How to Find Files by Specific Group ID in Ubuntu (find -gid)

The Group Ownership Audit

When executing a security audit on an Ubuntu Linux server, tracking file ownership isn’t limited to individual users. Linux relies heavily on user groups (like www-data for web servers or docker for container management) to assign shared permissions. If a specific administrative group is deleted from the system (meaning its textual name no longer exists in the /etc/group file), any files previously owned by that group will still exist on the disk, tagged with the group’s raw numeric Group ID (GID). To locate these orphaned files or to perform a strict audit that ignores the textual group resolution layer, you must search the filesystem using the raw numeric identifier.

Using the find Command with -gid

The Linux find command utilizes the -gid flag to perform a strict numerical group ownership search.

1. Open your Terminal application (Ctrl + Alt + T) or log into your server via SSH.
2. To recursively scan the entire /var/ directory for any file owned by the exact numeric Group ID 33 (which is typically the default GID for the www-data group), type the following command exactly:
3. sudo find /var/ -type f -gid 33
4. Press Enter.

Bypassing Group Resolution

The syntax utilizes a strict integer value (33). The engine completely bypasses the system’s group resolution daemon (it does not check /etc/group). Instead, it recursively scans the target directory, reading the raw inode metadata block of every encountered file. If the 32-bit integer representing the group ownership exactly matches 33, it is returned as a positive hit. This command is an absolute necessity for system administrators executing forensic cleanups after deleting compromised or redundant security groups, ensuring that no files are left behind with orphaned, potentially abusable permissions.