Files and Directories

Files and Directories

Linux organizes information using a hierarchical filesystem. Understanding
files and directories is essential for Linux administration, system
management and cybersecurity because security analysts frequently need to
locate configuration files, logs, application data, user files and other
system resources.

This lesson focuses on safe filesystem navigation and management inside an
authorized Linux environment.

1. What Is a File?

A file is a named collection of data stored by the operating system.
Depending on the system and filesystem, a file can contain text, program
code, images, databases, configuration information, logs or binary data.

Linux treats many resources as filesystem objects. Regular files and
directories are the most common objects students will work with.

2. What Is a Directory?

A directory is a filesystem object used to organize references to files
and other directories.

Directories allow Linux systems to arrange information into a structured
hierarchy.

For example:

/home/student/Documents
/home/student/Downloads
/home/student/Pictures

Here, Documents, Downloads and
Pictures are directories inside the student’s home directory.

3. The Root Directory

The Linux filesystem begins at the root directory:

/

The root directory is different from the root user. The root directory is
a filesystem location, while the root user is a highly privileged account.

This distinction is important for cybersecurity students.

4. Common Linux Directories

Several directories commonly appear on Linux systems.

The exact organization can vary between Linux distributions and modern
filesystem layouts.

5. Absolute Paths

An absolute path specifies a location from the filesystem root.

/home/student/Documents/report.txt

Because the path begins with /, it starts from the root of the
filesystem.

6. Relative Paths

A relative path is interpreted from the current working directory.

For example, if the current directory is:

/home/student

then:

Documents/report.txt

refers to:

/home/student/Documents/report.txt

7. The Current Directory

The pwd command displays the current working directory.

pwd

The current directory is represented by:

.

The parent directory is represented by:

..

8. Listing Files

The ls command lists directory contents.

ls

A detailed listing can be displayed with:

ls -l

Hidden files can be included with:

ls -la

The detailed listing can provide useful information about ownership,
permissions, size and timestamps.

9. Hidden Files

In Linux, a filename beginning with a period is commonly treated as
hidden by directory-listing tools.

Examples include:

.bashrc
.profile
.config

Hidden does not mean secure. A hidden file can still contain sensitive
information and should be protected appropriately.

10. Creating Directories

The mkdir command creates a directory.

mkdir cybersecurity-lab

Multiple nested directories can be created with:

mkdir -p cybersecurity-lab/logs/application

The -p option allows the required parent directories to be
created when they do not already exist.

11. Creating Files

The touch command can create an empty file when the specified
file does not already exist.

touch notes.txt

It can also update timestamps on an existing file.

12. Copying Files

The cp command copies files.

cp notes.txt notes-backup.txt

Directories can also be copied with appropriate options, but students
should be careful when copying large directory structures.

13. Moving and Renaming Files

The mv command can move a file or rename it.

mv notes.txt lesson-notes.txt

Moving a file does not necessarily mean copying its contents. The command
changes its filesystem location or name.

14. Removing Files

The rm command removes files.

rm test.txt

Students must be careful when using rm because accidental
deletion may be difficult or impossible to reverse.

Avoid experimenting with destructive recursive commands on production
systems. Use a dedicated disposable training directory instead.

15. Removing Empty Directories

The rmdir command can remove an empty directory.

rmdir old-lab

Using an empty directory during training provides an additional safety
check because the command does not remove a directory containing files.

16. Understanding File Types

Linux filesystems can contain different types of objects.

Common examples include:

• Regular files.
• Directories.
• Symbolic links.
• Device files.
• Named pipes.
• Sockets.

The first character of an ls -l listing can help identify
the object type.

17. The file Command

The file command examines a file and attempts to identify its
type.

file report.txt

This can be useful when a filename does not clearly describe the contents.

Security analysts can use file-type identification as one step when
examining suspicious or unexpected files.

18. Searching with find

The find command searches directories for files and other
filesystem objects.

For example, inside a training directory:

find ~/dwallnet-lab -type f

This searches the specified training directory for regular files.

The scope of a search should be carefully selected, especially on large
production systems.

19. The locate Concept

Some Linux systems provide locate, which searches an indexed
database of filenames.

Because the database may not always be current, its results can differ from
a real-time filesystem search.

Students should understand the difference between indexed searching and
direct filesystem searching.

20. File Size and Disk Usage

The du command can help estimate the amount of disk space
used by files and directories.

du -sh ~/dwallnet-lab

The df command displays filesystem disk-space information.

df -h

These commands are useful for troubleshooting systems that are running low
on storage.

21. File Metadata

File metadata can include:

• File size.
• Ownership.
• Permissions.
• Access timestamps.
• Modification timestamps.
• Change timestamps.
• Filesystem information.

The stat command can display detailed metadata.

stat report.txt

Metadata can be useful during authorized security investigations and
incident-response activities.

22. Symbolic Links

A symbolic link is a filesystem object that points to another path.

Conceptually:

link → target

Symbolic links are useful for providing alternate paths to files or
directories.

For example, a system may use a symbolic link to reference a current
version of an application.

Students should understand that a symbolic link can become broken if the
target is removed or moved.

23. Hard Links

A hard link provides another directory entry referring to the same
underlying file data on filesystems that support hard links.

Hard links behave differently from symbolic links and have restrictions,
such as generally not crossing filesystem boundaries.

Understanding this distinction becomes useful when investigating file
relationships and filesystem behavior.

24. Filesystem Integrity

Cybersecurity professionals often need to determine whether a file has
changed.

A cryptographic hash can provide a fingerprint of file contents.

For example:

sha256sum report.txt

If the contents change, the SHA-256 hash will normally change as well.

Hashing does not prove that a file is trustworthy. It allows a known hash
to be compared with a later hash or a trusted reference.

25. Files and Cybersecurity

Files and directories are central to security investigations.

Analysts may need to examine:

• System logs.
• Application logs.
• Configuration files.
• User home directories.
• Startup configuration.
• Temporary files.
• Application data.
• Security tool output.

The analyst must always remain within the scope of the authorized
investigation.

26. Log Files

Linux systems commonly store logs under:

/var/log

The exact files depend on the distribution and services installed.

Logs can contain information about:

• Authentication events.
• System activity.
• Application events.
• Network services.
• Errors.
• Security events.

Log access should respect organizational policies and privacy requirements.

27. Configuration Files

Linux and its applications commonly use configuration files under
directories such as:

/etc

Configuration files may contain sensitive information, including service
settings, access rules and sometimes credentials or secret material.

They should not be copied, uploaded or shared unnecessarily.

28. Temporary Files

Temporary data may appear under:

/tmp

Temporary files can be legitimate, but unexpected files may sometimes be
relevant during security investigations.

Never assume that a file is malicious solely because it appears in a
temporary directory. Context and evidence are required.

29. File Ownership

Linux files normally have an owner and group associated with them.

Use:

ls -l

to view ownership information.

Ownership works together with permissions to determine who can access or
modify a file.

Permissions will be studied in detail in the next lesson.

30. Protecting Sensitive Files

Sensitive files should be protected according to their purpose and
organizational requirements.

Good practices include:

• Use appropriate ownership.
• Apply least-privilege permissions.
• Avoid unnecessary copies.
• Protect backups.
• Do not expose configuration files through public web directories.
• Monitor sensitive file changes when appropriate.
• Use encryption where required.
• Remove temporary sensitive data securely according to policy.

31. Common File Security Problems

Examples of filesystem security problems include:

• World-writable sensitive files.
• Exposed configuration files.
• Secrets stored in source code.
• Unprotected backup files.
• Unexpected executable files.
• Unauthorized modifications.
• Insecure temporary-file handling.
• Incorrect ownership.

A security finding should be based on evidence rather than simply assuming
that an unusual filename represents an attack.

32. Safe Laboratory Exercise

Create a dedicated training directory in your own Linux virtual machine:

mkdir -p ~/dwallnet-files-lab
cd ~/dwallnet-files-lab

Create sample files and directories:

touch notes.txt
touch security.txt
mkdir documents
mkdir logs

Create sample content:

echo "Linux filesystem training" > notes.txt
echo "Cybersecurity laboratory" > security.txt

List the directory:

ls -la

Inspect a file:

file notes.txt

Display metadata:

stat notes.txt

Calculate a hash:

sha256sum notes.txt

Search the training directory:

find ~/dwallnet-files-lab -type f

Check its disk usage:

du -sh ~/dwallnet-files-lab

This laboratory should contain only disposable educational files.

33. Understanding Safe Deletion

Before deleting anything, confirm:

1. The current working directory.
2. The exact filename.
3. Whether the file is needed.
4. Whether a backup exists when appropriate.
5. Whether the operation is authorized.

A simple command such as:

pwd

can prevent mistakes by confirming where you are before performing a
filesystem operation.

34. PHP Example — Safe File Information

PHP applications can inspect basic file information. The following example
uses a fixed training filename and does not modify or execute the file.

<?php

$file = __DIR__ . '/training.txt';

if ( file_exists( $file ) ) {

    echo 'File exists.<br>';
    echo 'Size: ' . (int) filesize( $file ) . ' bytes<br>';

    echo 'Readable: ';
    echo is_readable( $file ) ? 'Yes' : 'No';

} else {

    echo 'Training file was not found.';
}

In a real application, file paths supplied by users must be handled very
carefully. Applications should prevent path traversal and unauthorized
access to files outside the intended directory.

35. Path Traversal

Path traversal is a security issue that can occur when an application
incorrectly handles user-controlled file paths.

Attackers may attempt to manipulate a requested path so that an application
accesses files outside its intended directory.

Secure applications should use controlled directories, allowlists where
appropriate, canonical path validation and strong access controls.

The key lesson is that a filename supplied by a user should never
automatically be trusted as a safe filesystem location.

36. Filesystem Investigation Scenario

Imagine that an authorized Linux server begins reporting unusually high
disk usage.

A basic investigation could include:

1. Check available disk space using df -h.
2. Identify directories consuming significant space with du.
3. Inspect relevant log directories.
4. Check whether applications are generating excessive logs.
5. Review timestamps and file ownership.
6. Compare unexpected files with known system behavior.
7. Document findings before making changes.

The investigator should avoid deleting files simply because they appear
unfamiliar. Preservation and evidence-based analysis are important.

37. Filesystem Security Mindset

When working with Linux files, ask:

• What is this file?
• Where is it located?
• Who owns it?
• Who can access it?
• When was it modified?
• Is it expected?
• What application uses it?
• Has its content changed?
• Is it sensitive?
• Am I authorized to inspect or modify it?

These questions help students develop a disciplined security-investigation
approach.

38. Practical Assignment

Inside an authorized Linux virtual machine:

1. Create a directory called dwallnet-files-lab.
2. Create three text files.
3. Create two subdirectories.
4. Copy one file into a subdirectory.
5. Rename another file.
6. Use ls -la to inspect the directory.
7. Use file to identify one file.
8. Use stat to inspect its metadata.
9. Use find to locate all regular files.
10. Use sha256sum to calculate a file hash.
11. Use du -sh to inspect directory size.
12. Explain why sensitive configuration files should not be publicly accessible.
13. Explain the difference between a symbolic link and a hard link.

39. Review Questions

1. What is the Linux root directory?
2. What is the difference between a file and a directory?
3. What is the difference between an absolute and relative path?
4. What does ls -la display?
5. What is a hidden file?
6. What does the find command do?
7. What is the purpose of stat?
8. What is the difference between a symbolic link and a hard link?
9. Why are file hashes useful during security investigations?
10. Why should students use a dedicated laboratory for filesystem experiments?
11. What is path traversal?
12. Why should unfamiliar files not automatically be treated as malicious?

40. Key Takeaways

• Linux uses a hierarchical filesystem beginning at /.
• Files and directories are fundamental Linux objects.
• Absolute paths begin from the filesystem root.
• Relative paths are interpreted from the current directory.
• ls, pwd, cd, mkdir, touch, cp and mv are important filesystem commands.
• Destructive commands must be used carefully.
• find, file and stat help inspect filesystem objects.
• Hashes can help verify file integrity.
• Logs and configuration files can contain important security information.
• Sensitive files require appropriate ownership and access controls.
• Path traversal is an important application security concern.
• Filesystem investigations should be evidence-based and authorized.

41. Conclusion

Understanding Linux files and directories is essential before moving into
permissions, users, processes and system administration.

Cybersecurity professionals regularly investigate files, logs,
configuration data, application directories and filesystem changes.
Strong filesystem fundamentals therefore provide an important foundation
for security analysis.

The next lesson will examine Permissions and how Linux
controls access to files and directories.