How to find files with 100% NUL characters in their contents?

Question

What is the Linux command-line command that can identify such files?

AFAIK the find command (or grep) can only match a specific string inside the text file. But I want to match whole contents, i.e. I want to see which files match regular expression \0+, ignoring the line end character(s). Maybe the find . cat | grep idiom could work, but I don't know how to make grep ignoring lines (and treat the file as binary).

Background: Every few days, when my laptop freezes, my btrfs partition looses information: files opened for write gets their contents replaced with zeroes (the size of the file remains more-or-less intact). I use synchronization and I don't want these fake files to propagate: I need a way to identify them so I can grab them from backup.

Answer 1

You can grep for ␀ characters using the Perl regex mode:

$ echo -ne "\0\0" > nul.bin
$ echo -ne "\0x\0" > non-nul.bin
$ grep -P "[^\0]" *.bin
Binary file non-nul.bin matches

So you can use this:

for path in *.foo
do
    grep -P "[^\0]" "$path" || echo "$path"
done

Answer 2

I agree with what D_Bye says about finding the root of the problem.

Anyway to check if a file only contains \0 and/or \n you could use tr:

<file tr -d '\0\n' | wc -c

Which returns 0 for null/newline and empty files.

Answer 3

I suspect those files are sparse, that is they don't have any disk space allocated to them, they just specify a file size (du would report 0 for them).

In which case, with GNU find, you could do (assuming no file path contains newline characters):

find . -type f -size +0 -printf '%b:%p\n' | grep '^0:' | cut -d: -f2-

Answer 4

Here's a small python program that can do it:

import sys

def only_contains_nulls(fobj, chunk_size=1024):
    first = True
    while True:
        data = fobj.read(chunk_size)
        if not data:
            if first:
                return 1  # No data
            else:
                return 0
        if data.strip("\0"):
            return 1
        first = False

if __name__ == '__main__':
    with open(sys.argv[1]) as f:
        sys.exit(only_contains_nulls(f))

And in action:

$ printf '\0\0\0' > file
$ ./onlynulls file && echo "Only nulls" || echo "Non-null characters"
Only nulls
$ printf a >> file
$ ./onlynulls file && echo "Only nulls" || echo "Non-null characters"
Non-null characters

You can check multiple files by using find's -exec, xargs, GNU parallel, and similar programs. Alternatively, this will print filenames that need to be dealt with:

files=( file1 file2 )
for file in "${files[@]}"; do
    ./onlynulls "$file" || printf '%s\n' "$file"
done

Bear in mind that if you're going to pass the output of this to another program, filenames can contain newlines, so you should delimit it differently (fittingly, with \0).

If you have a lot of files, it would be better to use an option for parallel processing, since this only reads one file at a time.

Answer 5

Find files which contain only null-chars '\0' and newline chars '\n'.
The q in sed causes each file search to quit immediately upon finding any non-null character in a line.

find -type f -name 'file-*' |
  while IFS= read -r file ;do 
      out=$(sed -n '1=; /^\x00\+$/d; i non-null
                      ; q' "$file")
      [[ $out == "1" ]] &&  echo "$file"
  done

Make test files

> file-empty
printf '%s\n' 'line1' 'line2' 'line3'      > file-with-text           
printf '%4s\n' '' '' xx | sed 's/ /\x00/g' > file-with-text-and-nulls
printf '%4s\n' '' '' '' | sed 's/ /\x00/g' > file-with-nulls-and-newlines
printf '%4s'   '' '' '' | sed 's/ /\x00/g' > file-with-nulls-only

output

./file-with-nulls-and-newlines
./file-with-nulls-only

Answer 6

This one-liner is the most efficient way to find 100% nul files using GNU find, xargs, and grep (assuming the latter is built with PCRE support):

find . -type f -size +0 -readable -print0 |
  LC_ALL=C xargs -r0 grep -LP "[^\x00]" --

The advantages of this method over other provided answers are:

• non-sparse files are included in the search.
• non-readable files aren't passed to grep, avoiding Permission denied warnings.
• grep will stop reading data from files after finding any non-nul byte (LC_ALL=C is used to make sure each byte is interpreted as a character).
• empty files (zero bytes) are not included in the results.
• fewer grep processes efficiently check multiple files.
• paths containing newlines or starting with - are handled correctly.
• works on most embedded systems that lack Python/Perl.

Passing the -Z option to grep and using xargs -r0 ... allows further actions to be performed on the 100% nul files (eg: cleanup):

find . -type f -size +0 -readable -print0 |
  LC_ALL=C xargs -0 grep -ZLP "[^\x00]" -- |
  xargs -r0 rm --

I also recommend using the find options -P to avoid following symlinks, and -xdev to avoid traversing filesystems (eg: remote mounts, device trees, bind mounts, etc).

For ignoring the line end character(s), the following variant should work (though I don't think this is such a good idea):

find . -type f -size +0 -readable -print0 |
  LC_ALL=C xargs -r0 grep -LP "[^\x00\r\n]" --

Putting it all together, including removing the unwanted files (100% nul / newline characters) to prevent them from being backed up:

find -P . -xdev -type f -size +0 -readable -print0 |
  LC_ALL=C xargs -0 grep -ZLP "[^\x00\r\n]" -- |
  xargs -0 rm --

I don't recommend including empty files (zero bytes), they often exist for very specific purposes.

Answer 7

Here's a mix and abbreviation of the answers of @Tyson and @l0b0:

# --text: do not skip non-text files
grep --recursive --files-without-match -P '[^\0]'

If you want a minimum file size of one byte:

# -size +0c: more than zero bytes
find -type f -size +0 -exec grep --text --files-without-match -P '[^\0]' {} +

Answer 8

For using GNU sed you can use the -z option, which defines a line as zero-terminated strings and match for and delete empty lines like so:

if [ "$( sed -z '/^$/d' "$file" | head -c 1 | wc -c )" -eq 0 ]; then
    echo "$file contains only NULL!"
fi

The head command inbetween is just an optimization.

Answer 9

Python

Single file

Define the alias:

alias is_binary="python -c 'import sys; sys.exit(not b\"\x00\" in open(sys.argv[1], \"rb\").read())'"

Test it:

$ is_binary /etc/hosts; echo $?
1
$ is_binary `which which`; echo $?
0

Multiple files

Find all binary files recursively:

IS_BINARY='import sys; sys.exit(not b"\x00" in open(sys.argv[1], "rb").read())'
find . -type f -exec bash -c "python -c '$IS_BINARY' {} && echo {}" \;

To find all non-binary files, change && with ||.