Every Linux system stores information within a hierarchical file system.
Unlike Windows, which uses drive letters such as:
- C:
- D:
- E:
Linux presents storage as a single unified directory structure.
Everything begins from a single location known as the root directory.
/
All files, directories, devices, processes, and mounted storage ultimately exist somewhere beneath this root.
Structure
Linux organizes data as a tree.
Example:
/
├── home
│ ├── alice
│ └── peter
│ ├── Documents
│ └── Downloads
├── etc
├── var
├── tmp
└── opt
Important characteristics:
- Every file has a path
- Every directory can contain files
- Every directory can contain additional directories
- There is only one root directory
- Storage devices become part of the directory structure through mounting (e.g. the equivalent of D:, E:, etc. on Windows)
Paths
A path identifies the location of a file or directory.
Example:
/home/peter/Documents/report.txt
This path can be read as:
| Component | Meaning |
|---|---|
| / | Root |
| home | Home directory storage |
| peter | User directory |
| Documents | Subdirectory |
| report.txt | File |
Absolute Paths
Absolute paths begin from root.
Examples:
/etc/passwd
/var/log/syslog
/home/user/file.txt
Characteristics:
- Always begin with /
- Valid regardless of current directory
- Commonly used in documentation
Relative Paths
Relative paths begin from the current directory.
Examples:
Documents/report.txt
../Downloads/file.zip
./script.sh
Special symbols:
| Symbol | Meaning |
|---|---|
| . | Current directory |
| .. | Parent directory |
| ~ | Current user's home directory |
Examples:
~/Documents
this is the equivalent of:
/home/peter/Documents
Assuming your current directory is:
/home/peter/Documents
then:
../../alice
resolves to:
/home/alice
Directories and Files
Linux makes very little distinction between file types at the file system level.
Everything is represented as an object within the directory tree.
You may hear the phrase:
"Everything is a file."
While not literally true, Linux exposes many resources through file-like interfaces, making this a useful mental model.
Examples:
| Object | Example |
|---|---|
| File | report.txt |
| Directory | Documents |
| Log | auth.log |
| Script | backup.sh |
| Configuration | sshd_config |
Naming Conventions
Linux file names are:
- Case sensitive
- Generally unrestricted
- Often descriptive
Examples:
file.txt
File.txt
FILE.txt
These are three different files.
Hidden Files
Files beginning with a period are hidden by default.
Examples:
.bashrc
.profile
.ssh
.gitconfig
Operators frequently inspect hidden files because they often contain:
- User configuration
- Credentials
- SSH keys
- Persistence mechanisms
Ownership
Every file and directory has an owner.
Example:
-rw-r--r-- 1 peter users report.txt
Ownership consists of:
| Component | Purpose |
|---|---|
| User Owner | Primary owner |
| Group Owner | Associated group |
Ownership determines who may access or modify resources.
Permissions
Linux uses a permission model based on:
- Read
- Write
- Execute
Applied to:
- Owner
- Group
- Others
Example:
-rwxr-xr-x
| Position | Meaning |
|---|---|
| rwx | Owner |
| r-x | Group |
| r-x | Others |
Permission concepts will be explored in depth later within the Privileges section.
Mounting
Linux does not use drive letters.
Instead, storage devices are mounted into the directory tree.
Example:
/mnt/usb
/media/user/USB
/home
Possible mounted resources:
- Hard drives
- SSDs
- USB devices
- Network shares
- Cloud storage
- Virtual disks
From the operating system's perspective, they become part of the same hierarchy.
Operator Perspective
When approaching an unfamiliar Linux system, Operators typically ask:
Structure
- What directories exist?
- What storage is mounted?
- Where are users located?
Files
- What files are present?
- What files were recently modified?
- What files appear unusual?
Ownership
- Who owns important files?
- Are permissions overly permissive?
Persistence
- What files execute automatically?
- What hidden files exist?
Evidence
- Where are logs stored?
- Where are configurations stored?
- Where are artifacts stored?
Understanding the file system provides the foundation for answering all of these questions.
Key Takeaways
- Linux uses a hierarchical file system.
- Everything begins from the root directory (/).
- Files are identified using paths.
- Paths may be absolute or relative.
- Files and directories have owners.
- Files and directories have permissions.
- Hidden files begin with a period (.).
- Storage devices are mounted into the directory tree.
- Understanding the file system is foundational for both offensive and defensive operations.
The next lesson explores the most important locations within a Linux system and what information can typically be found in each.