3.1.1. File Operations and Navigation
💡 First Principle: File operations in Linux are non-destructive by default — mv within the same filesystem is instant (it renames the directory entry, no data moves). mv across filesystems copies then deletes. cp always creates new data. rm removes the directory entry but the data persists until the blocks are reused.
# Navigation
pwd # Print working directory
cd /etc/nginx # Change to absolute path
cd .. # Go up one level
cd - # Return to previous directory
ls -la # Long format, show hidden files
ls -lh # Long format, human-readable sizes
ls -lS # Sort by file size (largest first)
ls -lt # Sort by modification time (newest first)
# Creating and removing
mkdir /data/project # Create directory
mkdir -p /data/a/b/c # Create with all parents (-p = no error if exists)
rmdir /data/empty # Remove empty directory only
rm file.txt # Remove file (no trash — gone immediately)
rm -r /data/project # Remove directory and contents recursively
rm -rf /tmp/cache # Force removal, no prompts (dangerous)
touch file.txt # Create empty file or update timestamps
touch -t 202401011200 file.txt # Set specific timestamp
# Copying and moving
cp file.txt /backup/ # Copy file to directory
cp -r /source/ /dest/ # Copy directory recursively
cp -p file.txt /backup/ # Preserve permissions, timestamps, owner
cp -a /source/ /dest/ # Archive copy (same as -dR --preserve=all)
mv file.txt /newlocation/ # Move or rename file
mv old_name.txt new_name.txt # Rename in place
# Inspection
file report.pdf # Identify file type by magic bytes (not extension)
stat file.txt # Full metadata: inode, permissions, times, blocks
diff file1.txt file2.txt # Line-by-line comparison
sdiff file1.txt file2.txt # Side-by-side diff
ls -la /proc/1234/ # Inspect open files for a process via /proc
Finding Files:
find /etc -name "*.conf" # By name (glob)
find /var/log -name "*.log" -mtime +30 # Modified more than 30 days ago
find /home -user alice # Owned by user alice
find /tmp -type f -size +10M # Regular files larger than 10 MB
find / -perm /4000 2>/dev/null # Files with setuid bit set
find /var -type f -newer /etc/passwd # Files newer than /etc/passwd
locate nginx.conf # Fast filesystem index search
updatedb # Rebuild locate database
lsof -p 1234 # Files open by process 1234
lsof /dev/sda1 # Processes using a device or file
lsof -i :80 # Processes listening on port 80
⚠️ Exam Trap: rm -rf has no undo. But there is a subtlety: deleting a file that is open by a running process does NOT immediately free disk space — the kernel keeps the inode alive until all file descriptors pointing to it are closed. lsof | grep deleted reveals these "deleted but still open" files that are consuming space. This is why df can show a disk full even after deleting large files.
Reflection Question: After deleting a 10 GB log file, df -h still shows the same usage. The disk appears full. What is the most likely explanation and how would you confirm it?
