GO KALI FREE
BeginnerLinux

Linux File System Explained: Directory Hierarchy and Structure

A comprehensive guide to the Linux filesystem hierarchy, directory structure, file types, mount points, and navigation commands.

#Linux#filesystem#directory hierarchy#FHS#file management

Understanding the Linux Filesystem

The Linux filesystem is a hierarchical tree structure rooted at /. Unlike Windows which uses separate drive letters (C:, D:, E:), Linux treats every storage device, partition, and network share as a directory within a single unified tree. This design provides consistency across systems and simplifies path management.

The Filesystem Hierarchy Standard (FHS) defines the purpose and contents of directories in Linux systems. Most distributions follow the FHS, so the directory structure is similar across Ubuntu, Kali, Fedora, and others.

Prerequisites

Basic familiarity with the command line including ls,cd, and pwd commands. Understanding file paths (absolute vs relative) is helpful.

The Root Directory

The root directory / is the top of the filesystem tree. Every file and directory on the system branches from this single point. All paths that start with / are absolute paths because they begin at the root.

Essential Directories Explained

/bin — Essential User Binaries

/bin contains essential command binaries needed for system booting and repair. These commands are available even if other filesystems are not mounted. Common binaries include ls, cp, mv, rm, cat, echo, bash, and sh.

ls /bin | head -10
# Output: bash, cat, chmod, cp, date, echo, grep, kill, less, ln

On modern distributions, /bin is often a symbolic link to /usr/bin.

/boot — Boot Loader Files

/boot contains everything needed to boot Linux: the kernel (vmlinuz), initial RAM disk (initrd.img), boot loader configuration (GRUB), and System.map (kernel symbol table). This directory is often kept small and may be a separate partition.

ls /boot
# vmlinuz-6.1.0-kali9-amd64  initrd.img-6.1.0-kali9-amd64  grub/

/dev — Device Files

Linux treats hardware devices as files. /dev contains device nodes that represent hardware components like hard drives (/dev/sda), partitions (/dev/sda1), terminals (/dev/tty), sound cards (/dev/audio), and random number generators (/dev/urandom).

ls /dev | head -10
# sda, sda1, sda2, tty, null, zero, random, urandom, cdrom, usb

/etc — Configuration Files

/etc (et-cetera) contains system-wide configuration files. This is one of the most important directories for system administration. Examples include:

  • `/etc/passwd` — User account information
  • `/etc/shadow` — Encrypted passwords
  • `/etc/ssh/sshd_config` — SSH server configuration
  • `/etc/network/interfaces` — Network configuration
  • `/etc/apt/sources.list` — Package repository list
  • `/etc/hosts` — Static hostname mapping
  • `/etc/fstab` — Filesystem mount table
    • cat /etc/os-release
# PRETTY_NAME="Kali GNU/Linux Rolling"
# NAME="Kali GNU/Linux"

    /home — User Home Directories

    Each regular user gets a subdirectory under /home (except root, whose home is /root). User data, personal configurations (dotfiles), and user-installed programs reside here. The path /home/username is often accessible as ~ for the current user.

    ls -la /home
# drwxr-xr-x  user1 user1  /home/user1
# drwxr-xr-x  user2 user2  /home/user2

    /lib — System Libraries

    /lib contains shared libraries needed by binaries in /bin and /sbin. These are the equivalent of DLLs on Windows. Library files typically have extensions like .so (shared object) or .a (archive). Kernel modules reside in /lib/modules.

    /media and /mnt — Mount Points

    /media is used for removable media (USB drives, CD-ROMs) that are automatically mounted. /mnt is a generic mount point for temporary manual mounts.

    # Mount a USB drive
sudo mount /dev/sdb1 /mnt/usb
ls /mnt/usb

    /opt — Optional Software

    /opt is reserved for third-party software packages that are not part of the distribution's package manager. Software here is self-contained in its own subdirectory. Examples include Google Earth, Oracle Database, and some commercial tools.

    /proc — Process Information

    /proc is a virtual filesystem that provides runtime system information. It contains files for every running process (numbered directories), system information (/proc/cpuinfo, /proc/meminfo), and kernel parameters (/proc/sys). Files in /proc are dynamically generated and do not occupy disk space.

    cat /proc/cpuinfo | head -5
cat /proc/meminfo | head -5
ls /proc | grep -E '^[0-9]+
    #039; | head -10  # Process IDs

    /root — Root Home Directory

    The home directory for the root (administrator) user is /root, not /home/root. This separation ensures root can log in even if /home is unmounted during recovery.

    /sbin — System Binaries

    /sbin contains system administration binaries used for system maintenance. These commands typically require root privileges. Examples include fdisk (partition editor), mkfs (filesystem creation), fsck (filesystem check), ifconfig, and reboot.

    /tmp — Temporary Files

    /tmp is world-writable and stores temporary files. Files in /tmp are typically deleted on system boot. The sticky bit (t) on /tmp prevents users from deleting each other's files.

    ls -la / | grep tmp
# drwxrwxrwt  ... /tmp

    /usr — User System Resources

    /usr is the largest directory on a typical Linux system. It contains user utilities, applications, libraries, documentation, and source code.

    /var — Variable Data

    /var stores data that changes frequently during system operation: logs (/var/log), spools (/var/spool), temporary files preserved between reboots (/var/tmp), cache data (/var/cache), web server root (/var/www), and database state (/var/lib).

    du -sh /var/log
ls /var/log/

    File Types in Linux

    Linux treats everything as a file. The first character of ls -l output indicates the file type:

    | Character | File Type | Example |

    |-----------|-----------|---------|

    | - | Regular file | -rw-r--r-- |

    | d | Directory | drwxr-xr-x |

    | l | Symbolic link | lrwxrwxrwx |

    | c | Character device | crw-rw-rw- |

    | b | Block device | brw-rw---- |

    Mount Points and Partitions

    mount | head -10

    Real-World Examples

    Finding Large Log Files: du -sh /var/log/* | sort -rh | head -10

    Checking Disk Usage by Directory: du -sh /* 2>/dev/null | sort -rh | head -10

    Finding Configuration Files: find /etc -name "*.conf" -type f

    Common Mistakes

    Confusing /bin and /usr/bin — on modern systems they are often symlinked. Never delete files in /proc or /sys. Ignoring /etc when troubleshooting.

    Best Practices

    Use df -h to monitor disk space. Use du -sh for directory sizes. Keep /boot clean of old kernels. Understand symbolic links — they are pointers, not copies.

    Related Tools

    ncdu — Interactive disk usage analyzer. du — Estimate directory space. df — Filesystem disk space. lsblk — List block devices. find — Search for files. tree — Display directory structure.

    Related Articles

  • linux-commands-explained
  • linux-file-permissions
  • command-line-essentials
  • linux-terminal-guide
  • kali-linux-beginner-guide

    • Summary

    The Linux filesystem follows the FHS with a single root directory /. Key directories include /bin (commands), /etc (configuration), /home (user data), /var (logs), /tmp (temporary files), and /usr (applications). Understanding this structure is fundamental to Linux administration and security.

    Knowledge Check

  • What is the root directory symbol in Linux?
  • Which directory contains system configuration files?
  • What is special about the /proc directory?
  • Where are user home directories stored?
  • What command shows mounted filesystems?

    • Frequently Asked Questions

    What is the Linux filesystem hierarchy standard (FHS)?

    The FHS defines the purpose and contents of directories in Linux systems, ensuring consistency across distributions. It specifies that /etc holds configuration files, /var stores logs, /home contains user data, and /bin holds essential commands. See our [Linux commands guide](/learn/linux-commands-explained) for navigation basics.

    What is the difference between /bin and /usr/bin?

    On modern Linux distributions, /bin is often a symbolic link to /usr/bin — they contain the same essential command binaries. Historically, /bin held commands needed during boot while /usr/bin held user commands after /usr was mounted. The distinction is largely cosmetic today.

    Why is /proc important for system administration?

    /proc is a virtual filesystem that provides real-time system information including per-process details (by PID number), CPU and memory info via /proc/cpuinfo and /proc/meminfo, and kernel parameters under /proc/sys. Files here are generated dynamically and use no disk space.

    Where should I store user files in Linux?

    User files belong in /home/username, which contains personal configurations (dotfiles), documents, and user-installed programs. The tilde (~) shorthand expands to the current user's home directory. Root's home is /root, not /home/root, ensuring root access even if /home is unmounted.

    What is the /tmp directory used for?

    /tmp stores temporary files that are typically deleted on reboot. It is world-writable but protected by the sticky bit, which prevents users from deleting each other's files. Never store important data in /tmp — use /var/tmp for files that need to survive reboots.

    What is the difference between /var and /tmp?

    /var stores variable data that persists between reboots (logs, caches, databases), while /tmp holds temporary files deleted on boot. /var/log contains system logs, /var/cache holds package manager caches, and /var/tmp preserves temporary files across reboots unlike /tmp.

    How do I find which directory uses the most disk space?

    Use `du -sh /* 2>/dev/null | sort -rh | head -10` to list the largest top-level directories. For interactive exploration, install ncdu with `sudo apt install ncdu` and run it on any path. This is essential for managing disk usage on servers.

    What are device files in /dev?

    Linux represents hardware as files in /dev: hard drives (/dev/sda), partitions (/dev/sda1), terminals (/dev/tty), and null/random devices (/dev/null, /dev/urandom). The null device discards input (like /dev/null), while urandom generates random numbers used by security tools and encryption.

    Where are system configuration files stored?

    System-wide configuration lives in /etc, including /etc/passwd (user accounts), /etc/ssh/sshd_config (SSH server), /etc/hosts (static DNS), and /etc/fstab (mount table). User-specific configs are dotfiles in the home directory like ~/.bashrc. Learn more in our [Linux terminal guide](/learn/linux-terminal-guide).

    What is the difference between absolute and relative paths?

    Absolute paths start from the root directory (/) like /etc/hosts and always resolve to the same location. Relative paths start from the current directory like ../config/file and change depending on where you are. Use `pwd` to print your current directory and understand your relative position.