Day 3 - Navigating the Filesystem and FHS

This lesson explains how Linux arranges files and directories and how to move with speed and safety. It covers absolute and relative paths, the Filesystem Hierarchy Standard, common directories, symlinks, mounts, and tools to check disk usage.

Prerequisites

• Day 1 and Day 2 completed
• A terminal with Bash
• A user account with sudo

Absolute paths and relative paths

• Absolute path: starts at / and names every directory down to the target. Example: /etc/ssh/sshd_config.
• Relative path: starts from the current working directory. Example: if the current directory is /etc, then ssh/sshd_config refers to /etc/ssh/sshd_config.

Useful commands:

1
2
3
4
5
6

pwd                        # print current working directory
cd /etc                    # go to an absolute path
cd ssh                     # relative path from /etc to /etc/ssh
cd -                       # go back to the previous directory
cd ~                       # go to the home directory
cd ~/projects              # absolute path with tilde expansion

Quick navigation cheatsheet

1
2
3
4
5
6
7
8
9

ls -la                     # long view, show hidden files (names starting with .)
ls -lah                    # add human readable sizes
ls -ld */                  # list only subdirectories

# jump to important places
cd /                       # filesystem root
cd /etc                    # system configuration
cd /var/log                # logs
cd /home/$USER             # home directory

Hidden files and directories begin with a dot. Use ls -A to include them.

Filesystem Hierarchy tour

The most common top level directories and what they contain:

• / root of the filesystem
• /bin, /sbin, /usr/bin, /usr/sbin command binaries and system tools. Many modern systems place most tools under /usr and provide compatibility links.
• /lib, /lib64, /usr/lib shared libraries for programs
• /etc system configuration files in plain text
• /var variable data such as logs, caches, spools, and databases
• /home user home directories
• /root home directory for the superuser
• /tmp temporary files that may be cleaned at boot or by timers
• /run volatile runtime data such as PID files and sockets
• /opt optional add on software installed outside the package manager
• /srv data for services served by the system, such as web or FTP content
• /media and /mnt mount points for removable media or manual mounts
• /dev device files that represent hardware and kernel interfaces
• /proc and /sys virtual filesystems that expose kernel and device information

Quick inspection:

1
2
3

sudo ls -l / /bin /etc /home /var | sed -n '1,80p'
ls -l /usr/bin | head
ls -l /dev | head

Inspecting files and directories

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

# show details including permissions, owner, size, and time
ls -l

# human readable sizes and classification marks
ls -lahF

# what type of thing is this
file /etc/hosts

# metadata with inodes and links
stat /etc/hosts

# follow symlinks and print the real path
readlink -f /bin/sh
realpath /bin/sh

Notes:

• file reads magic signatures and reports the file type.
• stat shows the inode number. Files with the same inode on the same filesystem are hard links to the same data.

Safe movement and deletion

1
2
3
4
5
6
7
8
9
10
11
12
13
14

# move and copy with prompts for existing targets
cp -i source.txt dest.txt
mv -i oldname newname

# preview what a wildcard expands to before deleting
printf '%s\n' *.log

# delete interactively or by explicit path
rm -i notes.txt
rm -- -weird-name

# move to trash instead of permanent delete (optional)
# Ubuntu: sudo apt install trash-cli
trash-put notes.txt

Finding files and folders

find walks the directory tree and applies tests.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

# by name and type
target=$HOME
find "$target" -type f -name "*.log" -maxdepth 3

# by size and modification time
find /var/log -type f -size +50M -mtime -7 -printf '%p %s bytes\n'

# run a command on matches (use -print0 with xargs -0 for safety)
find . -type f -name "*.tmp" -print0 | xargs -0 rm -v

# case insensitive name search
find /etc -type f -iname "*ssh*"

# stop at filesystem boundaries
sudo find / -xdev -type f -size +1G 2>/dev/null

locate searches a prebuilt index. It is very fast but may be out of date until the index refreshes.

1
2
3
4

# install and initialize if missing
sudo apt install -y mlocate || sudo dnf install -y mlocate
sudo updatedb
locate sshd_config | head

Symlinks and hard links

• Symbolic link (symlink): a pointer to another path. It can cross filesystems. If the target is removed, the link breaks.
• Hard link: another name for the same inode and data on the same filesystem.

Examples:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

# prepare a demo file
mkdir -p ~/playground/day3 && cd ~/playground/day3
echo "demo" > original.txt

# make a symlink and a hard link
ln -s original.txt link-sym.txt
ln original.txt link-hard.txt

# compare inodes (first column)
ls -li original.txt link-sym.txt link-hard.txt

# remove the original and see what survives
rm original.txt
ls -li
# the symlink shows a broken target, the hard link still contains the data

Mount points and virtual filesystems

Linux attaches filesystems under existing directories. The directory is called a mount point.

1
2
3
4
5
6
7
8
9

# view block devices and mount points
lsblk -f
findmnt -t ext4,xfs,vfat

# current mounts
mount | head

# fstab entries for persistent mounts
grep -v '^#' /etc/fstab | sed '/^$/d'

Notes:

• /proc and /sys are virtual filesystems provided by the kernel. They do not occupy disk space like normal files.
• Removable drives often appear under /media/$USER/NAME when auto mounted by the desktop.

Checking space usage

1
2
3
4
5
6
7
8

# free space per filesystem with types
df -hT

# disk usage in the current directory, sorted by size
du -sh * | sort -h

# top space consumers two levels down
du -h --max-depth=2 /var | sort -h | tail -20

Tip: run heavy du commands with sudo when permission denied appears, or use -x to stay on one filesystem.

Practical lab

The lab builds muscle memory for safe navigation and inspection.

1. Create a playground and explore hidden files.

1
2
3
4
5
6

mkdir -p ~/playground/day3 && cd ~/playground/day3
printf "alpha\n" > a.txt
printf "beta\n"  > b.txt
mkdir notes docs
printf "hidden\n" > .secret
ls -lah

2. Practice absolute and relative moves, then check where you are.

1
2
3
4
5
6
7

cd ~/playground/day3/docs
pwd
cd ..
pwd
cd /etc
pwd
cd -

3. Inspect types and metadata.

1
2

file a.txt
stat a.txt

4. Create links and study inodes.

1
2
3

ln -s a.txt a-symlink
ln a.txt a-hard
ls -li a*

5. Find candidates for cleanup and remove them safely.

1
2
3

find . -type f -name "*.tmp" -print
# if the list looks correct
echo "ok" && find . -type f -name "*.tmp" -delete

6. Measure usage.

1
2

df -hT | head
du -sh ~/* | sort -h | tail -10

Common pitfalls

• Confusing absolute and relative paths. Use pwd before running risky commands.
• Deleting through a symlink and removing the target unexpectedly. Inspect with ls -l or readlink -f first.
• Running rm -rf * in the wrong directory. Preview with printf '%s\n' * and use -i.
• Editing /etc files without backups. Copy to .bak first.
• Forgetting that /proc and /sys are virtual. Do not try to free space there.

Up next: [Day 4 - Viewing and Editing Files in the Terminal])(./day-3-navigating-the-filesystem-and-fhs)

Day 4 focuses on viewing and editing files in the terminal.