Lesson 2: The File System Layout and Navigation

One tree, one root

On Windows you're used to drive letters: C:\, D:\, a USB stick showing up as E:\. Linux doesn't use them. Everything hangs off a single top-level directory called the root, written /. A second disk, a USB stick or a network share doesn't get a letter. It gets attached to a folder somewhere inside that one tree.

Think of it like an office building with a single front door. Every room has an address that starts from the lobby: /home/david/reports means "start at the lobby, go to the home wing, then david's office, then the reports drawer". That address is called a path, and Linux uses forward slashes / between the names, not backslashes.

Most distributions lay out the tree the same way, following a document called the Filesystem Hierarchy Standard. Learn the layout once and you can find your way around Ubuntu, Red Hat, Rocky or Amazon Linux.

The directories you'll actually open

If you remember only two from this table, make them /etc ("how is this configured?") and /var/log ("what went wrong?"). Most support tickets end up in one of them.

Gotcha: /root is not /. "Go to root" is ambiguous. / is the top of the tree; /root is the admin user's home folder. As a normal user you'll usually get Permission denied if you try to look inside /root.

Gotcha: /tmp is temporary. Ubuntu normally empties it at boot, and on some systems it lives only in memory. Never leave anything there that you want to keep.

Note: on current Ubuntu and Red Hat family systems, /bin is just a shortcut (a symbolic link) to /usr/bin, so older guides that say /bin still work.

Where am I? pwd

The shell always has a current working directory. pwd (print working directory) tells you what it is:

$ pwd
/home/david        # a fresh terminal starts in your home directory

Moving around with cd

There are two ways to write a path:

• An absolute path starts with / and works from anywhere, like a full postal address.
• A relative path has no leading / and starts from where you are now, like "two doors down".

$ cd /var/log          # absolute: start at /, go to var, then log
$ pwd
/var/log

$ cd /etc
$ cd ssh               # relative: "ssh inside wherever I am" -> /etc/ssh
$ pwd
/etc/ssh

$ cd ..                # ..  = the parent directory (one level up)
$ pwd
/etc

$ cd ../var/log        # combine them: up to /, then into var/log
$ pwd
/var/log

$ cd .                 # .   = the current directory (you stay put)

$ cd ~                 # ~   = your home directory, /home/david
$ cd                   # cd on its own also takes you home

$ cd -                 # jump back to the previous directory
/var/log

That last one, cd -, saves a lot of typing when you're switching between a config folder and a log folder.

Best practice: use absolute paths in instructions, tickets and scripts, because they mean the same thing whoever runs them and wherever they are. Use relative paths when you're typing interactively and want to save keystrokes.

Tip: press Tab while typing a path and the shell completes it for you. cd /va<Tab>l<Tab> becomes cd /var/log/. It's faster and it avoids typos.

Looking around with ls

ls lists what's in a directory. Options change what you see:

$ ls                   # names only
Documents  notes.txt  scripts

$ ls -a                # -a = all, including hidden files
.  ..  .bashrc  .profile  Documents  notes.txt  scripts

Any file whose name starts with a dot is hidden. Dot-files are usually personal settings, such as .bashrc. -a also shows . and .., the same "here" and "parent" entries you just used with cd.

The long listing -l is the one you'll use most:

$ ls -l /var/log
drwxr-xr-x 2 root   root     4096 Oct 12 09:14 apt
-rw-r----- 1 syslog adm   1843921 Oct 17 10:02 syslog
-rw-r--r-- 1 root   root   302114 Oct 17 08:55 dpkg.log

Read each line left to right:

• First character = type. d is a directory, - is a regular file, l is a link. The other nine characters are permissions, which come later in the course.
• Owner and group: syslog adm.
• Size in bytes: 1843921.
• Last modified date: Oct 17 10:02. Useful for spotting "which log changed just now?"
• Name.

Byte counts are hard to read, so add -h (human-readable):

$ ls -lh /var/log
drwxr-xr-x 2 root   root  4.0K Oct 12 09:14 apt
-rw-r----- 1 syslog adm   1.8M Oct 17 10:02 syslog
-rw-r--r-- 1 root   root  296K Oct 17 08:55 dpkg.log

You can combine the options: ls -lah gives the long, human-readable view including hidden files.

Red Hat family note: the commands are the same, but the main system log is /var/log/messages rather than Ubuntu's /var/log/syslog.

Try it yourself

cd /etc && pwd          # expect: /etc
cd ../var/log && pwd    # expect: /var/log
ls -lh                  # find a line starting with d, and the largest file
cd ~ && ls -la          # expect to see .bashrc and the . and .. entries
cd - && pwd             # expect: /var/log again

If every pwd prints what the comment expects, you've got it.

Key takeaways

• Linux has one tree starting at /, with no drive letters.
• /etc holds configuration, /var/log holds logs, /home holds users' folders, /root is the admin's home, /tmp is throwaway, and /usr/bin holds programs.
• Absolute paths start with /; relative paths start from pwd.
• .. means up one level, . means here, ~ and a bare cd take you home, and cd - takes you back to the previous directory.
• ls -lah shows hidden dot-files, the type (d or -), the size in K/M/G and the modified date.