The file command is a powerful tool used to determine the actual content of a file, rather than relying on its filename or extension (like .txt or .jpg).
In Linux, file extensions are optional. A file named photo.jpg might actually be a text file, or a file with no extension at all might be a program. The file command looks "inside" the file to find out what it really is.
How it works:
It uses three sets of tests to identify a file:
- File System Tests: It checks the file's basic properties (is it a directory? Is it empty?).
- Magic Tests: This is the most important part. It looks for "magic numbers" (specific bytes at the beginning of a file) that identify the format. For example, almost all PDF files start with the characters
%PDF. - Language Tests: If it’s a text file, it checks the character encoding (like UTF-8 or ASCII).
Examples you can try in your terminal:
1. Identifying a Text File:
Even though /etc/passwd doesn't have an extension, the file command knows it's text:
file /etc/passwd
Output: /etc/passwd: ASCII text
2. Identifying a Program (Binary): This identifies the shell you are currently using:
file /bin/bash
Output: /bin/bash: ELF 64-bit LSB pie executable... (This tells you it's a 64-bit program).
3. Identifying a Directory:
file /home
Output: /home: directory
Summary:
Whenever you encounter a mysterious file and aren't sure how to open it, use the file command. It is the most reliable way to tell the difference between a picture, a document, or a system script!
