The ls Command

ls - a hands-on Linux lab on a real virtual machine.

Map every file, directory, and hidden asset using nothing but ls and its flags. 10 hands-on tasks on a real Linux VM.

You just landed on a Linux box. Callsign: recon-base. Intel says a classified dossier is stored somewhere in this folder. Your only tool is ls, two letters that mean "list."

There is no mouse here. No icons. Just a blinking cursor, and a folder that is about to lie to your face.

The black boxes in this lesson are a practice terminal. It is a safe sandbox that only checks the one command each step teaches, so you cannot break anything. At the end you launch a real Linux machine and run the full mission there.

Type this exact command in the practice terminal and press Enter:

ls ~/recon-base/

prompt: student@linuxcamp:~$ answer: ls ~/recon-base/ output: broken-link comms documents intel latest-briefing logs ops hint: Type ls, then a space, then the path. Like this: ls ~/recon-base/

Seven names. Count them again: seven.

But the mission brief says a classified dossier lives in this exact folder, and it is not in that list. The folder is hiding something from you. In a few steps you will catch it red-handed.

ls shows you the names of everything in a folder. On Linux, a folder is called a directory. The two words mean the same thing.

The part after the command, ~/recon-base/, is a path: the address of a folder. The ~ is a shortcut that means "my home folder."

Your terminal is always sitting inside some directory. You cannot see what is around you until you look, and ls is how you look.

This one command is the most-typed command on Linux. Engineers reach for it dozens of times a day, the way you check your mirrors while driving.

A quick bit of history, because it makes the name stick.

ls was born at Bell Labs in 1971. Ken Thompson was building the very first Unix, the operating system Linux is based on, and he wrote a tiny program to list files. He named it ls.

Thompson and Dennis Ritchie typed on painfully slow machines all day, so they kept command names short. That habit is why so many Linux commands are two or three letters.

The ls you are about to master has barely changed in over fifty years. It has outlived every computer it was written on.

The same two letters work on macOS and every flavor of Linux. Learn it once, use it everywhere.

Here is the trick the folder played on you. On Linux, any file or folder whose name starts with a dot (.) is hidden. Plain ls skips hidden items completely. They are not deleted. They are just invisible until you ask.

The -a flag stands for "all." It forces ls to show everything.

Before you run it, commit to a guess: recon-base showed seven names. How many will -a reveal?

ls -a ~/recon-base/

prompt: student@linuxcamp:~$ answer: ls -a ~/recon-base/ output: . .. .classified broken-link comms documents intel latest-briefing logs ops hint: Put the flag between ls and the path. Like this: ls -a ~/recon-base/

Ten. There it is: .classified, the dossier, sitting in that folder the entire time. One dot at the front of its name was all it took to vanish from plain ls.

What is inside it stays sealed until you are on the real machine. The two other new entries, . and .., are stranger than they look, and they are next.

Every single directory on Linux contains these two entries:

. means "this folder" (the one you are looking at right now)
.. means "the parent folder" (one level up)

They are how the system finds its way up and down the folder tree. You will use .. constantly once you learn the cd command in a later lesson.

Plain ls shows only names. Add -l (a lowercase L) and you get the detailed view: permissions, owner, size, date, and name for every item.

-l is called a flag. Flags change how a command behaves. They go after the command name, before the path.

Aim it at the documents folder:

ls -l ~/recon-base/documents/

prompt: student@linuxcamp:~$ answer: ls -l ~/recon-base/documents/ output: total 20 -rw-r--r-- 1 student student 512 Jun 15 09:30 after-action-report.txt -rw-r--r-- 1 student student 384 Jun 15 09:30 equipment-list.txt -rw-r--r-- 1 student student 640 Jun 15 09:30 mission-brief.txt -rw-r--r-- 2 student student 256 Jun 15 09:30 roster-backup.txt -rw-r--r-- 2 student student 256 Jun 15 09:30 roster.txt hint: Put the -l flag between ls and the path. Like this: ls -l ~/recon-base/documents/

The first character of each line is the quickest tell: a dash (-) means a regular file, a d means a directory.

Now look closer. The number right after the permissions is 1 on most lines, but roster.txt and roster-backup.txt both say 2. That column counts how many names point at a file. Two names, one file? Hold that thought. You will prove it before this lesson ends.

You can stack flags after a single dash. -la runs -l (details) and -a (hidden) in one shot. The letter order does not matter: -la and -al are identical.

This is the most useful form of ls. Many engineers type it by pure habit.

ls -la ~/recon-base/

prompt: student@linuxcamp:~$ answer: ls -la ~/recon-base/ output: total 40 drwxr-xr-x 8 student student 4096 Jun 15 09:30 . drwxr-xr-x 3 root root 4096 Jun 15 09:30 .. drwxr-xr-x 2 student student 4096 Jun 15 09:30 .classified lrwxrwxrwx 1 student student 17 Jun 15 09:30 broken-link -> /tmp/deleted-file drwxr-xr-x 2 student student 4096 Jun 15 09:30 comms drwxr-xr-x 2 student student 4096 Jun 15 09:30 documents drwxr-xr-x 2 student student 4096 Jun 15 09:30 intel lrwxrwxrwx 1 student student 52 Jun 15 09:30 latest-briefing -> /home/student/recon-base/documents/mission-brief.txt drwxr-xr-x 2 student student 4096 Jun 15 09:30 logs drwxr-xr-x 5 student student 4096 Jun 15 09:30 ops hint: Combine both flags after one dash. Like this: ls -la ~/recon-base/

Full details plus hidden files in one command. You will type this one in your sleep before long.

The lines starting with l are symbolic links: shortcuts that point at another file. The arrow shows the target. latest-briefing points at the mission brief. But look at broken-link: it points at /tmp/deleted-file, and that file is gone. Someone burned it. The shortcut still points at the ash.

With -l, sizes print in raw bytes. Numbers like 612000 make you stop and count digits. The -h flag means human-readable: it rewrites sizes into friendly units like 598K or 2.0M.

It only matters next to -l, since plain ls does not print sizes at all.

ls -lh ~/recon-base/logs/

prompt: student@linuxcamp:~$ answer: ls -lh ~/recon-base/logs/ output: total 680K -rw-r--r-- 1 student student 598K Jun 15 09:30 access.log -rw-r--r-- 1 student student 13K Jun 15 09:30 audit.log -rw-r--r-- 1 student student 42K Jun 15 09:30 auth.log -rw-r--r-- 1 student student 10K Jun 15 09:30 system.log hint: Add h next to l, so ls -lh, then point it at the logs folder.

Much kinder on the eyes. K is kilobytes, M is megabytes, G is gigabytes. From now on, whenever you reach for -l, consider bringing -h along.

By default ls sorts names alphabetically. The -S flag (a capital S) sorts by size instead, biggest first. This is how you find what is eating a folder alive.

You just saw the sizes in logs. Guess which file lands on top before you run it.

ls -lS ~/recon-base/logs/

prompt: student@linuxcamp:~$ answer: ls -lS ~/recon-base/logs/ output: total 680 -rw-r--r-- 1 student student 612000 Jun 15 09:30 access.log -rw-r--r-- 1 student student 42000 Jun 15 09:30 auth.log -rw-r--r-- 1 student student 12500 Jun 15 09:30 audit.log -rw-r--r-- 1 student student 10200 Jun 15 09:30 system.log hint: Combine -l and a capital S. Like this: ls -lS ~/recon-base/logs/

Called it? access.log jumps straight to the top at 612000 bytes. Whenever a disk fills up on a real server, ls -lS is one of the first moves an engineer makes.

So far you have looked at one folder at a time. The -R flag stands for recursive: it lists the folder, then every folder inside it, all the way down.

The ops folder holds the operation plans. Map the whole tree:

ls -R ~/recon-base/ops/

Aim -R at a specific folder. On a real server, ls -R / would flood your screen for minutes.

prompt: student@linuxcamp:~$ answer: ls -R ~/recon-base/ops/ output: /home/student/recon-base/ops/: plan-alpha plan-bravo plan-charlie run-scan.sh

/home/student/recon-base/ops/plan-alpha: 'mission log.txt' objectives.txt timeline.txt

/home/student/recon-base/ops/plan-bravo: objectives.txt resources.txt

/home/student/recon-base/ops/plan-charlie: contingency.txt objectives.txt hint: Use a capital R and point it at the ops folder. Like this: ls -R ~/recon-base/ops/

One command walked three operation plans. Notice 'mission log.txt' printed in quotes: that file has a space in its name, so ls quotes it to show you where the name really starts and ends. Spaces in filenames cause endless trouble, and those quotes are your warning.

The -F flag appends a small symbol to each name so you can tell what it is without the full -l view:

ls -F ~/recon-base/

prompt: student@linuxcamp:~$ answer: ls -F ~/recon-base/ output: broken-link@ comms/ documents/ intel/ latest-briefing@ logs/ ops/ hint: Use a capital F with the recon-base path. Like this: ls -F ~/recon-base/

Five folders and two @ shortcuts, readable in a single glance. And remember the trailing bar from that table, the mark of a named pipe. You will hunt one down in a challenge shortly.

Time to settle the roster mystery from the -l step. Behind the scenes, Linux tracks every file by a number called an inode, short for index node. Think of it as the file's ID number.

The -i flag prints those numbers. If two names share one inode, they are the exact same file wearing two names. That is called a hard link. Like two contacts in your phone that both dial the same number.

ls -i ~/recon-base/documents/

prompt: student@linuxcamp:~$ answer: ls -i ~/recon-base/documents/ output: 262401 after-action-report.txt 262403 mission-brief.txt 262405 roster.txt 262402 equipment-list.txt 262405 roster-backup.txt hint: Add the -i flag and point it at the documents folder.

There is the proof: roster.txt and roster-backup.txt share inode 262405. Two names, one single file on disk. Edit one and the other changes too, because there is no other. That is a hard link, and you just exposed it with two letters.

The training wheels come off. From here, no command is shown. You know the flags.

Intel says one file in ~/recon-base/intel/ dwarfs everything else in the folder. Find it: you want the detailed view, human-readable sizes, and the biggest file on top, in one command.

prompt: student@linuxcamp:~$ answer: ls -lhS ~/recon-base/intel/ output: total 3.4M -rw-r--r-- 1 student student 2.0M Jun 15 09:30 encrypted-comms.bin -rw-r--r-- 1 student student 847K Jun 15 09:30 satellite-feed.jpg -rw-r--r-- 1 student student 512K Jun 15 09:30 threat-assessment.pdf -rw-r--r-- 1 student student 203 Jun 15 09:30 coordinates.csv -rw-r--r-- 1 student student 156 Jun 15 09:30 'data[2026].txt' hint: Three flags stacked after one dash: details, human sizes, sort by size. You used all three today.

Cracked it. encrypted-comms.bin at 2.0M is the heavyweight, two megabytes of intercepted traffic. And ls quoted data[2026].txt because brackets, like spaces, are special characters in names.

One more. Somewhere in ~/recon-base/comms/ hides something that is not a regular file: a live channel that programs use to talk to each other.

Tag every item in comms with its type symbol and find it.

prompt: student@linuxcamp:~$ answer: ls -F ~/recon-base/comms/ output: radio-log-day1.txt radio-log-day2.txt radio-log-day3.txt radio-log-day4.txt radio-log-day5.txt radio-pipe| hint: The flag that appends type symbols is a capital F.

Found it: radio-pipe|. That trailing bar marks a named pipe, a live channel where one program writes and another reads. Five ordinary radio logs, one open line. You will work with pipes properly later in the track.

You earned this cheat sheet. Every row is a flag you have already used:

Stack any of them after one dash, in any order. The grand combination is ls -lahR: details, hidden items, readable sizes, every subfolder. One line, a complete map of a filesystem. That one is waiting for you as the final task on the real machine.

If you memorize one thing from this lesson, make it ls -la. It shows everything, every time.

The sandbox is done lying to you. Time for a machine that does not pretend.

Launch the lab below: a real Linux VM, booted just for you. Ten objectives, and every one uses a flag you just ran. One difference: the lab shows no commands. You read the objective, you recall the flag, you type it. That recall is what makes it stick. Progress is tracked automatically, and signals are there if you need them.

The .classified dossier is on that machine, unsealed. Go read what you fought to find.

Practice The ls Command in a real Linux terminal at The Linux Camp. Progress is verified automatically as you type commands on the machine.