Getting to know files: ls, hidden files, types
You read an evidence folder from every angle with ls options (-A, -F, -h, -S, -r, -i, -d, -t, -u), tell the seven file types apart (file, directory, link, character and block device, socket, pipe), look at the content instead of the extension with file, read the three time stamps (access, modify, change) with stat; at the end you find a program hiding behind its extension and the most recently changed log yourself. The files differ in every lab.
Level 101 · 45 min
Files copied from a server suspected of being compromised are in the /srv/evidence folder. Daniel asks you to get to know every file: "Don’t trust the name. The extension is a label; the content and properties tell you what a file really is."
On Linux everything is a file, but not every file is of the same kind: ordinary files, directories, links, devices, sockets and pipes through which programs talk to each other. The first character of an ls -l line tells the type; the figure sums up the seven types.
Every file also has an inode number: the identity number by which the file system knows the file. Even if its name changes or it moves to another folder (on the same disk), the inode stays the same.
What you will do in this lesson
- Seven types
- Hidden ones and markers: -A and -F
- By size: -lhS and -r
- Inode numbers and the folder itself: -i and -d
- Look at content, not the extension: file
- Three time stamps: stat
- Sort by time: -t, -u, full time
- The disguised program
- The most recently changed log
- Short quiz
Skills you will earn
- Telling the seven file types apart (- d l c b s p)
- Seeing hidden files with ls -a
- Seeing types by their markers (ls -F, -A)
- Sorting files by size and time (ls -lhS, -lt)
- Reading inode numbers (ls -i, stat)
- Finding a file’s real type from its content (file)
- Reading owner, group and mode with stat
- Reading the three time stamps (atime, mtime, ctime)
- Sorting files by modification time (ls -lt)
← The directory tree and moving around · Linux fundamentals · Creating, copying, moving, deleting and wildcards →
Start for free