🐧Linux File System

Understand cd, ls, chmod, chown, and mount by first understanding how Linux actually organizes its files.

The Linux File System is one of the most important Linux topics to understand. Once you get how it’s organized, commands like cd, ls, find, chmod, chown, and mount stop feeling random and start making complete sense. Let's break it down from the ground up.

1. What is a File System?

A file system is the way an operating system organizes and stores files and folders on a storage device.

For example, your computer has:

Documents
Pictures
Downloads
Videos

Linux also has files and directories, but its structure is different from Windows.

The most important thing to remember is:

Linux starts its entire file system from / (root).

2. Linux File System Starts from /

In Windows, you may see:

C:\
D:\
E:\

In Linux, you normally have:

/

Everything is connected under /. Think of / as the main building:

                         /
                    ROOT DIRECTORY
                         │
       ┌─────────┬───────┼────────┬─────────┐
       ↓         ↓       ↓        ↓         ↓
     /home      /etc    /var     /usr      /tmp

3. Complete Linux File System Structure

A typical Linux system looks something like this:

/
├── bin
├── boot
├── dev
├── etc
├── home
├── lib
├── lib64
├── media
├── mnt
├── opt
├── proc
├── root
├── run
├── sbin
├── srv
├── sys
├── tmp
├── usr
└── var

⚠️ The exact structure can differ between distributions and versions. Modern distributions often merge directories such as /bin into /usr/bin.

Now let’s go through every important directory.

4. / — Root Directory

This is the top of the entire Linux file system. Everything starts here.

For example, in the path:

/home/user/file.txt

the path starts from /.

/ = The starting point of the whole file system.

5. /home — Normal Users' Files 👤

This directory contains the personal directories of normal users.

/home/kinza/
├── Desktop
├── Documents
├── Downloads
├── Music
├── Pictures
└── Videos

/home = personal area for normal users.

Run cd /home then ls, and you'll see something like user1, user2.

6. /root — Root User's Home

This one confuses beginners.

/ means the root of the entire file system. /root means the home directory of the root user.

/root
├── .bashrc
├── .config
└── files

/ = filesystem root · /root = root user's home

7. /etc — Configuration Files ⚙️

One of the most important directories. It holds most system configuration files.

/etc/hosts
/etc/passwd
/etc/group
/etc/fstab
/etc/ssh/
/etc/systemd/

• /etc/hosts → local hostname-to-IP mappings
• /etc/passwd → user account information
• /etc/group → group information
• /etc/fstab → filesystems that mount automatically

/etc = Linux settings/configuration.

8. /var — Changing Data

var means variable — this stores data that changes frequently.

/var/log
/var/cache
/var/lib
/spool

The most important one for cybersecurity is /var/log.

9. /var/log — System Logs 📝

Logs record events happening on the system: login attempts, service events, errors, authentication events. A SOC analyst works with logs constantly.

ls /var/log

On some Debian-based systems you may see auth.log and syslog. Modern systems using systemd also use:

journalctl

/var/log = important place for system/application logs.

10. /tmp — Temporary Files

tmp means temporary. Programs store temporary files here, which may be cleaned up automatically depending on system policy.

/tmp = temporary files.

11. /boot — Boot Files 🚀

Contains files needed during the boot process: the Linux kernel, initramfs, and GRUB-related files.

Computer ON
     ↓
UEFI/BIOS
     ↓
Bootloader
     ↓
Kernel
     ↓
Linux starts

12. /dev — Device Files 🔌

Linux represents many devices as special files here.

/dev/sda
/dev/nvme0n1
/dev/null

/dev = device-related files.

13. /proc — Process and System Information 🧠

/proc is a virtual filesystem — it isn't stored permanently on disk. The kernel generates it live, containing information about processes, CPU, memory, and the kernel itself.

cat /proc/cpuinfo
cat /proc/meminfo

14. /proc/PID — Information About a Process

If a process has PID 1234, you'll find details under /proc/1234, including files like /proc/1234/status. Very useful for system administration and security investigations.

15. /sys — Hardware and Kernel Information

Like /proc, /sys is a virtual filesystem, exposing hardware, device, driver, and kernel subsystem info.

/proc → processes/system information
/sys  → devices/hardware/kernel information

16. /usr — User Programs and Data

A large, important directory containing programs, libraries, documentation, and shared data.

/usr/bin
/usr/sbin
/usr/lib
/usr/share

/usr/bin

Contains many user commands (ls, cat, grep, python).

/usr/sbin

Contains system administration programs.

/usr/lib

Contains libraries used by programs.

/usr/share

Contains architecture-independent shared data — documentation, icons, man pages.

17. /bin and /sbin — Essential Commands

Historically /bin held essential commands (ls, cp, mv, cat) and /sbin held admin commands.

On many modern distributions, both are now symbolic links:

/bin  -> /usr/bin
/sbin -> /usr/sbin

This is part of a design called usr merge.

18. /lib and /lib64

Contain libraries needed by programs and, traditionally, by the system during boot. On modern systems, these may also be part of the /usr merge.

19. /opt — Optional Software

Used for additional or optional software, e.g. /opt/application.

/opt = optional/additional applications.

20. /mnt — Temporary Mount Point

/mnt

is commonly used as a location where a filesystem can be manually mounted.

Get Kinza’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

For example:

USB/partition
      ↓
    mount
      ↓
    /mnt

Example:

mount /dev/sdb1 /mnt

Now the filesystem can be accessed through:

/mnt

21. /media — Removable Devices

/media

is commonly used for removable devices such as:

• USB drives
• External storage
• CDs/DVDs

Desktop Linux systems often automatically mount removable devices somewhere under /media.

22. /run — Runtime Information

Contains temporary runtime information created after boot — PID files, sockets, service runtime data. Doesn’t survive a reboot.

23. /srv — Service Data

Intended for data served by system services (e.g. website or FTP data).

24. /lost+found

Found on ext2/ext3/ext4 filesystems — used by recovery tools to store recovered file fragments after a filesystem check.

25. The Full Linux File System Tree

/
│
├── /bin       → Essential commands
├── /boot      → Boot files
├── /dev       → Device files
├── /etc       → Configuration files
├── /home      → Normal users' files
├── /lib       → Libraries
├── /media     → Removable media
├── /mnt       → Temporary mount point
├── /opt       → Optional software
├── /proc      → Process/system information
├── /root      → Root user's home
├── /run       → Runtime information
├── /sbin      → System commands
├── /srv       → Service data
├── /sys       → Hardware/kernel information
├── /tmp       → Temporary files
├── /usr       → Programs/libraries/shared data
└── /var       → Changing data/logs

26. What is a Path?

A path tells Linux where a file or directory is located.

/home/user/Documents/file.txt

/
└── home
    └── user
        └── Documents
            └── file.txt

27. Absolute vs Relative Paths

An absolute path starts from /:

/etc/passwd

A relative path doesn’t. If you’re already in /home/user, then:

cd Documents

gets you to /home/user/Documents — that's a relative path.

28. . and ..

• . means the current directory — e.g. ./script.sh runs a script from where you are.
• .. means the parent directory — e.g. running cd .. from /home/user/Documents takes you to /home/user.

29. ~ — Home Directory

~ represents the current user's home directory. If your username is kinza, then ~ means /home/kinza. Running cd ~ takes you home instantly.

30. “Everything is a File” in Linux

You’ll often hear: “Everything in Linux is a file.” This is a useful simplification — Linux uses a file-like interface for regular files, directories, devices, pipes, and sockets. Don’t take it too literally though; some kernel objects aren’t ordinary files. The real idea is that Linux gives you one common way to interact with many different system resources.

31. Types of Files

Run ls -l and check the first character:

-  → Regular file       (e.g. -rw-r--r--)
d  → Directory          (e.g. drwxr-xr-x)
l  → Symbolic link      (e.g. lrwxrwxrwx)
c  → Character device
b  → Block device
p  → Named pipe
s  → Socket

32. File Permissions 🔐

Linux controls file access through permissions:

r = read
w = write
x = execute

applied across three categories: Owner, Group, Others.

-  rwx  r-x  r--
   │    │    │
   │    │    └── Others
   │    └─────── Group
   └──────────── Owner

33. Permission Numbers

Read    = 4
Write   = 2
Execute = 1

So rwx = 7, rw- = 6, r-x = 5, r-- = 4.

chmod 755 file.sh

means Owner = rwx, Group = r-x, Others = r-x.

34. Ownership

Every file has an owner and a group:

ls -l

-rw-r--r--  user  user  file.txt

Change ownership with:

chown

35. Inodes

An inode stores metadata about a file: type, permissions, owner, group, size, timestamps, and pointers to its data blocks. It normally does not store the filename itself.

Filename
   ↓
Directory entry
   ↓
Inode
   ↓
File data

See inode numbers with ls -i.

36. Directories

A directory is a filesystem object that organizes filenames and links them to their inode information.

Documents/
├── report.txt
├── notes.txt
└── image.jpg

37. Mounting

Linux connects a filesystem to a directory through mounting.

USB filesystem
      ↓
    mount
      ↓
    /mnt/usb

Check mounted filesystems with mount, findmnt, or df -h.

38. Partitions

A storage device can be split into partitions, each of which can hold a filesystem.

  /dev/sda1
      ↓
  ext4 filesystem
      ↓
   mounted at /

39. Filesystem Types

• ext4 — very common Linux filesystem
• XFS — common in enterprise/server environments
• Btrfs — snapshots and checksumming
• FAT32 / exFAT — removable storage and compatibility
• NTFS — Windows filesystem, also accessible on Linux with support

40. Checking Disk and Directory Size

df -h

shows filesystem disk usage (human-readable).

du -sh Downloads

shows the total size of a directory.

41. Everyday Navigation Commands

• ls — list files, ls -l for details, ls -la to include hidden files
• Hidden files start with . (e.g. .bashrc, .profile, .config)
• cd /etc, cd ~, cd .. — move around
• pwd — prints your current location (Print Working Directory)
• find /home -name "test.txt" — search for files
• grep "error" logfile.txt — search text inside files (essential for log analysis)

42. Important File System Commands — Cheat Sheet

Command Meaning pwd Show current directory ls List files ls -la List files including hidden files cd Change directory mkdir Create directory touch Create empty file cp Copy mv Move/rename rm Remove cat Display file contents less Read file page by page find Search for files grep Search text df -h Show filesystem space du -sh Show directory size mount Show/manage mounted filesystems findmnt Show mounted filesystems chmod Change permissions chown Change ownership

43. The Easy Mental Picture 🧠

Imagine Linux as a big building:

/
              Main Building
                    │
       ┌────────────┼────────────┐
       ↓            ↓            ↓
     /home         /etc         /var
    Users        Settings       Logs
       │
       ↓
   Your Files

/boot  → Starting Linux
/dev   → Devices
/etc   → Settings
/home  → User files
/proc  → Process information
/sys   → Hardware information
/tmp   → Temporary files
/usr   → Programs and shared data
/var   → Changing data and logs
/root  → Root user's home

⭐ The Most Important Directories to Memorize

If you’re learning Linux for Cybersecurity/SOC work, start with these:

/           → Top of filesystem
/home       → User files
/root       → Root user's home
/etc        → Configuration
/var/log    → Logs
/tmp        → Temporary files
/dev        → Devices
/proc       → Process/system information
/sys        → Hardware/kernel information
/usr/bin    → Programs/commands
/boot       → Boot files

One-line memory trick:

/etc = settings, /home = users, /var/log = logs, /tmp = temporary, /dev = devices, /proc = processes, /boot = boot, /usr = programs.

Wrapping Up

Once the Linux file system stops looking like a random pile of folders and starts looking like an organized building — settings in /etc, logs in /var/log, users in /home, devices in /dev — every command you run starts to make sense in context. Architecture told you how Linux works; the file system tells you how Linux organizes everything. Together, they're the real foundation for anything you do next, whether that's system administration, scripting, or cybersecurity.

If you found this useful, follow for more beginner-friendly breakdowns of Linux, cybersecurity, and systems concepts.