find, which, and locate

find starts at a path and evaluates each file. find "$HOME/cyberlium-lab" -name "*.log" matches names (quote the glob so the shell does not expand it first). -type f means regular files; -type d means directories. -mtime -1 means modified in the last 24 hours; -mtime +7 means older than a week. Combine tests: find "$HOME" -type f -name "*.txt" -mtime -1 lists recent text files you likely created yourself.

Size and permission tests matter in defense labs: -size +1M, -empty, -perm -0002 (world-writable — recognize, do not create on shared systems). Actions: default prints paths; -exec cmd {} \; runs a command per match (powerful; easy to abuse). Prefer printing first. Only -delete or -exec rm when you are sure the match set is tiny and owned by you.

find / -name "id_rsa" 2>/dev/null is a classic lab hunt for SSH keys — on a system you own or have written permission to audit. 2>/dev/null hides Permission denied from directories you cannot read; it does not bypass security. Prefer starting under $HOME or a lab folder until you have a reason and authorization to search further. On a shared school host, do not wander /home/* looking for other students' keys — that is not a lab, that is snooping.

which name prints the path of the executable the shell would run (implementation varies slightly by shell/OS). type name (bash) is often more informative: alias, function, or hashed path. command -v name is a portable cousin. Use these when you suspect PATH order tricks — a malicious ~/bin/ls before /usr/bin/ls.

PATH is a colon-separated list of directories searched for bare command names. echo "$PATH" and read left to right. Putting . (current directory) early in PATH is a classic footgun on multi-user systems. After installing tools, re-check which python3 or which ssh so you know what you invoke.

locate name searches a database built by updatedb (often daily via cron). It is fast but can be stale — newly created files may be missing until the DB refreshes. locate may also be absent on minimal installs. find is live and precise; locate is a quick index when available. Neither tool authorizes reading file contents you should not see.

Need contents? grep. Need a name under your tree? find $HOME …. Need which binary runs? which/type/command -v. Need a fuzzy system-wide name hint on a machine you own? locate, then verify with ls and find. Mixing them up wastes time: people locate a config, then forget to check it is the one the service actually reads.

Safety defaults for this course: find "$HOME/cyberlium-lab" … first; expand to "$HOME" if needed; only then consider system paths on a VM you own. Never -delete from / . Never find other users' homes on shared hosts. World-writable hunts (-perm -0002) are for recognizing risk on systems you administer — not for creating 777 traps.

When results are huge, narrow: -maxdepth 2, tighter -name, or pipe to head while exploring. Save interesting paths to a notes file under your lab directory. Reproducibility beats a blur of scrolling paths.

Create a small tree with .log and .txt files, age them if you like (touch), then run find tests. Compare which python3 / type python3. Optionally run locate on your own filename after you know the tool exists.

# YOUR VM / WSL — start finds under $HOME (cyberlium-lab)
mkdir -p "$HOME/cyberlium-lab/m05-find/logs" \
         "$HOME/cyberlium-lab/m05-find/notes"
cd "$HOME/cyberlium-lab/m05-find" || exit 1

echo 'alpha' > notes/alpha.txt
echo 'beta' > notes/beta.txt
echo 'line' > logs/app.log
echo 'old' > logs/old.log
touch -d '10 days ago' logs/old.log 2>/dev/null || touch logs/old.log

echo '--- by name ---'
find "$HOME/cyberlium-lab/m05-find" -name '*.log'

echo '--- files only ---'
find "$HOME/cyberlium-lab/m05-find" -type f

echo '--- recent txt (mtime -1 ≈ last 24h; may vary) ---'
find "$HOME/cyberlium-lab" -type f -name '*.txt' -mtime -1

echo '--- deeper but still under HOME ---'
find "$HOME" -maxdepth 3 -type d -name 'cyberlium-lab' 2>/dev/null

# Which binary will the shell run?
echo "PATH=$PATH"
command -v ssh
type ssh 2>/dev/null || true
which ssh 2>/dev/null || true

# locate (optional; DB may be stale / tool may be missing)
if command -v locate >/dev/null 2>&1; then
  locate -n 5 'm05-find' 2>/dev/null || true
else
  echo 'locate not installed — find is enough for this lesson'
fi

# Save a short inventory
find "$HOME/cyberlium-lab/m05-find" -type f | tee file-inventory.txt

# NEVER:
# find /home -name id_rsa   # on shared hosts / other users
# find / -delete
# trust a random binary earlier in PATH without checking which

You can locate files with find tests, verify binaries with which/type/command -v, understand locate's index tradeoff, and keep searches inside authorized trees — starting at $HOME. Next — Lab — Hunt Through Logs — combines pipes, grep, and disciplined evidence saving on sample data you control.