Finding a file on a Mac when you forgot the name

The file was open two weeks ago. It had a chart in it, it was sent to someone, and it was definitely saved. The name is gone. Typing fragments into Spotlight returns applications and web suggestions. Typing the same fragments into a Finder window returns a different and equally useless list. Searching for how to find a file on mac at this point is not a request for keyboard shortcuts. It is a request for a different handle on the problem, because the one handle that every search box asks for is the one that is missing.

The good news is that a name is the weakest identifier a file has. macOS records a large amount of metadata about every indexed file: when it was created, when it was last opened, what kind of thing it is, which application wrote it, how large it is, and for many formats, the text inside it. Any one of those can be used as the search key. The work is knowing which tool exposes which attribute, and which of them are switched off by default.

Stop searching for the name and pick a different handle

Before opening any search field, decide what is actually remembered. There are usually three or four facts available even when the name is not.

Time is almost always the strongest handle. People rarely remember a filename but almost always remember roughly when the file was touched. Last Tuesday, some time before the trip, the week the invoice went out. A date range narrows a home folder from tens of thousands of files to a few dozen.

Kind is the second. A spreadsheet, a PDF, a screenshot, a video. Combining kind with a date range is usually enough on its own.

Application is the third, and it is the one people forget they have. Most macOS applications keep a File menu with Open Recent, and many keep more entries there than the ten that Finder shows. If the file was made in a specific editor, that menu is a shortcut past the whole search problem.

Content is the fourth. If any distinctive phrase inside the document can be recalled, a content search will find it even when nothing about the name, date, or location can be.

Location is the weakest of the five, because the reason the file is lost is usually that it was saved somewhere unexpected. Still, it is worth checking the Downloads folder sorted by Date Added, and the folder the application defaults to, before doing anything else.

What Spotlight is good for, and where it stops

Spotlight, opened with Cmd+Space, is a launcher that includes files. It ranks a single top hit, mixes applications, mail, calendar entries, contacts, definitions, conversions, and web suggestions into one list, and shows a small number of documents underneath. Apple describes the difference between it and a Finder window search directly.

If you began your search in Spotlight, the search results can include email, calendar events, information from other apps, and more. If you began your search in a Finder window, the search results include only files and folders on the internal disk. Source: support.apple.com

For a nameless file, that mixing is the problem. Spotlight has no interface for saying "modified last Tuesday, kind spreadsheet, ignore everything that is not a document". It is optimised for getting quickly to something already known, not for narrowing an unknown set.

There is one exception worth keeping. Spotlight accepts a small natural query syntax, so typing a phrase such as kind:pdf alongside a fragment does filter the result list, and quoting a phrase matches it exactly rather than matching the words in any order. That is enough for a quick guess. It is not enough for a systematic search, and the moment more than one condition is needed, the search belongs in a Finder window.

The three Finder settings that decide whether this works

Finder search is the right tool for a nameless file, and it is close to unusable until three defaults are changed. Each takes one click.

Where the search starts

By default, typing in the search field of a Finder window throws away the folder that was open and switches the scope to This Mac. In Finder Settings, on the Advanced tab, the option When performing a search can be set to Search the Current Folder. That turns Finder search into a scoped query, which is what was intended by having a folder open. The scope can still be widened with the This Mac button above the results at any time.

Name versus contents

As soon as text is typed, a dropdown offers to match the filename instead of the contents. For a file whose name is unknown, contents matching is the one that matters, and it is worth understanding what it covers. The index stores extracted text for formats that have an importer plugin, which includes plain text, rich text, PDFs with a text layer, and the common office formats. A scanned PDF with no text layer holds no searchable words at all, and neither does an image.

The criteria row

The plus button at the right of the search bar is where the search stops being a text box. It adds rows for Kind, Last modified date, Created date, and Name. Under Other there is a long list of attributes including File Size, File Visibility, System Files, and Last Opened Date. Two or three criteria stacked together are what actually finds a nameless file: kind is Document, last modified is within the last 30 days, size is greater than 1 MB.

Once a set of criteria works, save it. File, then New Smart Folder, keeps the query as a live folder in the sidebar so the same question can be asked again next month without rebuilding it. The Features page covers how a file manager can keep that kind of saved query next to the folder tree rather than buried in a menu.

Searching by time, which is what was actually remembered

Time based searches are where the metadata index earns its place, and they are worth setting up carefully because there are four different dates and they are not interchangeable.

Date Created is when the file was written to this disk, which for a downloaded or copied file is not when it was authored. Date Modified is the last time the contents changed. Date Added is when the item arrived in its current folder, which is the useful one for a Downloads folder. Date Last Opened records reading rather than writing, and it is the one that finds a document that was reviewed but never edited.

In Finder, all four are available as criteria rows, and Date Added and Date Last Opened can also be added as list view columns through View, then Show View Options. Sorting a folder by Date Added rather than by Name is often the entire search.

The same attributes are reachable from a terminal through mdfind, which queries the same index that Finder uses. A query such as mdfind -onlyin ~ 'kMDItemContentModificationDate >= $time.today(-14) && kMDItemKind == "*PDF*"' returns every PDF in the home folder touched in the last fortnight. The advantage over the Finder version is not speed. It is that the result is a list of paths that can be piped into another command, counted, or opened as a batch.

There is also the Recents item in the Finder sidebar, which is a Smart Folder covering recently used documents across the machine. It is limited and it hides some kinds, but it costs one click and it solves this problem more often than its reputation suggests.

When the file was never in the index at all

A search that returns nothing can mean the file is gone, or it can mean the index never saw it. Five exclusions cover most cases, and all five are worth checking before concluding that anything was deleted.

The Search Privacy list, in the Spotlight section of System Settings, removes folders and disks from results completely. Entries added years ago to keep something out of a screen share are still in effect.

Folders whose names end in .noindex are skipped by the indexer by design. This is occasionally inherited by copying a folder that already carried the suffix.

Files inside a zip archive or a disk image are not searchable until the archive is expanded or the image is mounted and indexed. Downloaded bundles and archived project folders both fall into this gap.

Volumes with indexing disabled produce no results and give no warning. mdutil -s /Volumes/Name reports the state for a given disk, and external drives that were ejected during an index rebuild frequently end up switched off.

Hidden items, meaning dot files and system files, are excluded from ordinary Finder results unless the File Visibility criterion is added. Cmd+Shift+Period toggles their display in a Finder window, which is the fastest way to check whether something is sitting in plain view of the shell.

Four routes, and what each one is for

Route	Finds a file by	Sees hidden and unindexed files	Best when
Spotlight	Name fragment, rough kind	No	The file is known and just needs opening
Finder search	Date, kind, size, contents, tags	Only with File Visibility added	The name is gone but the shape is remembered
mdfind	Any indexed metadata attribute	Yes, if indexed	The result needs to feed another command
find and grep	Path, name pattern, raw file contents	Yes, index not required	The index is broken or the volume is not indexed

The last row is the one that matters when everything else has failed. find walks the filesystem directly and does not consult the index, so it works on volumes that were never indexed and on folders excluded by the privacy list. find ~ -type f -newermt '14 days ago' -size +1M is slow and thorough, which is exactly the right trade when a search has already failed twice.

Where the time actually goes

The search itself is rarely the expensive part. What costs time is the sequence around it: a result appears in a Finder window, the path has to be copied with Cmd+Option+C, a terminal window has to be found or opened, the path pasted, and the command run. Then something in the output suggests a second search, and the whole switch happens again in reverse.

That is a layout problem rather than a search problem, and it is the reason a file manager with a built in terminal exists at all. A result list and a command prompt sharing one working directory removes the copy and the window switch from every iteration. The Compared with other file managers page sets that arrangement against dual pane tools and terminal file managers, which each solve a different half of it.

What to change first

Set Finder search to start in the current folder, then read the Search Privacy list once. Those two changes take five minutes and account for most searches that appear to fail for no reason. If what remains is the constant switch between a search result and the command that acts on it, that is worth solving with layout rather than with another search tool, and Atriens is built around that gap.