How to Find Which Package Owns a File or Binary in Ubuntu Using dpkg -S

When administering Ubuntu servers or troubleshooting desktop software installations, system administrators frequently encounter mystery configuration files, stray shared libraries, or utility executables located across system directories such as /etc, /usr/bin, or /usr/lib. Identifying which installed software package originally placed a given file on your filesystem is critical before modifying, replacing, or deleting it. Conversely, if a system command is missing and you need to determine which package to install, you require a method to search remote repositories by filename. In Ubuntu and Debian-based systems, the native package manager tools dpkg -S and apt-file resolve these queries with absolute precision.

Using dpkg -S to Identify Installed Package Ownership

The native Debian package management tool, dpkg, maintains an internal ledger of every file and directory deployed by installed .deb packages in the database directory /var/lib/dpkg/info/. The -S (or --search) option interrogates this catalog to report which package owns a specific path.

Basic Syntax and Exact File Lookups

To determine which installed package owns an executable or configuration file, pass the absolute path of the target file to dpkg -S:

dpkg -S /usr/bin/curl

The terminal returns the owning package name followed by a colon and the verified path:

curl: /usr/bin/curl

You can combine dpkg -S with the which command to check the package source of any active terminal command without having to manually find its directory path first:

dpkg -S $(which tar)

This outputs: tar: /bin/tar (or /usr/bin/tar on systems with merged-usr architecture).

Understanding Wildcards and Pattern Matching in dpkg -S

If you do not know the absolute path of a file, you can search for a bare filename or partial string pattern. For example, to locate any installed package that provides a file containing nginx.conf:

dpkg -S nginx.conf

When supplied with a partial string, dpkg -S searches across the entire path of all recorded files. It may return multiple matches if several documentation packages, examples, or modules reference that string:

nginx-common: /etc/nginx/nginx.conf
nginx-common: /usr/share/doc/nginx-common/examples/nginx.conf

To avoid false positives from matching substrings inside unrelated folder names, specify the filename preceded by an asterisk and slash:

dpkg -S "*/htop"

Searching for Files from Uninstalled Packages Using apt-file

While dpkg -S is exceptionally fast and requires no internet access, it operates exclusively on packages that are currently installed on your local machine. If you attempt to execute a command that is not installed, or if a build script fails with a missing C header file (e.g. fatal error: openssl/ssl.h: No such file or directory), dpkg -S will return a “no path found matching pattern” error.

To discover which remote package in Ubuntu’s official repositories provides an uninstalled file, use apt-file.

Installing and Initialising apt-file

The apt-file utility is available directly from the default Ubuntu repositories:

sudo apt update
sudo apt install apt-file

Once installed, download the package contents index from the Ubuntu archive mirrors:

sudo apt-file update

Searching Remote Package Contents

To find which package provides a specific missing header or library, run:

apt-file search openssl/ssl.h

The output lists all packages providing matching files:

libssl-dev: /usr/include/openssl/ssl.h

This diagnostic confirms that installing libssl-dev via sudo apt install libssl-dev will resolve the missing header error and satisfy the build dependency.

Verifying Package File Integrity with dpkg -V

Once you have identified the package that owns a file, you may wish to verify whether the file has been altered, corrupted, or replaced since installation. The dpkg -V (or --verify) command inspects MD5 checksums, file sizes, and permission flags against the package manifest:

dpkg -V curl

If all installed files match their original package state, the command returns zero output silently. If a binary or configuration file was modified, dpkg displays status flags (e.g. 5 indicating an MD5 checksum mismatch, or S indicating a modified file size), providing immediate visibility into potential configuration drift or system tampering.