I need to delete recursively all files which have the following HEX content: \xDE\xAD\xBA\xAD

Can you please suggest a terminal command which will do that?

  • Are the files in a know place or have to be search for first then deleted? – George Udosen Oct 26 '17 at 14:34

To locate these files, you can use this command:

LC_ALL=C grep -Fral $'\xDE\xAD\xBA\xAD'

Setting LC_ALL=C is a safety measure to make sure no multi-byte behavior or any other weirdness kicks in. It is probably not needed, although might speed up the operation.

grep searches for files matching a certain pattern.

-F tells it that the pattern is a simple string rather than a regular expression. It is not needed here, although would be needed if your patter contained characters that have special meaning in regular expressions.

-r tells grep to operate recursively.

-a tells it to process all files (even ones that it guesses as binary).

-l tells it to list the filenames only, not the matching line(s).

The order of these four options doesn't matter.

$'\xDE...' tells bash, your command line interpreter to place those actual bytes in the command line before starting grep. That is, grep already sees the four raw bytes instead of the \xDE... string.

If you're satisfied with a result after a dry run (highly recommended), you should add another -z option to grep so that its output is delimited by NUL characters rather than newlines, and then pipe the output to xargs:

LC_ALL=C grep ... -z ... | xargs -0 rm -i --

xargs passes all the values it sees from its standard input into parameters of the -i command.

xargs's -0 correspond's to grep's -Z: the input is expected to be NUL-separated.

rm's -i makes rm interactive, remove this if you're absolutely sure you want all such files to be removed without confirmation, you know for sure what you're doing, you do have a backup, and you've verified that I haven't made a significant mistake here that could lead to unexpectedly deleting files. :-)

rm's -- makes sure rm doesn't process any of its remaining arguments as command line parameters, just in case grep's first match would be a filename beginning with -.


Run the grep command first to see the files of interest:

grep -REl '\\xDE\\xAD\\xBA\\xAD' /path/to/file/location/

Then using rm:

rm -rf $(grep -REl '\\xDE\\xAD\\xBA\\xAD' /path/to/file/location/)


-R: used to search a location with grep

-E: grep's extended regex option

\: greps regex escape character, used to make sure \ is included in the search.

-l: grep's option to list the files where the said pattern have been found

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.