Executable File Searching Techniques

Following are the steps to perform executable File Search if there is no Installer Evidence or known File Evidence found:


1)    Search for a String Recursively and Redirect it to File:
•    Recursively searching for a string in all the files and redirect it to a file.

Syntax:      
              grep -ir “<pattern>” <PATH>     >      <FileName>

Options:
•    i: Ignore case
•    r: recursive search
                                                                                                              
Example:

          grep -ir "bpa\|suite\|analysis"  *  >   filelist.tmp


2)    File and strings search:
•    Search for a string in contents of the file.

         Syntax:
                      grep -i  “<pattern>”  <filename>  | grep –v “<pattern>”

         Options:
•    v: ignore these strings

         Example: 

          grep -i "bpa\|suite\|analysis" filelist.tmp | grep -v ".jar\|.html\|.doc\|.xml\|man1\|txt\|.loc"

3)    Search for Executables from desired path:
•    Lists all the executables in the particular path.

         Syntax:
find <path> -type f -perm 0755  -a ! -name “<pattern>”

         Options:
•    type     : Type of file to be searched, a file or a directory.
•    perm    : Permissions of the file
•    a           : AND Condition
•    !            : Not Operator
•    name    : Name of the File.
  
         Example:

         find . -type f -perm 0755 -a ! -name "java"  -a ! -name "*.msb" -a ! -name "*.qm" -a ! -name "*.sh" -a ! -name "*.jar"

Move large set of files from dir1/ to dir2/

find . -type f -exec mv {} ../incoming_files/ \;

Note : find . -type f | xargs mv {} ../incoming_files/ ; works but treats some files as dirs.

rename a lakh file using find and xargs

I have 1 lakh files ending with (filenames).processing.done. I want to rename all these filename .processing.done files to filenames again to restart my processing again.

simple rename command won't work on large set and says argument list too long. One way is to do with find and xargs.

find . -type f | xargs rename 's/.processing.done//' {} ;

find specific files out of lakhs of files

I need to find number of files starting with sa.277 or sa.278 or sa.295 or sa.299 out of a directory which has over 10 lakh files.How can i do that ?

ls won't work here, it will take hell lot of time.This is how we can do:

find . -type f -name "ma.*" | grep "ma.2[97][5978]" | wc -l  

find files non-recursively and move them

find the files in the OUTDIR where there are some more dirs inside that and move those files in the $NEWDIR/done/

find $OUTDIR -maxdepth 1 -type f -exec mv {} $OUTDIR/dpdone \;

count num files large in number

let us say,If we want to count number of files in a directory where there are some 40,000 plus files.. ls * | wc -l wont work here.

ls * | wc -l says..
bash: /bin/ls: Argument list too long

To do this use our find..

find . -type f | wc -l

41080

some useful find commands

The -ok action can be used instead of -exec. The -ok action means you'll be asked for confirmation before the command is executed.

There are many ways these can be used in 'real life' situations:
If you are locked out from the default Mozilla profile, this will unlock you:

$ find ~/.mozilla -name lock -exec rm {} \;

To compress .log files on an individual basis:

$ find . -name \*.log -exec bzip {} \;

Give user ken ownership of files that aren't owned by any current user:

$ find . -nouser -exec chown ken {} \;

View all .dat files that are in the current directory with vim. Don't search any subdirectories.

$ vim -R `find . -name \*.dat -maxdepth 1`

Look for directories called CVS which are at least four levels below the current directory:

$ find -mindepth 4 -type d -name CVS

If you know something has changed much more recently than that, say in the last 14 minutes, and want to know what it was there's the mmin argument:

$ find ~ -mmin 14 -name \.\*

Be aware that doing a 'ls' will affect the access time-stamps of the files shown by that action. If you do an ls to see what's in a directory and try the above to see what files were accessed in the last 14 minutes all files will be listed by find.

To locate files that have been modified since some arbitrary date use this little trick:

$ touch -d "13 may 2001 17:54:19" date_marker
$ find . -newer date_marker

To find files created before that date, use the cnewer and negation conditions:

$ find . \! -cnewer date_marker

To find a file which was modified yesterday, but less than 24 hours ago:

$ find . -daystart -atime 1 -maxdepth

The -daystart argument means the day starts at the actual beginning of the day, not 24 hours ago.
This argument has meaning for the -amin, -atime, -cmin, ctime, -mmin and -mtime options.

Multiple file search and run xargs on the output

I want to find the files named 223_meta.db and tid_223.xml in "data" directory and rename 223 with 224 :

find 223 -name *meta.db -o -name tid_* | xargs -i rename "s/223/224/g" {}; echo $i

Find directories which are last accessed and modified x many days ago

Find everything in your home directory modified in the last 24 hours :

find $HOME -mtime -1

Find everything in your home directory modified in the last seven days :

find $HOME -mtime -7

Find everything in your home directory that have NOT been modified in the last 7 days :

find $HOME -mtime +7

Find everything in your home directory that have NOT been modified in the last year :

find $HOME -mtime +365

Find everything in your home directory that have been modified exactly one year ago :

find $HOME -mtime 365

remove 1000 files at a time

Deleting 1000 files of name sri.1228457562.ram.1228456412.3.linux with different timestamps :

find . -name "sri.12284[0-9]*.ram.[0-9]*.[0-9].linux" -exec rm {} \;

Note : rm * won't work here