Navigating the Linux Filesystem

Linux FoundationsLesson 2 of 745 minutesLab included

Learning objectives

By the end of this lesson

• Explain the difference between the filesystem root and your home directory.
• Distinguish absolute paths from relative paths.
• Use pwd, ls, cd, file, and stat to orient yourself.
• Explain the immediate roles of /home, /etc, /tmp, /proc, and /var.
• Handle hidden files, spaces, and parent directories without guessing what a path means.

The question behind every shell command

Open the Terminal application inside your course VM.

The terminal gives us a text-based way to interact with Linux. The program reading the commands you type is called a shell. We will eventually use the shell to inspect programs, process logs, search through files, and connect tools together. For now, we need to answer a more basic question:

Where am I, and what is around me?

That question sounds almost insultingly simple. It is also the source of an impressive number of mistakes. A command that operates on notes.txt needs to know which notes.txt you mean. A program that writes output needs somewhere to put it. A researcher who cannot identify the current directory will eventually inspect the wrong file and develop a very confident explanation of something that never happened.

Your location is part of every shell command, even when the location is not written in the command.

The filesystem is a tree

Linux organizes files and directories into a tree. A directory is a container that can hold files and other directories. Other operating systems often call one a folder; the terms refer to the same basic idea.

At the top of the tree is the root directory, written as a single forward slash:

/

Everything else is located somewhere beneath it.

This root directory is not the same thing as the root user account, and it is not your home directory. Linux reused a word in several related places because apparently one source of beginner confusion was insufficient.

Your home directory is the part of the filesystem intended for your files and settings. If your username is student, it will normally be:

/home/student

The shell also uses a tilde as shorthand for your home directory:

~

Key concept

Root is the top; home is your workspace

The root directory / contains the entire filesystem tree. Your home directory is one branch within that tree. The shorthand ~ means the home directory of the current user.

Find your current location with pwd

The shell keeps track of a current working directory. This is the directory from which relative paths are interpreted.

Run:

pwd

pwd stands for print working directory. If your username is student, the output will probably resemble:

/home/student

The shell prompt may already display part of this location. Do not rely on that. Prompt designs vary, shorten long paths, and sometimes omit the location entirely. pwd asks the shell directly.

Checkpoint

Read the evidence

Run pwd and record the exact output. Which part is the filesystem root? Which part identifies your user?

List what is around you

Run:

ls

ls lists directory contents. On Ubuntu Desktop, you may see names such as:

Desktop  Documents  Downloads  Music  Pictures  Public  Templates  Videos

Your output may differ. That is fine. These are entries in your home directory, not a sacred list Linux is required to preserve.

Now add two options:

ls -la

An option changes how a command behaves. Options are commonly introduced with a hyphen.

• -l requests the long format, including permissions, ownership, size, and timestamps.
• -a includes entries whose names begin with a period.

Names beginning with a period are normally called hidden files. They are not encrypted or specially protected. Ordinary directory listings omit them to reduce clutter. Configuration files such as .bashrc often use this convention.

The first two entries in an ls -la listing are usually:

.
..

A single period means the current directory. Two periods mean its parent directory: the directory one level above it.

Move between directories with cd

cd stands for change directory. Run:

cd Documents
pwd

If Documents exists in your home directory, pwd should now end with:

/home/student/Documents

Return to the parent directory:

cd ..
pwd

You should be back in your home directory.

You can return home from anywhere by running cd with no argument:

cd
pwd

You can also write cd ~. The shorter form is convenient; the explicit form makes the destination easier to see while learning.

Safety note

Linux paths are case-sensitive

Documents, documents, and DOCUMENTS are three different names. If cd documents reports “No such file or directory,” check capitalization before assuming the directory is missing.

Knowledge check

Question 1 of 2

Which command directly reports your current working directory?

pwdlscd

Check answer

Absolute and relative paths

An absolute path describes a location from the root directory. It begins with /:

/home/student/Documents/notes.txt

A relative path describes a location from the current working directory:

Documents/notes.txt

If your current directory is /home/student, those paths identify the same file. If you move to /tmp, the relative path points to /tmp/Documents/notes.txt instead.

That is why relative paths are convenient and dangerous in equal measure. They are short, but their meaning depends on where you stand.

We can demonstrate this without changing any files:

cd
realpath Documents
cd /tmp
realpath Documents

The first command should resolve to the Documents directory in your home. The second may report that /tmp/Documents does not exist. The text Documents stayed the same; its starting location changed.

Checkpoint

Predict before running

Suppose your current directory is /home/student/projects/demo. What absolute path does ../notes.txt identify?

The two periods move from demo to its parent, projects, before adding notes.txt. The answer is /home/student/projects/notes.txt.

Build a disposable practice tree

Let’s create a small directory tree in your home directory. These are your files, created for this exercise, so changing them is safe.

cd
mkdir -p underdunn-course/navigation/evidence
cd underdunn-course/navigation
pwd

mkdir creates a directory. The -p option also creates missing parent directories, so the entire path can be built in one command.

Your working directory should now end with:

/underdunn-course/navigation

Create three empty practice files:

touch notes.txt "strange name.txt" .hidden-note
ls
ls -la

touch creates an empty file when that name does not already exist. Compare the two listings:

• ls should show notes.txt and strange name.txt.
• ls -la should also show .hidden-note.

The quotation marks around "strange name.txt" tell the shell to treat the space as part of one name. Without the quotes, the shell sees two separate arguments: strange and name.txt.

You can also escape a space with a backslash:

ls strange\ name.txt

Quoting the entire path is usually easier to read:

ls "strange name.txt"

Inspect a name before trusting it

Filenames are labels chosen by people and programs. A file named photo.jpg is not required to contain a JPEG image. Attackers, challenge authors, and confused coworkers are all capable of naming files badly.

Run:

file notes.txt
file /etc/os-release

file examines identifying patterns in the contents. The empty practice file may be reported as:

notes.txt: empty

/etc/os-release should be identified as text. This does not tell us everything in the file, but it is better evidence than the filename alone.

Now inspect metadata:

stat notes.txt

stat reports information maintained by the filesystem, including size, timestamps, ownership, and permissions. Your exact values will differ, but the size should be zero because touch created an empty file.

Key concept

file asks what it resembles; stat asks how it is stored

file examines content and reports a likely type. stat reports filesystem metadata. Researchers commonly use both because they answer different questions.

Knowledge check

Question 1 of 2

What makes /home/student/notes.txt an absolute path?

It contains a usernameIt begins at the filesystem rootIt points to a text file

Check answer

Five directories worth recognizing

You do not need to memorize the entire Linux filesystem today. You should recognize these locations when they appear:

Directory	What belongs there
/home	Home directories for ordinary users
/etc	System-wide configuration
/tmp	Temporary files; contents may disappear
/var	Data that changes while the system runs, including many logs
/proc	A virtual view of processes and kernel information

/proc is the unusual one. Many entries look like files but are generated by the kernel when read. They are an interface to current system state rather than ordinary data stored on disk.

Try:

file /proc/cpuinfo
stat /proc/cpuinfo

The results may look odd compared with a normal file. That oddness is evidence that /proc behaves differently, not evidence that the commands failed.

Inspect before acting

You now know enough commands to build a useful habit:

pwd
ls -la
file target
stat target

This is not a ritual that must be typed before every command. It is a short investigation sequence:

1. Confirm your current location.
2. List everything present, including hidden entries.
3. Ask what the target’s contents resemble.
4. Inspect its metadata.

We have deliberately not introduced commands for deleting or moving files yet. Guessing with destructive commands is an unnecessary way to discover that a relative path did not mean what you thought it meant.

Checkpoint

A short navigation exercise

Starting from anywhere:

1. Return to your home directory.
2. Enter underdunn-course/navigation/evidence.
3. Use pwd to confirm the exact location.
4. List the contents of the parent directory without leaving evidence.
5. Inspect the type and metadata of ../notes.txt.

You should be able to complete the exercise with cd, pwd, ls, file, and stat.

What this gives us as researchers

You can now orient yourself in an unfamiliar part of a Linux system without relying on the graphical file browser or trusting filenames. More importantly, you can explain what each command contributes:

• pwd establishes location.
• ls identifies nearby entries.
• cd changes the location from which relative paths are interpreted.
• file provides evidence about contents.
• stat provides evidence about filesystem metadata.

That is already a small research process: establish context, gather observations, and avoid making changes until the target makes sense.

Knowledge check

Question 1 of 3

Your current directory is /home/student/projects/demo. What does ../notes.txt refer to?

/home/student/projects/notes.txt/home/student/notes.txt/notes.txt

Check answer

Next, the Filesystem Investigation Lab will ask you to use these commands on a directory tree you did not create.