Learn › Linux Foundations › Reading Files
Final test: Chapter 5, Reading Files. Twenty-five objectives on a real Debian 12 server covering both parts: cat, tac, head, tail, less, more and wc, then file, stat, du, df, hexdump and xxd. Fifty minutes, graded from the commands you run.
A service has produced a file you do not recognize, and its disk is getting full. Before opening or deleting anything, you need to answer three questions: what might this file contain, how much space does it use, and how much space is available?
Part 1 taught tools for reading text. This part connects those observations to file types, metadata and storage. You will identify sample files with file, inspect their metadata with stat, compare space with du and df, and examine bytes with hexdump and xxd. The final Test Room covers both parts.
What you already know: Part 1 used cat, tac, head, tail, less and more to read text files, and measured them with wc. Those tools process bytes even when a file is not text, but printing arbitrary bytes may be hard to interpret or disrupt a terminal. This part starts by identifying what a file may contain.
Objectives
After this part you can:
Before you start a machine, each exercise shows a rehearsal terminal. It checks the requested command against an example and does not change Linux files. Start one real practice machine and use its admin@server1 shell across these steps. Commands run there, and a wrong command still runs even if the lesson does not mark the exercise complete.
The final Test Room starts a separate Debian 12 server with the files for both parts of this chapter and checks its objectives automatically as you work.
Five questions before the material. A wrong answer costs nothing: the explanation states the fact and names the section that teaches it.
>>> The name can be misleading. The bytes must follow an image format for an image reader to use them. The file command can recognize clues in those bytes; its classification does not validate the whole image. Section 5.8.
>>> stat prints the status of a file, the facts the system keeps about it, and never its contents. cat and less print contents; wc counts them. Section 5.9.
>>> df reports filesystem space. du walks the directories you name and reports their disk usage. Start with the filesystem, then investigate the directories on it. Sections 5.10 and 5.11.
>>> Each row of a dump shows the same bytes twice: as hexadecimal numbers in the middle and as characters on the right. A byte that is not a printable character shows as a dot. Section 5.12.
>>> Every file is a sequence of bytes, and every byte is a number from 0 to 255. Text files are bytes that stand for characters; other files are bytes that stand for something else. Section 5.1 defined the byte and Section 5.12 shows bytes one by one.
On Linux the ending of a file name, .txt, .png, .gz, is a convention and not proof of its contents. Renaming a file changes its name and not one byte inside it, so inspect more than the ending when the type matters.
file examines a path and reports the kind it can identify. Many formats have identifying bytes called a signature, or magic number; file can also use other tests and report a symbolic link itself. Its answer is evidence, not a guarantee about every byte or a file's safety. For text it may report the kind of text. The ordinary file commands in this chapter classify the sample files without running them. Other options may inspect compressed contents; no classification proves a file is safe.
You are in your home directory. The samples directory inside reference holds one file of each kind. List reference/samples in long form first, with ls from Section 2.4:
prompt: admin@server1:~$ answer: ls -l reference/samples ||| ls -l reference/samples/ ||| ls -l ~/reference/samples output: total 20 -rw-r--r-- 1 admin admin 337 Jan 15 2026 archive.tar.gz -rw-r--r-- 1 admin admin 64 Jan 15 2026 cache.bin -rwxr-xr-x 1 admin admin 116 Jan 15 2026 check.sh -rw-r--r-- 1 admin admin 0 Jan 15 2026 empty.txt lrwxrwxrwx 1 admin admin 10 Jan 15 2026 link-to-readme -> readme.txt -rw-r--r-- 1 admin admin 70 Jan 15 2026 logo.png -rw-r--r-- 1 admin admin 162 Jan 15 2026 readme.txt hint: Section 2.4. The listing command with its long option -l, then the path reference/samples (or ~/reference/samples from anywhere).
Seven entries. The long listing tells you their sizes, that check.sh is executable, and that link-to-readme is a symbolic link, a name that points at another file (Section 2.4), here readme.txt. It tells you nothing about what cache.bin or logo.png hold; a listing reads names and status, not contents.
You are in your home directory. Identify the plain text sample, reference/samples/readme.txt:
prompt: admin@server1:~$ answer: file reference/samples/readme.txt ||| file ~/reference/samples/readme.txt output: reference/samples/readme.txt: ASCII text hint: Section 5.8. The identifying command, then the path reference/samples/readme.txt (or ~/reference/samples/readme.txt from anywhere).
The path, a colon, and the answer: ASCII text. ASCII is the basic character set: the plain English letters, digits and punctuation, one byte each. A file made only of those is text for every tool in Part 1. file reached this answer by reading the bytes, not the .txt.
You are in your home directory. Identify the image, reference/samples/logo.png:
prompt: admin@server1:~$ answer: file reference/samples/logo.png ||| file ~/reference/samples/logo.png output: reference/samples/logo.png: PNG image data, 1 x 1, 8-bit/color RGBA, non-interlaced hint: Section 5.8. The same identifying command, then the path reference/samples/logo.png (or ~/reference/samples/logo.png from anywhere).
A PNG, a common image format, one pixel wide and one high. 8-bit/color RGBA means 8 bits for each of red, green, blue and alpha, which is transparency; non-interlaced means the image is stored in one pass from top to bottom. All of that came from the first 33 bytes of the file: the eight-byte PNG signature and the header that follows it. Section 5.12 shows those bytes.
An archive is one file that holds several files packed together, and the ending .tar.gz marks a compressed one. You are in your home directory. Identify reference/samples/archive.tar.gz:
prompt: admin@server1:~$ answer: file reference/samples/archive.tar.gz ||| file ~/reference/samples/archive.tar.gz output: reference/samples/archive.tar.gz: gzip compressed data, from Unix, original size modulo 2^32 10240 hint: Section 5.8. The same identifying command, then the path reference/samples/archive.tar.gz (or ~/reference/samples/archive.tar.gz from anywhere).
The file is recognized as gzip compressed data, and its header reports Unix as the source system. For this small prepared sample, 10240 is the uncompressed size in bytes. The phrase modulo 2^32 means this stored size wraps for large inputs; it is not a general guarantee of how much space extraction will need. This command classified the compressed file without unpacking it. That is a useful first inspection, not a safety check.
You are in your home directory. Identify the file whose name says nothing, reference/samples/cache.bin:
prompt: admin@server1:~$ answer: file reference/samples/cache.bin ||| file ~/reference/samples/cache.bin output: reference/samples/cache.bin: data hint: Section 5.8. The same identifying command, then the path reference/samples/cache.bin (or ~/reference/samples/cache.bin from anywhere).
One word: data. Here file did not identify a more specific format. It is not an error, and it does not prove the file has no structure. A hex dump in Section 5.12 can show its exact bytes and may provide a clue.
file accepts several paths and aligns its answers in a column. You are in your home directory. Identify reference/samples/check.sh, reference/samples/link-to-readme and reference/samples/empty.txt in that order:
prompt: admin@server1:~$ answer: file reference/samples/check.sh reference/samples/link-to-readme reference/samples/empty.txt ||| file ~/reference/samples/check.sh ~/reference/samples/link-to-readme ~/reference/samples/empty.txt output: reference/samples/check.sh: Bourne-Again shell script, ASCII text executable reference/samples/link-to-readme: symbolic link to readme.txt reference/samples/empty.txt: empty hint: Section 5.8. The identifying command, then the three paths in that order: reference/samples/check.sh reference/samples/link-to-readme reference/samples/empty.txt (each can be written ~/reference/samples/... from anywhere).
A shell script is a text file of commands for bash, here marked executable. The symbolic link is reported with the path it stores, because file reports the link itself rather than following it. empty is a file of zero bytes. These answers use the file's bytes and, for the link and empty file, information about the file entry itself.
The CSV exports in data from Chapter 2 are text too, and file can recognize their structure. You are in your home directory. Identify data/customers.csv:
prompt: admin@server1:~$ answer: file data/customers.csv ||| file ~/data/customers.csv output: data/customers.csv: CSV text hint: Section 5.8. The identifying command, then the path data/customers.csv (or ~/data/customers.csv from anywhere).
CSV text suggests comma-separated values, a plain-text table format used by spreadsheets. Part 1 tools can display its text. Inspect the actual header and records before deciding how to process it: this label does not prove the expected columns are present or that every record is valid.
Besides its contents, every file has metadata: facts the system keeps about the file rather than in it. Its size in bytes, what kind of thing it is, who owns it, who may read and write it, and when it was last changed. stat prints these facts, and never the contents. You are in your home directory. Print the status of reference/maintenance-log.txt:
prompt: admin@server1:~$ answer: stat reference/maintenance-log.txt ||| stat ~/reference/maintenance-log.txt output: File: reference/maintenance-log.txt Size: 7810 Blocks: 16 IO Block: 4096 regular file ... Access: (0644/-rw-r--r--) Uid: ( 1000/ admin) Gid: ( 1000/ admin) ... Modify: 2026-01-15 09:00:00.000000000 +0000 ... hint: Section 5.9. The status command, then the path reference/maintenance-log.txt and nothing else (or ~/reference/maintenance-log.txt from anywhere).
The lines to read. Size is 7810 bytes, the number wc -c gave in Section 5.7. Blocks is the disk space the file occupies, counted in units of 512 bytes: 16 of them are 8K, the figure Section 5.10 reports for this file. regular file is the kind: an ordinary file, as opposed to a directory or a symbolic link.
Access: (0644/-rw-r--r--) is the permissions, the same nine characters ls -l shows. They come in three groups of three, for the owner, the group and everyone else; r, w and x grant read, write and run, and a dash withholds that right. Uid and Gid name the owner and the group, both admin. Modify is the recorded modification time for the contents.
The ... marks omitted lines in this recorded example. Your output also includes device and inode numbers and other timestamps. Access records a read time, but filesystem settings can delay or skip updates. Change records changes to file status, including writes and permission changes. Birth, when available, records creation; a dash means it is unavailable.
Use Modify as a clue when investigating an edit, not proof on its own. Programs can preserve or deliberately set that timestamp. Compare the relevant contents when you need to establish what changed.
The -c option, followed by a format, prints only what you ask for. A format is a string in which a percent sign and a letter stand for one field. %s is the size in bytes, %F the kind of file, %U the owner, %y the modification time, %n the name. You are in your home directory. Print only the size of reference/maintenance-log.txt:
prompt: admin@server1:~$ answer: stat -c %s reference/maintenance-log.txt ||| stat -c "%s" reference/maintenance-log.txt ||| stat -c '%s' reference/maintenance-log.txt ||| stat --format=%s reference/maintenance-log.txt ||| stat -c %s ~/reference/maintenance-log.txt ||| stat -c '%s' ~/reference/maintenance-log.txt output: 7810 hint: Section 5.9. The format option -c, then the size code %s, then the path reference/maintenance-log.txt (or ~/reference/maintenance-log.txt from anywhere).
One number and nothing else, the shape a script or a quick comparison wants. It is the third number of wc, the Size of the full status, and the size column of ls -l, all reporting one fact.
The samples directory holds link-to-readme, the symbolic link from Exercise 5-21. You are in your home directory. Ask for the kind of reference/samples/link-to-readme:
prompt: admin@server1:~$ answer: stat -c %F reference/samples/link-to-readme ||| stat -c "%F" reference/samples/link-to-readme ||| stat -c '%F' reference/samples/link-to-readme ||| stat -c %F ~/reference/samples/link-to-readme ||| stat -c '%F' ~/reference/samples/link-to-readme output: symbolic link hint: Section 5.9. The format option -c, then the code for the kind of file, %F, then the path reference/samples/link-to-readme (or ~/reference/samples/link-to-readme from anywhere).
stat, like file, reports the link itself. Run on readme.txt it would say regular file, and on reference it would say directory. Chapter 6 makes links; here you only learn to recognize one.
A file's byte count and its allocated disk space can differ. In this prepared example, the 7810-byte maintenance log occupies two 4096-byte blocks, or 8192 bytes of disk space. Other filesystems and specially stored files can behave differently.
du, disk usage, adds up allocated space beneath the paths you name. With this lab's default settings, its numbers use units of 1024 bytes. It prints a total for each directory, including its contents. You are in your home directory. Report the usage of reference:
prompt: admin@server1:~$ answer: du reference ||| du reference/ ||| du ~/reference output: 24 reference/samples 44 reference hint: Section 5.10. The disk usage command with no option, then the directory reference (or ~/reference from anywhere).
In this recorded example, samples uses 24 units of 1024 bytes. The reference total is 44 units and already includes samples; do not add the two rows together. The total includes allocated space for files and directories. Your numbers can differ with filesystem allocation or changes to the files. Compare that meaning with stat Size, which counts the file's bytes.
The -h option means the same as it did for ls in Section 2.4: sizes in K, M and G. You are in your home directory. Report the usage of reference again:
prompt: admin@server1:~$ answer: du -h reference ||| du -h reference/ ||| du -h ~/reference output: 24K reference/samples 44K reference hint: Section 5.10. The disk usage command with the human-readable option -h, then the directory reference (or ~/reference from anywhere).
The same two numbers with K after them. On a directory this small the option changes only the unit; on a directory of gigabytes it turns a long count into a short figure in M or G.
The -s option, summarize, prints one line for the directory you named and nothing for the directories inside it. With -h it is the form administrators type most. You are in your home directory. Report one total for reference:
prompt: admin@server1:~$ answer: du -sh reference ||| du -hs reference ||| du -sh reference/ ||| du -sh ~/reference ||| du -s -h reference output: 44K reference hint: Section 5.10. The summarize option and the human-readable option written together as -sh, then the directory reference (or ~/reference from anywhere).
One line, 44K. Given several directories, du -sh prints one total for each, which is how you find the directory that holds the most. The next exercise does that.
Given several directories, du prints one total for each. You are in your home directory. Compare logs, docs and website, in that order:
prompt: admin@server1:~$ answer: du -sh logs docs website ||| du -sh ~/logs ~/docs ~/website output: 1.1M logs 28K docs 132K website hint: Section 5.10. The same -sh options, then the three directories in that order: logs docs website (or ~/logs ~/docs ~/website from anywhere).
The logs use 1.1M, most of it the access log from Section 5.3; the docs use 28K; the website, releases included, 132K. When a disk fills up, du -sh on the suspect directories is the second command you run. The first is in the next section.
A filesystem organizes files and directories. It can use disk storage or, as with `tmp
Practice Chapter 5, Part 2. Reading Files: file, stat, du, df, hexdump and xxd in a real Linux terminal at The Linux Camp. Progress is verified automatically as you type commands on the machine.