Determine File Type in Linux with the file Command

Learn how to identify a file's actual format in Linux with the file command, including MIME types, symbolic links, filenames, and safe shell usage.

Linux does not determine a file's format from its filename extension. A file named report.txt might contain binary data, while a file with no extension might be a shell script, image, archive, or executable. The file command determines and describes a file's type by examining filesystem information and the file's contents.

This makes file useful when you receive an unknown file, verify a download, troubleshoot a misleading extension, or need machine-readable type information in a script.

Basic file Command Syntax

The basic syntax is:

file FILE

For example:

file document

Typical output includes the pathname followed by a detected description:

document: ASCII text

The description is based on detected content and filesystem information, not merely on the name after the final dot.

Inspecting Multiple Files

Provide several pathnames as arguments to classify them in one command:

file report.pdf image.png program

Example output might look like this:

report.pdf:  PDF document, version 1.7
image.png:    PNG image data, 800 x 600, 8-bit/color RGBA
program:      ELF 64-bit LSB pie executable

Each input normally produces one line, making it easy to compare files.

Why File Type Detection Matters

Extensions are conventions used by people and applications. They are not a reliable security or format boundary. Renaming photo.png to photo.txt does not convert the image into text. Similarly, a script may have no extension at all.

Using file can help identify:

• Plain text and Unicode text files
• Shell scripts and other source files
• ELF executables and shared libraries
• Directories, symbolic links, sockets, and device files
• Images such as PNG and JPEG files
• Compressed files and archive containers
• Unknown binary content reported as generic data

Detection is useful evidence, but it is not a complete security analysis. Do not execute an unknown program simply because its name or reported type appears familiar.

How the file Command Identifies Content

The utility applies several kinds of tests. Conceptually, it checks applicable tests in sequence, and the first successful applicable test determines the reported type.

Filesystem Tests

A filesystem test recognizes the kind of filesystem object represented by a pathname. This allows file to report a directory or symbolic link even though those objects do not have ordinary file contents. It can also identify special objects such as sockets and device files.

Magic-Number Tests

A magic number is a distinctive byte sequence at a known location in a file. Many binary and container formats begin with recognizable signature bytes. The file utility compares these bytes with rules in its magic database, which is the collection of known signatures and detection rules.

For example, a PNG file can be recognized from its signature even if its name has no .png extension. Similar rules identify many archives, document formats, images, and executable formats.

Language and Text-Content Tests

When binary signatures do not provide the answer, file can analyze text content. A language test recognizes patterns associated with programming languages, scripts, or other text-based formats. A file may therefore be identified as a shell script or source file based on its content.

The exact description depends on the file's bytes, encoding, and the detection rules installed on the system. A text classification describes detected content; it does not simply repeat a suffix such as .txt.

Interpreting Common Output

• ASCII text: Text using the ASCII character set.
• UTF-8 Unicode text: Text containing characters encoded as UTF-8.
• empty: A file with zero bytes.
• directory: A directory filesystem object.
• symbolic link: A pathname entry that points to another pathname.
• ELF executable: An executable or related object using ELF, the common executable and shared-library format on Linux and many Unix-like systems.
• compressed archive: Data recognized as a compressed or archive format, such as a ZIP or gzip-related format.
• data: Content that did not match a known signature or recognizable text format.

An output of data does not necessarily mean the file is damaged. It may be a private binary format, encrypted content, an incomplete file, or a format unknown to the installed magic database.

Useful Output Options

Brief Descriptions

Use -b when another part of a script already knows the filename:

file -b document

ASCII text

MIME Types and Encodings

A MIME type is a standardized media-type label, such as text/plain or image/png. MIME output is convenient for programs that need a consistent label rather than a human-oriented description.

file -i notes.txt

notes.txt: text/plain; charset=us-ascii

The --mime-type form returns only the media type:

file --mime-type image.png

image.png: image/png

Use -i when character-set information matters. Use --mime-type when a script needs only the media type.

Following Symbolic Links

A symbolic link is a filesystem entry that points to another pathname. Without extra options, file may report the link itself:

file current

current: symbolic link to release

Use -L when you want the type of the referenced target:

file -L current

ELF 64-bit LSB shared object

Working Safely with Filenames

Paths Containing Spaces

The shell normally splits unquoted spaces into separate arguments. Quote the complete pathname:

file "file with spaces"

You can also escape each space with a backslash:

file file\ with\ spaces

Quoting is generally easier to read and also protects other shell-special characters from expansion.

Filenames Beginning with a Hyphen

A pathname such as -filename can be mistaken for a command-line option. Place -- before it:

file -- -filename

The -- marker tells the command to stop processing options and treat the remaining argument as a pathname.

Shell Globs

A shell glob is a wildcard pattern that the shell expands before running the command. To classify entries in the current directory, you can use:

file *

This may report regular files, directories, and other entries. Use globs carefully:

• * normally does not match names beginning with a dot, so hidden entries are not included.
• A pattern can expand to many arguments and produce a large amount of output.
• Always check the pattern before running commands that modify files; for file, the operation is inspection only.
• Quote a wildcard only when you want to pass the literal pattern rather than let the shell expand it.

Practical Examples

Identify One Unknown File

file document

Read the description that follows the filename. It might identify ASCII text, a PNG image, an archive, or an ELF executable.

Check a Text File

file notes.txt

The result may be ASCII text or a Unicode text classification. The extension does not determine the result.

Inspect a Group of Files

file report.pdf image.png program

This prints one detected description for each supplied pathname.

Inspect Entries in the Current Directory

file *

The shell expands * into matching names, and file examines each resulting argument.

Get a Machine-Friendly Result

file --mime-type image.png

This produces a value such as image/png, which is easier for scripts to compare than a longer descriptive sentence.

Troubleshooting

The Type Does Not Match the Extension

An extension may be misleading, missing, or manually changed. Treat the detected content description as the primary indication of format, then inspect the file further if the distinction matters.

The Result Is data

The file may not match a known signature or recognizable text format. Check where the file came from, verify whether it is complete, and inspect its bytes with a suitable hexadecimal viewer when necessary. MIME output can provide another representation:

file --mime-type unknown-file

Remember that an unknown result is not proof that the file is safe or unsafe.

A Symbolic Link Is Reported Instead of Its Target

By default, the link itself may be identified. Use dereferencing:

file -L LINK

A Leading-Hyphen Name Is Treated as an Option

Use the option terminator before the pathname:

file -- -filename

A Path with Spaces Is Split into Several Arguments

Quote the path or escape its spaces:

file "file with spaces"

Exam- and Practice-Relevant Notes

• The file command examines filesystem metadata and content; it does not rely only on filename extensions.
• A magic number is a recognizable byte sequence used to identify many binary formats.
• The magic database contains known signatures and rules used by file.
• Filesystem tests can identify directories, links, sockets, and device files.
• Language tests analyze recognizable text-based source or script content.
• -b removes the filename from normal human-readable output.
• -i reports MIME type and character-set information; --mime-type reports only the MIME type.
• -L follows symbolic links to inspect their targets.
• -- protects a pathname that begins with a hyphen.