Determine File Type in Linux with the file Command

Learn how to use the Linux file command to identify text, binaries, archives, images, directories, symbolic links, and other filesystem objects.

Linux filenames do not reliably describe what a file contains. A file named report.txt might contain binary data, while a file with no extension might be a valid image or archive. The file command examines the target and reports its detected type.

What the file Command Does

file is a Linux command-line utility for identifying the type or format of a filesystem object. Its result is based on filesystem metadata and, when appropriate, the contents of the target.

The target can be a regular file, directory, executable, script, archive, symbolic link, device, or another filesystem object. The command prints a human-readable classification.

Basic Syntax

file FILE_NAME

For example, to inspect a document named notes.txt:

file notes.txt

A possible result is:

notes.txt: ASCII text

ASCII text means the file contains plain text represented with ASCII characters. Other text encodings may be reported differently.

Practical Examples

Identify a plain text file

file notes.txt

The command may report ASCII text or another text encoding. This checks the contents instead of trusting the .txt suffix.

Inspect an unknown file

file unknown_file

This is useful when a downloaded file has no extension or when its name does not explain its format. The result may identify text, an executable, an archive, an image, or generic data.

Check a file with a misleading name

file package.bin

Magic-number detection may reveal that the object is an image, compressed archive, executable, or another recognized binary format, even though its name ends in .bin.

Identify a directory

file /path/to/directory

A directory is a filesystem object, not a regular content file. The command can report it as a directory using filesystem metadata without analyzing the directory's entries as file contents.

How file Identifies a Target

The command applies detection tests in an ordered process. In general, it checks filesystem information first, then recognizable content signatures, and finally text or language characteristics. Detection stops when a successful classification is found.

Test type — What is examined — Typical results

Filesystem test — Filesystem metadata and the object's category — directory, symbolic link, device, or empty file

Magic-number test — Identifying bytes or signatures in the content — archive, image, executable, or other binary format

Language/text test — Text content, character encoding, and recognizable language patterns — ASCII text, scripts, or source-related text

Filesystem tests

A filesystem test uses metadata or object-category information rather than examining the file's content. This lets file recognize categories such as:

Directories
Symbolic links, which are filesystem objects that point to another path
Devices
Sockets
Empty files

These checks can identify an object even when it has no useful content to inspect.

Magic-number tests

Many binary and structured formats begin with a recognizable sequence of bytes. This sequence is commonly called a magic number, although it can be longer than a single number. The signature may appear at a known position, often near the beginning of the file.

The file command compares content against known signatures. This can identify a format when the filename has no extension, has the wrong extension, or uses a misleading name.

For example, a file named download might still be recognized as an archive or image because its content contains a known format signature.

Language and text tests

If the target appears to be text, file analyzes character patterns and encoding. A simple document may be reported as ASCII text. Other results can indicate a different text encoding or a particular type of textual content.

A language test looks for patterns associated with scripts or source files. An interpreter directive, sometimes called a shebang, can provide a clue about the program used to run a script. Recognizable language content can also help classify source-related text, although not every programming language or file format will be identified.

Interpreting Common Results

Reported category — Meaning — Example use case

ASCII or text data — The content is recognized as plain text or another text encoding — Read it with tools such as less or inspect it as source

Executable — The content matches a recognized executable format — Determine whether it is a program before attempting to run it

Archive or compressed data — The content matches a packaging or compression format — Choose an appropriate extraction or decompression tool

Image or other media format — The content matches a recognized media format — Open or process it with a format-appropriate tool

Directory or symbolic link — Filesystem metadata identifies the object category — Inspect the directory or follow the link target as appropriate

The result is a detection based on available evidence. It is not a guarantee that the file is safe, trustworthy, complete, or suitable for a particular purpose. A file can be correctly identified as an executable and still be malicious, damaged, or unwanted.

Why Extensions Can Disagree

A file extension is the suffix in a filename, such as .txt, .jpg, or .zip. It is a naming convention, not a reliable description enforced by Linux.

An extension may disagree with the file result because it was changed accidentally, assigned incorrectly, omitted, or deliberately misleading. For format detection, the command's content- and metadata-based result is generally more useful than the suffix alone.

Troubleshooting

The reported type differs from the extension

Extensions can be missing, changed, or misleading. Use the reported type as evidence about the content, then inspect the file further with a format-specific tool if necessary.

The result says generic data

A generic result may mean that the format has no recognized signature, is encrypted, is corrupted, is proprietary, or does not contain enough distinctive information. Treat this result as inconclusive. Use an appropriate format-specific inspection tool or examine the content carefully.

The command cannot inspect the target

The path may be incorrect, the target may not exist, or your user may lack permission to access it. Check the path and permissions, then run the command again:

file /correct/path/to/target

A text-like file is not identified as the expected language

The file may not contain enough recognizable language indicators, or its format may not be supported by the available detection rules. Use the general text classification, inspect the contents, and check any interpreter line separately.

Exam-Relevant Notes

file FILE_NAME identifies a filesystem object or detected file format.
Filenames and extensions are conventions; they do not prove a file's actual type.
Filesystem tests use metadata and can identify directories, symbolic links, devices, sockets, and empty files.
Magic numbers are recognizable byte sequences used to identify many binary formats.
Language and text tests analyze textual content, encoding, scripts, and source-related patterns.
The command reports a classification based on evidence; it does not certify safety or intent.