We know the merkel tree is branchs of transaction hash so that root of tree is hash that show in block header. If i want to find a specific transaction, how i can?
In order to verify if a transaction is part of a merkle tree, you have to calculate the hash of the transaction id and it's sibling, and verify that the value is correct. For example,
We’ll start with a simple 2 leaf example (see the First Bitcoin Transaction):
Lets assume that hashes
Hb have already been calculated from the data
Tb and that:
Ha = b1fea52486ce0c62bb442b530a3f0132b826c74e473d1f2c220bfa78111c5082
Hb = f4184fc596403b9d638783cf57adfe4c75c605f6356fbc91338530e9831e9e16
First, we must reverse the bytes (they need to be little endian) because that is how Bitcoin calculates the hashes. You can use this python script, if you like:
line = raw_input("Input original hex string\n")
n = 2
orig_list = [line[i:i+n] for i in range(0, len(line), n)]
reversed_list = orig_list[::-1]
reversed = ''.join(reversed_list)
Ha = 82501c1178fa0b222c1f3d474ec726b832013f0a532b44bb620cce8624a5feb1
Hb = 169e1e83e930853391bc6f35f605c6754cfead57cf8387639d3b4096c54f18f4
Then, the node (and root in this case)
Hab is calculated by concatenating the two and hashing with sha256 twice (i.e. hash256):
$ printf "82501c1178fa0b222c1f3d474ec726b832013f0a532b44bb620cce8624a5feb1169e1e83e930853391bc6f35f605c6754cfead57cf8387639d3b4096c54f18f4" | xxd -r -p | openssl sha256
$ printf "a24ee7fb7333f85c16560ed8850a1773d6977ce7a4936367eaf72f8fff33797e" | xxd -r -p | openssl sha256
Now, reverse the bytes! (back to big endian):
To search for a transaction in a merkle root, one must know the TXID of the transaction being looked for. It's not possible to search for leaves (transaction IDs) that satisfy a complex pattern [without scanning each of the transactions]. After the TXID and the TXIDs of other transactions in that block are acquired, the tree is traversed by hashing (For details, please see Why is the full Merkle path needed to verify a transaction?) The transaction is proved to be a part of the block if the final hash is equal to the merkle root.
A common misconception is that a Merkle tree is a data structure which makes finding elements in it easier. It does not. While it does have a tree structure, it is not a search tree like a B-tree or Red-Black or Patricia tree.
As far as searching for data goes, it is conceptually just a list (the leaves of the tree) with a number of associated hash values. Searching in it is exactly as hard as searching in a list is. If the list is sorted, that can be done in O(log n) time, but if the list is not sorted, you need to do an O(n) exhaustive search.
So what is a Merkle tree then useful for?
Proofs. A Merkle tree lets one party prove that a particular element is in it, to anyone who knows the tree's root hash.
So in practice the answer to "How do I find something in a Merkle tree?" is "You don't. You let someone else search for you, and have them show you a proof of what they found.".
If you want to keep a proof that your transaction was included in a particular block, you need to create and save the proof yourself. To create the proof you need to get a copy of the block and using the transaction ids in the block you compute the path from your transaction to the merkel root. The path would be an array of hash outputs along with the side one which to hash it. If a block had 1000 transaction the path to the merkel root would only have about 10 hash outputs.
The user needs to save their own proof that the transaction was included in a block. You cannot query the network for that. You can query to see if the merkel root is correct.