7.

1 Introduction
In Linux, everything is considered a file. Files are used to store data such as text, graphics,
and programs. Directories are a type of file used to store other files; Windows and Mac OS
X users typically refer to them as folders. In any case, directories are used to provide a
hierarchical organization structure. However, this structure may be somewhat different
depending on the type of system in use.
When working in a Linux operating system, it is important to know how to manipulate files
and directories. Some Linux distributions have GUI-based applications that allow you to
manage files, but it is advantageous to know how to perform these operations via the
command line.

•
•

7.2 Directory Structure

On a Windows system, the top level of the directory structure is called My Computer.
Physical devices, such as hard drives, USB drives, network drives, show up under My
Computer and are each assigned a drive letter, such as C: or D:.
The directory structures shown below are provided as examples only. These directories
may not be present within the virtual machine environment of this course.
A visual representation of a Windows directory structure:

Like Windows, the Linux directory structure, typically called a filesystem, also has a top
level. However instead of My Computer, it is called the root directory, and it is symbolized
by the slash / character. Additionally, there are no drives in Linux; each physical device is
accessible under a directory, as opposed to a drive letter.
The following image shows a visual representation of a typical Linux filesystem:

To view the contents of the root directory, use the ls command with the / character as the
argument:

sysadmin@localhost:~$ ls /
bin etc lib mnt root 'sbin'$'\342\200\214' tmp
boot home lib64 opt run srv usr
dev init media proc sbin sys var
Notice that there are many directories with descriptive names including /boot, which
contains files to boot the computer.

•
•

7.2.1 Home Directory

The term home directory often confuses new Linux users. To begin with, on most Linux
distributions there is a directory called home under the root / directory.

Under this /home directory there is a directory for each user on the system. The directory
name is the same as the name of the user, so a user named sysadmin would have a
home directory called /home/sysadmin.

The home directory is an important directory. To begin with, when a user opens a shell,
they should automatically be placed in their home directory, as typically this is where they
do most of their work.
Additionally, the home directory is one of the few directories where the user has full control
to create and delete additional files and directories. On most Linux distributions, the only
users who can access the files in a home directory are the owner and the administrator on
the system. Most other directories in a Linux filesystem are protected with file permissions.
File permissions and ownership will be covered in detail later in the course.
The home directory has a special symbol used to represent it; the tilde ~ character. So if
the sysadmin user is logged in, the tilde ~ character can be used in place of
the /home/sysadmin directory.
It is also possible to refer to another user's home directory by using the tilde ~ character
followed by the name of the user account. For example, ~bob would be the equivalent
of /home/bob.

•
•
7.2.2 Current Directory
To determine where the user is currently located within the filesystem, the pwd (print
working directory) command can be used:

pwd [OPTIONS]
sysadmin@localhost:~$ pwd
/home/sysadmin

The pwd command prints the working directory, which is the current location of the user
within the filesystem. The output of the above command indicates that the sysadmin user
is currently in their home directory, shown in the filesystem below:

•
•

7.2.3 Changing Directories

When a user opens a shell, they typically begin in their home directory. When you start a
fresh virtual machine in our course, either by opening the course or after using the reset
button, you are logged in as the sysadmin user, and you begin in the home directory for
that user, highlighted in the image below.
To navigate the filesystem, use the cd (change directory) command.

cd [options] [path]

There is a directory called Documents located in the home directory of

the sysadmin user. To move from the home directory into the Documents directory use
the directory name as an argument to the cd command:

sysadmin@localhost:~$ cd Documents
sysadmin@localhost:~/Documents$

When used with no arguments, the cd command will take the user to their home directory.

sysadmin@localhost:~/Documents$ cd
sysadmin@localhost:~$

Notice our virtual machines employ a prompt that displays the current working directory,
emphasized with the color blue. In the first prompt, the tilde ~ character is equivalent
to /home/sysadmin, representing the user's home directory.
sysadmin@localhost:~$

After changing directories, the new location ~/Documents can also be confirmed in the
new prompt, again shown in blue.

sysadmin@localhost:~$ cd Documents
sysadmin@localhost:~/Documents$

Consider This
For some commands, no news is good news; there is no output if the cd command is
successful. If the user tries to change to a directory that does not exist, the command
returns an error message:
sysadmin@localhost:~$ cd Junk
-bash: cd: Junk: No such file or directory

•
•

7.3 Paths
The argument to the cd command is more than just the name of a directory, it is actually a
path. A path is a list of directories separated by the / character. If you think of the
filesystem as a map, paths are the directory addresses, which include step-by-step
navigation directions; they can be used to indicate the location of any file within the
filesystem.
For example, /home/sysadmin is a path to the home directory:

There are two types of paths: absolute and relative.

•
•

7.3.1 Absolute Paths

Absolute paths allow the user to specify the exact location of a directory. It always starts at
the root directory, and therefore it always begins with the / character. The
path /home/sysadmin is an absolute path; it tells the system to begin at the
root / directory, move into the home directory, and then into the sysadmin directory.
If the path /home/sysadmin is used as an argument to the cd command, it moves the
user into the home directory for the sysadmin user.

sysadmin@localhost:~/Documents$ cd /home/sysadmin

Again, no output means the command succeeded. This can be confirmed by looking at the
prompt, or using the pwd command:

sysadmin@localhost:~$ pwd
/home/sysadmin

•
•

7.3.2 Relative Paths

Relative paths start from the current directory. A relative path gives directions to a file
relative to the current location in the filesystem. They do not start with the / character.
Instead, they start with the name of a directory. More specifically, relative paths start with
the name of a directory contained within the current directory.
Take another look at the first cd command example. The argument is an example of the
simplest relative path: the name of a directory within the current working directory.

sysadmin@localhost:~$ cd Documents
sysadmin@localhost:~/Documents$

If the user is located in the Documents directory, moving to the Art directory can be
accomplished in a number of ways.

The absolute path to the Art directory can be used:

sysadmin@localhost:~/Documents$ cd /home/sysadmin/Documents/School/Art
sysadmin@localhost:~/Documents/School/Art$

Multiple relative paths can be used:

sysadmin@localhost:~/Documents$ cd School
sysadmin@localhost:~/Documents/School$ cd Art
sysadmin@localhost:~/Documents/School/Art$

However, the simplest method is to use a single relative path that covers the journey from
the origin to the destination directory:

sysadmin@localhost:~/Documents$ cd School/Art
sysadmin@localhost:~/Documents/School/Art$

Use the pwd command to confirm the change:

sysadmin@localhost:~/Documents/School/Art$ pwd
/home/sysadmin/Documents/School/Art

•
•

7.3.3 Shortcuts
The .. Characters
Regardless of which directory the user is in, two period .. characters always represents
one directory higher relative to the current directory, sometimes referred to as the parent
directory. To move from the Art directory back to the School directory:

sysadmin@localhost:~/Documents/School/Art$ cd ..
sysadmin@localhost:~/Documents/School$

The double dot can also be used in longer paths as well. The following relative path could
be used to move from the School directory to the Downloads directory (both highlighted
in the image below):

sysadmin@localhost:~/Documents/School$ cd ../../Downloads
sysadmin@localhost:~/Downloads$

The . Character
Regardless of which directory the user is in, the single period . character always
represents the current directory. For the cd this shortcut is not very useful, but it comes in
handy for commands covered in subsequent sections.

•
•

7.4 Listing Files in a Directory

For the previous examples, images were provided to show the layout of the filesystem. In
practice, maps like these aren’t provided, and users must rely on what’s available in the
command line, making the ls (list) command one of the most powerful for navigating the
filesystem.

ls [OPTION]... [FILE]...

This ls command is used to display the contents of a directory and can provide detailed
information about the files. By default, when it is used with no options or arguments, it lists
the files in the current directory:
sysadmin@localhost:~$ ls
Desktop Documents Downloads Music Pictures Public Templates Vid
eos

The ls command can also be used to list the contents of any directory in the filesystem.
Provide the path to the directory as an argument:

sysadmin@localhost:~$ ls /var
backups cache lib local lock log mail opt run spool tmp

Consider This
On many Linux distributions, including the one used in our virtual machines,
the ls command uses color to distinguish by file type. For example, directories may be
displayed in blue, executable files may be displayed in green, and symbolic links may be
displayed in cyan.
⁠
Colored output is not the default behavior for the ls command, but rather the effect of the -
-color option. The ls seems to perform this coloring automatically because there is an
alias for the ls command, so it runs with the --color option.
sysadmin@localhost:~$ type ls
ls is aliased to `ls --color=auto'

To avoid using the alias, place a backslash character \ in front of your command:
sysadmin@localhost:~$ ls
Desktop Documents Downloads Music Pictures Public Templates Vid
eos
sysadmin@localhost:~$ \ls
Desktop Documents Downloads Music Pictures Public Templates Vid
eos

•
•

7.4.1 Listing Hidden Files

When the ls command is used to display the contents of a directory, not all files are shown
automatically. The ls command omits hidden files by default. A hidden file is any file (or
directory) that begins with a dot . character.

⁠
To display all files, including hidden files, use the -a option to the ls command:

sysadmin@localhost:~$ ls -a
. .bashrc .selected_editor Downloads Public
.. .cache Desktop Music Templates
.bash_logout .profile Documents Pictures Videos
Why are files hidden in the first place? Most of the hidden files are customization files,
designed to customize how Linux, your shell or programs work. For example,
the .bashrc file in the home directory customizes features of the shell, such as creating or
modifying variables and aliases.
These customization files are not ones that you work with on a regular basis, and having
them displayed makes it more difficult to find other files.

•
•

7.4.2 Long Display Listing

Each file has details associated with it called metadata. This can include information such
as the size, ownership, or timestamps. To view this information, use the -l option to
the ls command. Below, a listing of the /var/log directory is used as an example, since
it provides a variety of output:

sysadmin@localhost:~$ ls -l /var/log/
total 900
-rw-r--r-- 1 root root 15322 Dec 10 21:33 [Link]
drwxr-xr-x 1 root root 4096 Jul 19 06:52 apt
-rw-r----- 1 syslog adm 371 Dec 15 16:38 [Link]
-rw-r--r-- 1 root root 35330 May 26 2018 [Link]
-rw-rw---- 1 root utmp 0 May 26 2018 btmp
-rw-r----- 1 syslog adm 197 Dec 15 16:38 [Link]
-rw-r--r-- 1 root adm 85083 Dec 10 21:33 dmesg
-rw-r--r-- 1 root root 351960 Jul 19 06:52 [Link]
-rw-r--r-- 1 root root 32064 Dec 10 21:33 faillog
drwxr-xr-x 2 root root 4096 Jul 19 06:51 journal
-rw-rw-r-- 1 root utmp 292584 Dec 15 16:38 lastlog
-rw-r----- 1 syslog adm 14185 Dec 15 16:38 syslog
-rw------- 1 root root 64128 Dec 10 21:33 tallylog
-rw-rw-r-- 1 root utmp 384 Dec 15 16:38 wtmp

In the output above, each line displays metadata about a single file. The following
describes each of the fields of data in the output of the ls -l command:

File Type
- rw-r--r-- 1 root root 15322 Dec 10 21:33 [Link]
d rwxr-xr-x 1 root root 4096 Jul 19 06:52 apt

The first character of each line indicates the type of file. The file types are:
 Symbol File Type Description

d directory A file used to store other files.

- regular file Includes readable files, images files, binary files, and compressed
files.

l symbolic link Points to another file.

s socket Allows for communication between processes.

p pipe Allows for communication between processes.

b block file Used to communicate with hardware.

c character Used to communicate with hardware.

file

The first file [Link] is a regular file (-), while the second file apt is a
directory (d).

Permissions
d rwxr-xr-x 2 root root 4096 Jul 19 06:51 journal

The next nine characters demonstrate the permissions of the file. Permissions indicate how
certain users can access a file.
Permissions will be covered in detail later in the course.

Hard Link Count

-rw-r----- 1 syslog adm 371 Dec 15 16:38 [Link]
drwxr-xr-x 2 root root 4096 Jul 19 06:51 journal

This number indicates how many hard links point to this file.
Links will be covered in detail later in the course.
User Owner
-rw-r----- 1 syslog adm 197 Dec 15 16:38 [Link]

Every file is owned by a user account. This is important because the owner has the rights
to set permissions on a file.
File ownership will be covered in detail later in the course.

Group Owner
-rw-rw-r-- 1 root utmp 292584 Dec 15 16:38 lastlog

Indicates which group owns this file. This is important because any member of this group
has a set of permissions on the file.
File ownership will be covered in detail later in the course.

File Size
-rw-r----- 1 syslog adm 14185 Dec 15 16:38 syslog

Displays the size of the file in bytes.

For directories, this value does not describe the total size of the directory, but rather how
many bytes are reserved to keep track of the filenames in the directory. In other words,
ignore this field for directories.

Timestamp
-rw-rw---- 1 root utmp 0 May 26 2018 btmp

Indicates the time that the file's contents were last modified. For directories, this timestamp
indicates the last time a file was added or deleted from the directory.

File Name
-rw-r--r-- 1 root root 35330 May 26 2018 [Link]

The final field contains the name of the file or directory.

In the case of symbolic links, the link name is displayed along with an arrow and the
pathname of the original file.

lrwxrwxrwx. 1 root root 22 Nov 6 2018 /etc/[Link] -> ../boot/grub/

[Link]

Symbolic links will be covered in detail later in the course.

•
•
7.4.3 Human-Readable Sizes
The -l option to the ls command displays file sizes in bytes. For text files, a byte is 1
character. For smaller files, byte sizes are fine. However, for larger files, it is hard to
comprehend how large the file is. For example, consider the output of the following
command:

sysadmin@localhost:~$ ls -l /var/log/lastlog
-rw-rw-r-- 1 root utmp 292584 Dec 15 16:38 /var/log/lastlog

The file size is hard to determine in bytes. Is 292584 a large file or small? It seems fairly
large, but it is hard to determine using bytes.
Think of it this way: if someone were to give the distance between Boston and New York
using inches, that value would be meaningless. Most people think in terms of miles or
kilometers.
Sometimes it is preferable to present the file size in a more human-readable size, like
megabytes or gigabytes. To accomplish this, add the -h option to the ls command:

sysadmin@localhost:~$ ls -lh /var/log/lastlog

-rw-rw-r-- 1 root utmp 286K Dec 15 16:38 /var/log/lastlog

Important: The -h option must be used with the -l option.

•
•

7.4.4 Listing Directories

When the -d option is used, it refers to the current directory, and not the contents within it.
Without any other options, it is rather meaningless. Recall that the current directory is
always referred to with a single period . character:

sysadmin@localhost:~$ ls -d
.

To use the -d option in a meaningful way requires the addition of the -l option. In this
case, note that the following command lists the details of the contents in
the /home/sysadmin directory:

sysadmin@localhost:~$ ls -l
total 32
drwxr-xr-x 2 sysadmin sysadmin 4096 Dec 10 21:33 Desktop
drwxr-xr-x 4 sysadmin sysadmin 4096 Dec 10 21:33 Documents
drwxr-xr-x 2 sysadmin sysadmin 4096 Dec 10 21:33 Downloads
drwxr-xr-x 2 sysadmin sysadmin 4096 Dec 10 21:33 Music
drwxr-xr-x 2 sysadmin sysadmin 4096 Dec 10 21:33 Pictures
drwxr-xr-x 2 sysadmin sysadmin 4096 Dec 10 21:33 Public
drwxr-xr-x 2 sysadmin sysadmin 4096 Dec 10 21:33 Templates
drwxr-xr-x 2 sysadmin sysadmin 4096 Dec 10 21:33 Videos

In comparison, the next command lists the /home/sysadmin directory itself:

sysadmin@localhost:~$ ls -ld
drwxr-xr-x 1 sysadmin sysadmin 224 Nov 7 17:07 .

Note the single period at the end of the long listing. This indicates that the current directory
is being listed, and not the contents.

•
•

7.4.5 Recursive Listing

There are times when you want to display all of the files in a directory as well as all of the
files in all subdirectories under that directory. This is called a recursive listing.
To perform a recursive listing, use the -R option to the ls command:

sysadmin@localhost:~$ ls -R /etc/ppp
/etc/ppp:
ip-down.d ip-up.d

/etc/ppp/ip-down.d:
bind9

/etc/ppp/ip-up.d:
bind9

Note that in the previous example, the files in the /etc/ppp directory were listed first. After
that, the contents of its subdirectories /etc/ppp/ip-down.d and /etc/ppp/ip-
up.d were listed.
Be careful with this option; for example, running the command on the root directory would
list every file on the file system, including all files on any attached USB device and DVD in
the system. Limit the use of recursive listings to smaller directory structures.

•
•

7.4.6 Sort a Listing

By default, the ls command sorts files alphabetically by file name. Sometimes, it may be
useful to sort files using different criteria.
To sort files by size, we can use the -S option. Note the difference in the output of the
following two commands. The same files and directories are listed, but in a different order:
sysadmin@localhost:~$ ls /etc/ssh
moduli ssh_host_ecdsa_key.pub ssh_host_rsa_key ss
hd_config
ssh_config ssh_host_ed25519_key ssh_host_rsa_key.pub
ssh_host_ecdsa_key ssh_host_ed25519_key.pub ssh_import_id
sysadmin@localhost:~$ ls -S /etc/ssh
moduli ssh_host_ed25519_key ssh_host_ecdsa_key.pub
sshd_config ssh_host_rsa_key.pub ssh_host_ed25519_key.pub
ssh_host_rsa_key ssh_import_id
ssh_config ssh_host_ecdsa_key

Note
The option above uses a capital letter s.
While the -S option works by itself, it is most useful when used with the -l option so the file
sizes are visible. The following command lists files from largest to smallest and displays the
actual size of the file.

sysadmin@localhost:~$ ls -lS /etc/ssh

total 580
-rw-r--r-- 1 root root 553122 Feb 10 2018 moduli
-rw-r--r-- 1 root root 3264 Feb 10 2018 sshd_config
-rw------- 1 root root 1679 Jul 19 06:52 ssh_host_rsa_key
-rw-r--r-- 1 root root 1580 Feb 10 2018 ssh_config
-rw------- 1 root root 411 Jul 19 06:52 ssh_host_ed25519_key
-rw-r--r-- 1 root root 399 Jul 19 06:52 ssh_host_rsa_key.pub
-rw-r--r-- 1 root root 338 Jul 19 06:52 ssh_import_id
-rw------- 1 root root 227 Jul 19 06:52 ssh_host_ecdsa_key
-rw-r--r-- 1 root root 179 Jul 19 06:52 ssh_host_ecdsa_key.pub
-rw-r--r-- 1 root root 99 Jul 19 06:52 ssh_host_ed25519_key.pub

It may also be useful to use the -h option to display human-readable file sizes:

sysadmin@localhost:~$ ls -lSh /etc/ssh

total 580K
-rw-r--r-- 1 root root 541K Feb 10 2018 moduli
-rw-r--r-- 1 root root 3.2K Feb 10 2018 sshd_config
-rw------- 1 root root 1.7K Jul 19 06:52 ssh_host_rsa_key
-rw-r--r-- 1 root root 1.6K Feb 10 2018 ssh_config
-rw------- 1 root root 411 Jul 19 06:52 ssh_host_ed25519_key
-rw-r--r-- 1 root root 399 Jul 19 06:52 ssh_host_rsa_key.pub
-rw-r--r-- 1 root root 338 Jul 19 06:52 ssh_import_id
-rw------- 1 root root 227 Jul 19 06:52 ssh_host_ecdsa_key
-rw-r--r-- 1 root root 179 Jul 19 06:52 ssh_host_ecdsa_key.pub
-rw-r--r-- 1 root root 99 Jul 19 06:52 ssh_host_ed25519_key.pub

The -t option sorts files based on the time they were modified. It will list the most recently
modified files first. This option can be used alone, but again, is usually more helpful when
paired with the -l option:

sysadmin@localhost:~$ ls -tl /etc/ssh

total 580
-rw------- 1 root root 227 Jul 19 06:52 ssh_host_ecdsa_key
-rw-r--r-- 1 root root 179 Jul 19 06:52 ssh_host_ecdsa_key.pub
-rw------- 1 root root 411 Jul 19 06:52 ssh_host_ed25519_key
-rw-r--r-- 1 root root 99 Jul 19 06:52 ssh_host_ed25519_key.pub
-rw------- 1 root root 1679 Jul 19 06:52 ssh_host_rsa_key
-rw-r--r-- 1 root root 399 Jul 19 06:52 ssh_host_rsa_key.pub
-rw-r--r-- 1 root root 338 Jul 19 06:52 ssh_import_id
-rw-r--r-- 1 root root 553122 Feb 10 2018 moduli
-rw-r--r-- 1 root root 1580 Feb 10 2018 ssh_config
-rw-r--r-- 1 root root 3264 Feb 10 2018 sshd_config

It is important to remember that the modified date on directories represents the last time a
file was added to or removed from the directory.
If the files in a directory were modified many days or months ago, it may be harder to tell
exactly when they were modified, as only the date is provided for older files. For more
detailed modification time information you can use the --full-time option to display the
complete timestamp (including hours, minutes, seconds). It will assume the -l option
automatically:

sysadmin@localhost:~$ ls -t --full-time /etc/ssh

total 580
-rw------- 1 root root 227 2018-07-19 06:52:16.000000000 +0000 ssh_
host_ecdsa_key
-rw-r--r-- 1 root root 179 2018-07-19 06:52:16.000000000 +0000 ssh_
host_ecdsa_key.pub
-rw------- 1 root root 411 2018-07-19 06:52:16.000000000 +0000 ssh_
host_ed25519_key
-rw-r--r-- 1 root root 99 2018-07-19 06:52:16.000000000 +0000 ssh_
host_ed25519_key.pub
-rw------- 1 root root 1679 2018-07-19 06:52:16.000000000 +0000 ssh_
host_rsa_key
-rw-r--r-- 1 root root 399 2018-07-19 06:52:16.000000000 +0000 ssh_
host_rsa_key.pub
-rw-r--r-- 1 root root 338 2018-07-19 06:52:16.000000000 +0000 ssh_
import_id
-rw-r--r-- 1 root root 553122 2018-02-10 02:31:46.000000000 +0000 modu
li
-rw-r--r-- 1 root root 1580 2018-02-10 02:31:46.000000000 +0000 ssh_
config
-rw-r--r-- 1 root root 3264 2018-02-10 02:31:46.000000000 +0000 sshd
_config

It is possible to perform a reverse sort by using the -r option. It can be used alone, or
combined with either the -S or -t options. The following command will sort files by size,
smallest to largest:

sysadmin@localhost:~$ ls -lrS /etc/ssh

total 580
-rw-r--r-- 1 root root 99 Jul 19 06:52 ssh_host_ed25519_key.pub
-rw-r--r-- 1 root root 179 Jul 19 06:52 ssh_host_ecdsa_key.pub
-rw------- 1 root root 227 Jul 19 06:52 ssh_host_ecdsa_key
-rw-r--r-- 1 root root 338 Jul 19 06:52 ssh_import_id
-rw-r--r-- 1 root root 399 Jul 19 06:52 ssh_host_rsa_key.pub
-rw------- 1 root root 411 Jul 19 06:52 ssh_host_ed25519_key
-rw-r--r-- 1 root root 1580 Feb 10 2018 ssh_config
-rw------- 1 root root 1679 Jul 19 06:52 ssh_host_rsa_key
-rw-r--r-- 1 root root 3264 Feb 10 2018 sshd_config
-rw-r--r-- 1 root root 553122 Feb 10 2018 moduli

The following command will list files by modification date, oldest to newest:

sysadmin@localhost:~$ ls -lrt /etc/ssh

total 580
-rw-r--r-- 1 root root 3264 Feb 10 2018 sshd_config
-rw-r--r-- 1 root root 1580 Feb 10 2018 ssh_config
-rw-r--r-- 1 root root 553122 Feb 10 2018 moduli
-rw-r--r-- 1 root root 338 Jul 19 06:52 ssh_import_id
-rw-r--r-- 1 root root 399 Jul 19 06:52 ssh_host_rsa_key.pub
-rw------- 1 root root 1679 Jul 19 06:52 ssh_host_rsa_key
-rw-r--r-- 1 root root 99 Jul 19 06:52 ssh_host_ed25519_key.pub
-rw------- 1 root root 411 Jul 19 06:52 ssh_host_ed25519_key
-rw-r--r-- 1 root root 179 Jul 19 06:52 ssh_host_ecdsa_key.pub
-rw------- 1 root root 227 Jul 19 06:52 ssh_host_ecdsa_key

•
•