File Management in Linux: file and ls

Two of the most fundamental commands for managing and inspecting files in Linux are file and ls. This post covers their usage, common options, and practical examples.

The ls Command — List Directory Contents

ls lists files and directories. It is likely the most frequently typed command in any Linux terminal session.

Basic Usage

ls            # list files in the current directory
ls /var/log   # list files in a specific directory

Common Options

Option Description
-l Long format — shows permissions, owner, size, and modification time
-a Show all files, including hidden ones (names starting with .)
-h Human-readable sizes (e.g., 4.0K, 1.2M, 3.5G)
-R Recursively list subdirectories
-t Sort by modification time (newest first)
-S Sort by file size (largest first)
-r Reverse the sort order
-d List directories themselves, not their contents
-i Show inode number of each file
-1 One file per line (useful for scripting)

Practical Examples

List all files in long format with human-readable sizes:

ls -lah

total 28K
drwxr-xr-x  3 user user 4.0K Mar 18 10:00 .
drwxr-xr-x 12 user user 4.0K Mar 17 09:15 ..
-rw-r--r--  1 user user  220 Mar 10 08:30 .bashrc
-rw-r--r--  1 user user 3.7K Mar 18 10:00 notes.txt
drwxr-xr-x  2 user user 4.0K Mar 15 14:22 projects
-rwxr-xr-x  1 user user 8.5K Mar 16 11:45 script.sh

Understanding the long format columns:

-rw-r--r--  1  user  user  3.7K  Mar 18 10:00  notes.txt
│           │  │     │     │     │              └── filename
│           │  │     │     │     └── last modified time
│           │  │     │     └── file size
│           │  │     └── group owner
│           │  └── user owner
│           └── hard link count
└── file type & permissions (rwx = read/write/execute)

The first character indicates the file type:

Character Meaning
- Regular file
d Directory
l Symbolic link
c Character device
b Block device
p Named pipe (FIFO)
s Socket

Sort files by size (largest first):

ls -lhS

Find the most recently modified files:

ls -lt | head -10

List only directories:

ls -d */

List files with inode numbers (useful for debugging hard links):

ls -li

262146 -rw-r--r-- 2 user user 1024 Mar 18 10:00 file1.txt
262146 -rw-r--r-- 2 user user 1024 Mar 18 10:00 file2.txt

When two files share the same inode number, they are hard links pointing to the same data on disk.

Recursively list all files under a directory:

ls -R /etc/nginx/

The file Command — Determine File Type

Unlike Windows, Linux does not rely on file extensions to determine what a file is. The file command inspects the actual content (magic bytes, headers, encoding) and reports the real type.

Basic Usage

file notes.txt

notes.txt: UTF-8 Unicode text

How It Works

file performs three tests in order:

  1. Filesystem test — checks if the file is empty, a symlink, a directory, etc.
  2. Magic test — reads the first few bytes and compares them against signatures in /usr/share/misc/magic (or /usr/share/file/magic).
  3. Language test — examines the content to guess the programming language or encoding.

The first test that produces a result wins.

Common Options

Option Description
-i Output MIME type instead of human-readable description
-b Brief mode — do not prepend the filename to the output
-L Follow symbolic links
-z Try to look inside compressed files
-f <list> Read filenames to examine from a file (one per line)

Practical Examples

Identify the real type of a file regardless of its extension:

file mystery_file.txt

mystery_file.txt: PNG image data, 800 x 600, 8-bit/color RGBA, non-interlaced

Even though the extension says .txt, file detects it is actually a PNG image.

Get the MIME type (useful for scripting and HTTP Content-Type):

file -i report.pdf

report.pdf: application/pdf; charset=binary

Check multiple files at once:

file /bin/ls /etc/passwd /var/log/syslog

/bin/ls:        ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, ...
/etc/passwd:    ASCII text
/var/log/syslog: UTF-8 Unicode text, with very long lines

Inspect a binary executable:

file /usr/bin/python3

/usr/bin/python3: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked,
interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, stripped

This tells you the architecture (x86-64), linking type (dynamically linked), and whether debug symbols are present (stripped).

Look inside a compressed file:

file -z archive.gz

archive.gz: ASCII text (gzip compressed data, was "readme.txt", last modified: Mon Mar 18 10:00:00 2026, from Unix)

Brief mode (no filename prefix):

file -b /etc/hostname

ASCII text

Combining ls and file

A useful pattern is to combine both commands to get a quick overview of files and their real types:

for f in /usr/bin/head /usr/bin/python3 /etc/hosts; do
    echo "$(ls -lh "$f") --> $(file -b "$f")"
done

-rwxr-xr-x 1 root root 47K Mar 18 10:00 /usr/bin/head --> ELF 64-bit LSB pie executable, x86-64, ...
lrwxrwxrwx 1 root root   9 Mar 15 08:00 /usr/bin/python3 --> symbolic link to python3.10
-rw-r--r-- 1 root root 221 Mar 10 12:00 /etc/hosts --> ASCII text

Or use find with file to scan an entire directory tree:

find /opt/myapp -type f -exec file {} \;

Summary

Command Purpose Key Strength
ls List files and their metadata Permissions, size, timestamps at a glance
file Identify the real type of a file Content-based detection, ignores extensions

These two commands form the foundation of file inspection on Linux. Mastering their options saves time when navigating unfamiliar systems, debugging permission issues, or verifying file integrity.