Linux online course

Identify File Types in Linux

Learn to identify Linux filesystem object types from the first character of ls -l output, including files, directories, links, devices, pipes, and sockets.

Linux treats more than ordinary documents as filesystem entries. A filesystem object is any entry in a filesystem, including a regular file, directory, symbolic link, device, named pipe, or socket. The first character of an ls -l listing tells you which kind of object you are looking at.

Reading the Long Listing from ls -l

The ls -l command displays a long listing: a detailed format that includes permissions, ownership, size, timestamps, and names.

ls -l

-rw-r--r--  1 alex users  1200 Aug 17 10:30 notes.txt
drwxr-xr-x  2 alex users  4096 Aug 17 10:31 projects
lrwxrwxrwx  1 alex users     7 Aug 17 10:32 current -> projects

At the beginning of each line is the mode field, sometimes called the type-and-permission field. In -rw-r--r--, the first character, -, is the file type code. The remaining nine characters are the permission bits.

• First character: identifies the kind of filesystem object.
• Next nine characters: show read, write, and execute permissions for the owner, group, and others.

For file-type identification, read only the first character. Do not mistake the permission characters for the object type.

Separating Type from Permissions

Linux File Type Codes

Regular Files: -

A hyphen, -, means the entry is a regular file. Regular files are ordinary containers for user, program, or system data. Examples include text documents, images, executable programs, source code, and configuration files.

-rw-r--r--  1 alex users  1200 Aug 17 10:30 notes.txt
-rwxr-xr-x  1 alex users 18432 Aug 17 10:31 backup-tool

Linux does not determine a regular file's filesystem type from its filename extension. A file named report.txt and a file named report can both be regular files. An extension is part of the name and may suggest a content format, but it is not what makes the entry a regular file.

To investigate the contents or likely format of a regular file, use file:

file path

This answers a different question from ls -l. The first character from ls -l identifies the filesystem object, while file examines contents and recognizable data formats.

Directories: d

The character d denotes a directory. A directory is a special filesystem object that stores names and references to other entries. It can contain regular files, subdirectories, and symbolic links.

drwxr-xr-x  3 alex users 4096 Aug 17 10:35 projects

Normally, ls -l directory-name lists the directory's contents. To display information about the directory object itself, use -d:

ls -ld directory-name

This distinction is useful when checking a directory's own type and permissions instead of examining the entries inside it.

Symbolic Links: l

The character l denotes a symbolic link. A symbolic link is a filesystem reference containing another path. It can point to a regular file, directory, or another path.

ls -l link-name

lrwxrwxrwx  1 alex users 7 Aug 17 10:32 current -> projects

The arrow, ->, shows the link's target path. The link and its target are separate filesystem objects: the link has its own name and type, while the target is the object reached by following that path.

A symbolic link becomes broken when its target is moved or deleted. The link may remain visible in a listing, but commands that follow it cannot reach the original target.

ls -l link-name

When diagnosing a broken link, inspect the path shown after -> and verify that the target still exists at that path.

Device Files: c and b

Device files, also called device nodes, provide filesystem names for hardware or kernel interfaces. They are commonly found under /dev and should not be assumed to be ordinary stored documents.

Character Devices

The character c denotes a character device. It transfers data as a stream of characters or bytes, generally in a sequential manner.

crw-rw-rw-  1 root tty 5, 2 Aug 17 10:40 device-entry

Block Devices

The character b denotes a block device. It transfers data in blocks and is commonly associated with storage devices such as disks and partitions.

brw-rw----  1 root disk 8, 0 Aug 17 10:40 storage-entry

Use the following command to view device entries:

ls -l /dev

Communication Objects: p and s

Named Pipes (FIFOs)

The character p denotes a named pipe, also called a FIFO. A FIFO is a special file used for one-way communication between processes. One process writes data and another process reads it, commonly in the order it was written.

prw-r--r--  1 alex users 0 Aug 17 10:45 messages

A FIFO is not a conventional document that simply stores data for later inspection. It may wait for another process to read or write, so it can appear empty or behave unexpectedly when handled like a regular file.

Sockets

The character s denotes a socket. A Unix socket is a special filesystem object that allows processes to communicate, often between local client and server programs.

srwxr-xr-x  1 alex users 0 Aug 17 10:46 service.sock

Sockets are communication endpoints, not ordinary data files. Their behavior depends on the processes using them.

Why the File Type Matters

The filesystem object's type affects how the Linux kernel and commands treat the path. A command that reads ordinary data may work on a regular file but fail, block, follow, or take special action when given a directory, symbolic link, device, FIFO, or socket.

• A regular file is normally read as stored data.
• A directory organizes references to other entries and may require recursive or directory-specific handling.
• A symbolic link may be followed to another path, and that path may no longer exist.
• A device represents a hardware or kernel interface rather than a normal document.
• A FIFO or socket may require another process for communication.

Object type, contents, and permissions are different properties. The type code tells you what kind of filesystem object the entry is. The contents describe data stored in a regular file or the information exposed by a special object. Permission bits indicate which users or groups may perform permitted operations.

Using ls, file, and stat Together

Use ls -l when you want a quick visual type code, permissions, ownership, size, and timestamp:

ls -l path

Use file when you want to examine the contents or recognized format of a path, especially a regular file:

file path

Use stat for detailed metadata, including the filesystem object's type and permissions:

stat path

These commands complement one another. For example, a file can have an unexpected extension, but ls -l still reveals whether it is a regular file or another object, while file can help identify the data format inside it.

Practical Recognition Examples

Common Directory Listing

-rw-r--r--  1 alex users  1200 Aug 17 10:30 notes.txt
d rwxr-xr-x  2 alex users  4096 Aug 17 10:31 projects
lrwxrwxrwx  1 alex users     7 Aug 17 10:32 current -> projects

Ignoring the spacing typo that may appear in manually formatted output, the meaningful type patterns are:

• -rw-r--r--: regular file.
• drwxr-xr-x: directory.
• lrwxrwxrwx: symbolic link.

Special Entries

• crw-rw-rw-: character device.
• brw-rw----: block device.
• prw-r--r--: named pipe or FIFO.
• srwxr-xr-x: socket.

Troubleshooting File Type Confusion

A File Has No Extension or an Unexpected Extension

Filename extensions do not determine the filesystem object type. Run ls -l path to identify whether the path is a regular file, directory, link, or special object. For a regular file, run file path to examine its contents or format.

A Symbolic Link Target Does Not Exist

Inspect the target after the -> marker in ls -l output. The symbolic link may be broken because the target was moved or deleted.

A Path Expected to Be a Normal File Begins with d

The path is a directory. Use a path to a file inside that directory, or use a command option designed to process directories recursively when appropriate.

An Entry under /dev Cannot Be Treated Like a Document

The entry is likely a character or block device. Device nodes represent hardware or kernel interfaces, and their behavior depends on the associated device and permissions.

A Path Beginning with p or s Appears Empty

A named pipe or socket is a communication endpoint, not conventional stored data. It may require another process to read from or write to it.

Quick Reference

1. Run ls -l.
2. Find the mode field at the start of the line.
3. Read its first character to identify the filesystem object type.
4. Read the following characters separately as permission bits.
5. Use file for a regular file's contents or format.
6. Use stat when you need detailed metadata.

The essential mapping is - regular file, d directory, l symbolic link, c character device, b block device, p FIFO, and s socket.

Related Linux Topics

• File Structure in Linux
• Determine File Type
• Show The Full Path Of Shell Commands
• Linux