How to Find Files by Group and Copy Them in Ubuntu (find -exec cp)

The Group Extraction Protocol

When auditing an Ubuntu Linux server during a security investigation or a backup operation, you may need to physically isolate every single file belonging to a specific user group (such as www-data or finance). Simply listing the files is insufficient if you need to perform forensic analysis on them in an isolated sandbox. You must instruct the search engine to mathematically identify the files based on their group ownership and immediately execute a copy operation to duplicate them into a secure quarantine directory.

Using the find Command with -group and -exec

The Linux find command allows you to chain the -group filter directly to the -exec action flag to run a standard copy command (cp) against the matched files.

1. Open your Terminal application (Ctrl + Alt + T) or log into your server via SSH.
2. To scan the /home/shared/ directory for all files belonging to the accounting group and instantly copy them into a secure folder located at /root/audit_backup/, type the following command exactly:
3. sudo find /home/shared/ -type f -group accounting -exec cp {} /root/audit_backup/ \;
4. Press Enter.

Execution Payload Syntax

The -exec payload utilizes a strict sequence. The engine first identifies a file matching the group criteria. It then triggers the cp command. The curly braces {} act as a dynamic variable; the find command automatically injects the absolute path of the matched file into those braces as the source file. The destination directory (/root/audit_backup/) follows. Finally, the escaped semicolon \; terminates the execution string. This compound structure is an absolute necessity for system administrators executing rapid, targeted data extraction across complex directory trees.