Forensicslocatefile-searchindexingdatabase

plocate

plocate is a much faster locate utility based on posting lists, providing quick file name searches on a smaller index. It serves as a drop-in replacement for mlocate and performs efficiently on both SSDs and non-SSDs.

Description

plocate enables rapid searching for files by name using a highly optimized index generated from posting lists. It is designed as a drop-in replacement for mlocate, maintaining compatibility in nearly all aspects while delivering significantly faster search performance. The tool is particularly effective for large filesystems, making it ideal for forensics, system administration, and quick file location tasks in Kali Linux environments.

Key components include plocate for searching, plocate-build for generating the index from mlocate databases or plaintext files, and updatedb.plocate for maintaining the database. These utilities support customization through various flags, allowing users to tailor searches and index builds to specific needs, such as case-insensitive matching or limiting output.

Use cases include quickly locating files during incident response, auditing systems, or navigating complex directory structures. The default database is /var/lib/plocate/plocate.db, with configuration options drawn from /etc/updatedb.conf.

How It Works

plocate uses posting lists to create a compact index that enables much faster searches compared to traditional locate implementations like mlocate. The index is generated by plocate-build from an mlocate.db or plaintext input, storing filenames in blocks (default 32 per block) for efficient querying. updatedb.plocate refreshes the database by scanning specified subtrees, applying prune rules from configuration, and outputting to the plocate.db format. Searches match patterns against basename or full paths, with options for case-insensitivity, limits, and output formatting.

Installation

bash
sudo apt install plocate

Flags

-b, --basenamesearch only the file name portion of path names
-c, --countprint number of matches instead of the matches
-d, --database DBPATHsearch for files in DBPATH (default is /var/lib/plocate/plocate.db)
-i, --ignore-casesearch case-insensitively
-l, --limit LIMITstop after LIMIT matches
-0, --nulldelimit matches by NUL instead of newline
-N, --literaldo not quote filenames, even if printing to a tty
-b, --block-size SIZEnumber of filenames to store in each block (default 32)
-p, --plaintextinput is a plaintext file, not an mlocate database
-f, --add-prunefs FSomit also FS (space-separated)
-o, --output FILEdatabase to update (default `/var/lib/plocate/plocate.db')

Examples

Display help and usage information for plocate
plocate -h
Show help for plocate-build, which generates plocate index from mlocate.db
plocate-build -h
Generate plocate index from specified mlocate.db to plocate.db (typically /var/lib/mlocate/mlocate.db to /var/lib/plocate/plocate.db)
plocate-build MLOCATE_DB PLOCATE_DB
Display help for updatedb.plocate, which updates a plocate database
updatedb.plocate -h
Update the plocate database using defaults from /etc/updatedb.conf (output to /var/lib/plocate/plocate.db)
updatedb.plocate
Search for files matching the given PATTERN using the default database
plocate PATTERN
Perform a case-insensitive search for files matching PATTERN
plocate -i PATTERN
Updated 2026-04-16kali.org ↗