The Exact File Signature
In Ubuntu Linux, system administrators often need to hunt down files based on their exact physical footprint on the hard drive. If you are tracking down a known piece of malware whose binary payload is exactly 1,024 bytes, or if a database script failed and generated a specific 500-megabyte error log, searching by name or date is inefficient. The Linux search engine allows you to bypass metadata entirely and scan the raw file system for items matching a highly specific byte count.
Using the find Command with -size
The Linux find command utilizes the -size flag to isolate files based on their exact physical weight. The flag supports various units, including c (bytes), k (kilobytes), M (megabytes), and G (gigabytes).
- Open your Terminal application (Ctrl + Alt + T) or log into your server via SSH.
- To scan the entire
/var/www/directory and return files that are exactly 50 Megabytes in size, type the following command exactly: find /var/www/ -type f -size 50M- Press Enter.
The Absolute Value
The integer provided to the -size flag is absolute. Because you omitted the mathematical modifiers (such as +50M for larger than, or -50M for smaller than), the search engine will exclusively hunt for files whose physical size equals exactly 50 megabytes. If a file is 49.9 megabytes or 50.1 megabytes, it will be completely ignored, allowing you to establish a highly surgical filter for identifying specific data payloads.