A typical Unix system consists of thousands of files. During the development of Unix certain rules have emerged in which directories which files are normally stored. These rules were adapted to the particularities of Linux and summarized in a separate document: the Filesystem hierarchy standard (FHS). Most Linux distributions adhere to this standard with a few exceptions.
The file system starts with the root directory. There are normally no files but only directories.
We will now look at all possible subdirectories, I will treat each with a single message.
/bin
Contains elementary Linux commands for system administration that can be executed by all users. Other programs are located in /usr/bin. In modern distributions, /bin is simply a link to /usr/bin. The separation between /bin and /usr/bin has thus been removed.
┌──(teacher㉿carder)-[~]
└─[07:21:50 PM]─$ ls -l /bin
lrwxrwxrwx 1 root root 7 Jan 29 01:53 /bin -> usr/bin
/boot
Contains files used for booting/starting up the system (usually by GRUB). With most distributions, the kernel is also located here.
Since I have problems with GRUB in the past, I will learn a little GRUB and still write individual topics about it soon.
┌──(teacher㉿carder)-[~]
└─[07:22:17 PM]─$ ls /boot
config-5.10.0-kali6-amd64 initrd.img-5.10.0-kali6-amd64 System.map-5.10.0-kali7-amd64
config-5.10.0-kali7-amd64 initrd.img-5.10.0-kali7-amd64 vmlinuz-5.10.0-kali6-amd64
efi lost+found vmlinuz-5.10.0-kali7-amd64
grub System.map-5.10.0-kali6-amd64
/dev
Contains all device files. Almost all hardware components - such as the serial interface or a hard disk partition - are accessed via so-called device files. These are set up dynamically by the udev-system. With most distributions, the /dev directory is located in a RAM disk, which means that the contents of the directory are not retained when the computer is rebooted.
You can use the df command to list all your devices. df not only shows you the device, but also shows the size, used memory, available memory, usage in % and where it was mounted.
For space reasons I will only give the command here.
┌──(teacher㉿carder)-[~]
└─[07:29:16 PM]─$ df -h
/etc
Contains configuration files for the whole system. Within /etc there are a lot of subdirectories that organize the configuration files into groups — e.g. /etc/apt for files of the package management system apt.
┌──(teacher㉿carder)-[~]
└─[07:34:27 PM]─$ ls /etc/apt/sources.list.d/ | grep -v ".save"
anydesk-stable.list
checkra1n.list
docker.list
freedownloadmanager.list
malteworld-ubuntu-ppa-impish.list
mattrose-ubuntu-terminator-hirsute.list
metasploit-framework.list
ondrej-ubuntu-php-hirsute.list
opera-stable.list
spotify.list
sublime-text.list
teamviewer.list
vscode.list
whonix.list
┌──(teacher㉿carder)-[~]
└─[07:35:21 PM]─$ cat /etc/apt/sources.list.d/checkra1n.list
deb https://assets.checkra.in/debian/
/home
Contains the home directories of all regular Linux users. The home directory is the directory in which the user is automatically located after logging in and to whose files he has unrestricted access rights. A special case is root, as so often: Its home directory is /root.
To move quickly in the home directory, there is a tilde character that you can use.
cd ~
cd ~/Desktop/
cd ~/Documtents/
If you don't use this, you have to go back to the main directory and execute the command again manually.
/lib[64]
Contains some shared libraries or symbolic links to them. The files are needed for the execution of programs. /lib/modules contains kernel modules that are dynamically activated or deactivated during operation. Other libraries contain the firmware of various hardware components (e.g. wlan-controller).
On current distributions, /lib is a link to/usr/lib. This means that all libraries are stored centrally in the /usr directory.
/lost+found
Only exists in ext file systems. The directory is usually empty. If it does contain files, then they are file fragments that could no longer be allocated when fsck attempted to repair the file system. In other words, sectors were found, but it is unclear to which file the sector once belonged. Instead of simply deleting such file fragments, fsck copies them to the lost+found directory.
fsck is automatically executed during system startup if Linux was not shut down properly (power failure, crash, etc.) or if the file system has not been checked for a long time. The goal of fsck is to restore the file system to a well-defined state.
/media
Contains subdirectories like cdrom or <usb-name> where external file systems are mounted. Traditionally, /mnt was common for this, but in recent years /media and finally the directory /run/media/<benutername>/<filecarrier-name> have become popular instead.
/opt
Is intended for add-on packages, but is rarely used by common distributions - probably because it is unclear how add-on packages differ from normal packages.
Some use this file path for Github repositories
/proc
Contains subdirectories for all running processes. These are not real files! The /proc directory merely reflects the Linux-internal administration of the processes.
/root
Contains the files of the root user, i.e. the system administrator.
/run
Contains files with the process IDs and other information of some system services for many current distributions. In the past, these files were stored in the /var/run directory.
The /run/lock/ subdirectory contains locking files. For example, you may have noticed that if you run apt update or apt upgrade and try to install another package, it will not work because it is locked. On older distributions, you will find the locking files in /var/lock instead.
With many distributions, either the entire /run directory or at least individual /run subdirectories are stored in a RAM disk. The mostly very small files in /run are thus never physically stored on a hard disk or SSD and are lost when the computer is rebooted.
/sbin
Contains commands for system administration. A common feature of all programs stored in it is that they may only be executed by root. In modern distributions, /sbin is a link from /usr/sbin. All system administration commands are now in /usr/sbin.
/share
Sometimes contains architecture-dependent files, i.e. files that are independent of the processor. The correct location is actually /usr/share.
/srv
Contains data for server processes in some distributions (Fedore, RHEL), e.g. in /srv/www files of the web server or in /srv/ftp files of the FTP server.
/sys
Contains the sysfs file system. Like the proc file, it provides information about the state of the computer.
/tmp
Contains temporary files. However, temporary files are often stored in /var/tmp. An example of this would be /tmp/mozilla_mrblackx0/ where temporary downloads from Mozilla Firefox are stored.
/usr
Contains all application programs, the complete X system, the source codes to Linux etc. The contents of this directory usually change only during package installations and updates. The /var directory is intended for modifiable files. There are important sub directories which are as follows:
/usr/bin : Executable programs.
/usr/games : Games, possibly link to /usr/share/games.
/usr/include : C include files.
/usr/lib[64] : Various libraries, plus countless subdirectories for C compilers, various other programming languages, large program packages such as emacs or Latex, etc.
/usr/local : Applications and files that do not directly belong to the Linux distribution or were installed later.
/usr/sbin : Only programs executable by root.
/usr/share : Architecture independent data (e.g. emacs lisp files, ghostscript fonts etc.) documentation (/usr/share/doc).
/usr/src/ : Source code to Linux and possibly to other programs
/var
Contains mutable files. Important subdirectories include docker (docker files), lock (locking files to protect access to devices), log (logging files), mail (email files, often also in /var/spool/mail), mysql (MySQL database files), and spool (cached print files).
That's it, I know it dragged out but finally we got it. If there are questions come privately.
After all, it is important to know how your file system is structured to be able to use Linux properly.
Filesystem Hierarchy Standard
This standard consists of a set of requirements and guidelines for file and directory placement under UNIX-like operating systems. The guidelines are intended to support interoperability of applications, system administration tools, development tools, and scripts as well as greater uniformity of...
refspecs.linuxfoundation.org
The file system starts with the root directory. There are normally no files but only directories.
We will now look at all possible subdirectories, I will treat each with a single message.
/bin
Contains elementary Linux commands for system administration that can be executed by all users. Other programs are located in /usr/bin. In modern distributions, /bin is simply a link to /usr/bin. The separation between /bin and /usr/bin has thus been removed.
┌──(teacher㉿carder)-[~]
└─[07:21:50 PM]─$ ls -l /bin
lrwxrwxrwx 1 root root 7 Jan 29 01:53 /bin -> usr/bin
/boot
Contains files used for booting/starting up the system (usually by GRUB). With most distributions, the kernel is also located here.
Since I have problems with GRUB in the past, I will learn a little GRUB and still write individual topics about it soon.
┌──(teacher㉿carder)-[~]
└─[07:22:17 PM]─$ ls /boot
config-5.10.0-kali6-amd64 initrd.img-5.10.0-kali6-amd64 System.map-5.10.0-kali7-amd64
config-5.10.0-kali7-amd64 initrd.img-5.10.0-kali7-amd64 vmlinuz-5.10.0-kali6-amd64
efi lost+found vmlinuz-5.10.0-kali7-amd64
grub System.map-5.10.0-kali6-amd64
/dev
Contains all device files. Almost all hardware components - such as the serial interface or a hard disk partition - are accessed via so-called device files. These are set up dynamically by the udev-system. With most distributions, the /dev directory is located in a RAM disk, which means that the contents of the directory are not retained when the computer is rebooted.
You can use the df command to list all your devices. df not only shows you the device, but also shows the size, used memory, available memory, usage in % and where it was mounted.
For space reasons I will only give the command here.
┌──(teacher㉿carder)-[~]
└─[07:29:16 PM]─$ df -h
/etc
Contains configuration files for the whole system. Within /etc there are a lot of subdirectories that organize the configuration files into groups — e.g. /etc/apt for files of the package management system apt.
┌──(teacher㉿carder)-[~]
└─[07:34:27 PM]─$ ls /etc/apt/sources.list.d/ | grep -v ".save"
anydesk-stable.list
checkra1n.list
docker.list
freedownloadmanager.list
malteworld-ubuntu-ppa-impish.list
mattrose-ubuntu-terminator-hirsute.list
metasploit-framework.list
ondrej-ubuntu-php-hirsute.list
opera-stable.list
spotify.list
sublime-text.list
teamviewer.list
vscode.list
whonix.list
┌──(teacher㉿carder)-[~]
└─[07:35:21 PM]─$ cat /etc/apt/sources.list.d/checkra1n.list
deb https://assets.checkra.in/debian/
/home
Contains the home directories of all regular Linux users. The home directory is the directory in which the user is automatically located after logging in and to whose files he has unrestricted access rights. A special case is root, as so often: Its home directory is /root.
To move quickly in the home directory, there is a tilde character that you can use.
cd ~
cd ~/Desktop/
cd ~/Documtents/
If you don't use this, you have to go back to the main directory and execute the command again manually.
/lib[64]
Contains some shared libraries or symbolic links to them. The files are needed for the execution of programs. /lib/modules contains kernel modules that are dynamically activated or deactivated during operation. Other libraries contain the firmware of various hardware components (e.g. wlan-controller).
On current distributions, /lib is a link to/usr/lib. This means that all libraries are stored centrally in the /usr directory.
/lost+found
Only exists in ext file systems. The directory is usually empty. If it does contain files, then they are file fragments that could no longer be allocated when fsck attempted to repair the file system. In other words, sectors were found, but it is unclear to which file the sector once belonged. Instead of simply deleting such file fragments, fsck copies them to the lost+found directory.
fsck is automatically executed during system startup if Linux was not shut down properly (power failure, crash, etc.) or if the file system has not been checked for a long time. The goal of fsck is to restore the file system to a well-defined state.
/media
Contains subdirectories like cdrom or <usb-name> where external file systems are mounted. Traditionally, /mnt was common for this, but in recent years /media and finally the directory /run/media/<benutername>/<filecarrier-name> have become popular instead.
/opt
Is intended for add-on packages, but is rarely used by common distributions - probably because it is unclear how add-on packages differ from normal packages.
Some use this file path for Github repositories
/proc
Contains subdirectories for all running processes. These are not real files! The /proc directory merely reflects the Linux-internal administration of the processes.
/root
Contains the files of the root user, i.e. the system administrator.
/run
Contains files with the process IDs and other information of some system services for many current distributions. In the past, these files were stored in the /var/run directory.
The /run/lock/ subdirectory contains locking files. For example, you may have noticed that if you run apt update or apt upgrade and try to install another package, it will not work because it is locked. On older distributions, you will find the locking files in /var/lock instead.
With many distributions, either the entire /run directory or at least individual /run subdirectories are stored in a RAM disk. The mostly very small files in /run are thus never physically stored on a hard disk or SSD and are lost when the computer is rebooted.
/sbin
Contains commands for system administration. A common feature of all programs stored in it is that they may only be executed by root. In modern distributions, /sbin is a link from /usr/sbin. All system administration commands are now in /usr/sbin.
/share
Sometimes contains architecture-dependent files, i.e. files that are independent of the processor. The correct location is actually /usr/share.
/srv
Contains data for server processes in some distributions (Fedore, RHEL), e.g. in /srv/www files of the web server or in /srv/ftp files of the FTP server.
/sys
Contains the sysfs file system. Like the proc file, it provides information about the state of the computer.
/tmp
Contains temporary files. However, temporary files are often stored in /var/tmp. An example of this would be /tmp/mozilla_mrblackx0/ where temporary downloads from Mozilla Firefox are stored.
/usr
Contains all application programs, the complete X system, the source codes to Linux etc. The contents of this directory usually change only during package installations and updates. The /var directory is intended for modifiable files. There are important sub directories which are as follows:
/usr/bin : Executable programs.
/usr/games : Games, possibly link to /usr/share/games.
/usr/include : C include files.
/usr/lib[64] : Various libraries, plus countless subdirectories for C compilers, various other programming languages, large program packages such as emacs or Latex, etc.
/usr/local : Applications and files that do not directly belong to the Linux distribution or were installed later.
/usr/sbin : Only programs executable by root.
/usr/share : Architecture independent data (e.g. emacs lisp files, ghostscript fonts etc.) documentation (/usr/share/doc).
/usr/src/ : Source code to Linux and possibly to other programs
/var
Contains mutable files. Important subdirectories include docker (docker files), lock (locking files to protect access to devices), log (logging files), mail (email files, often also in /var/spool/mail), mysql (MySQL database files), and spool (cached print files).
That's it, I know it dragged out but finally we got it. If there are questions come privately.
After all, it is important to know how your file system is structured to be able to use Linux properly.
