flag.*
```

## Resources

**find** - Linux manual page: <https://man7.org/linux/man-pages/man1/find.1.html>

**forfiles** - Microsoft Learn:\
<https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/forfiles>

**locate** - Linux manual page: <https://www.man7.org/linux/man-pages/man1/locate.1.html>

**tree** - Linux manual page: <https://linux.die.net/man/1/tree>

**tree** - Microsoft Learn: <https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/tree>

**where** - Microsoft Learn: <https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/where>