Module 3: Filesystem and Directory Structure - FHS, Inodes, Links & Storage

3.1 The Filesystem Hierarchy Standard (FHS)

Unlike Windows, which assigns separate drive letters (C:, D:) to physical partitions, Linux mounts all storage devices, memory spaces, and pseudo-interfaces into a single root tree denoted by a forward slash (/). The Filesystem Hierarchy Standard defines the designated purpose of each standard directory.

3.1.1 /, /home, /root

Directory	Standard Purpose	Typical Content
/	The single root of the entire filesystem hierarchy	Mount points for all physical and virtual filesystems
/home	Personal user directories and configuration files	/home/student, /home/alice (desktop, docs, dotfiles)
/root	Home directory for the root superuser account	Kept on root partition to allow emergency maintenance

3.1.2 /etc, /var, /usr, /opt

`System Configuration and Dynamic State`

/etc (Editable Text Configurations):Host-specific system configuration files. Contains static configs for network interfaces, DNS, daemons, user databases (/etc/passwd), and system services (/etc/systemd).
/var (Variable Data):Data expected to change continuously during normal operation. Houses system logs (/var/log), mail spools (/var/spool), database tables (/var/lib/mysql), and package caches.
/usr (User System Resources):Secondary hierarchy containing shareable, read-only user utilities and libraries. Includes user-level programs (/usr/bin), manual documentation (/usr/share/man), and shared libraries (/usr/lib).
/opt (Optional Third-Party Software):Add-on application software packages installed outside standard distribution package managers (e.g., Google Chrome, Slack, custom proprietary enterprise suites).

3.1.3 /bin, /sbin, /lib (Usr-Merge Architecture)

In modern Linux releases such as Ubuntu 24.04, the legacy split between root-level and user-level binaries has been consolidated via symbolic links:

`Binary and Library Placement`

/bin -> /usr/bin:Essential command binaries required for single-user mode and general user shells (e.g., bash, ls, cp, grep).
/sbin -> /usr/sbin:Essential system administration binaries intended for superuser execution (e.g., fdisk, iptables, reboot, ip).
/lib -> /usr/lib:Shared library images required by binaries in /bin and /sbin, along with kernel modules in /lib/modules.

3.1.4 /proc, /sys, /dev, /tmp

`Virtual Filesystems and Devices`

/proc (Process Information Pseudo-FS):A virtual filesystem generated in RAM by the kernel. Exposes running process tables (numbered directories matching PIDs) and hardware status (/proc/cpuinfo, /proc/meminfo).
/sys (Sysfs Kernel Subsystem Interface):A structured device tree exposing kernel device drivers, buses, power states, and plug-and-play hardware abstractions.
/dev (Device Nodes):Special files representing attached storage disks (/dev/sda, /dev/nvme0n1), terminals (/dev/tty), and character streams (/dev/null, /dev/urandom).
/tmp (Temporary Scratch Storage):World-writable directory for temporary files created by applications. Flushed automatically on system reboot or cleared periodically by systemd timers.

3.2 File Types and Inodes

The Unix philosophy states that "everything is a file". When an application interacts with a storage device, a network socket, or a hardware terminal, it uses standard file read and write system calls.

3.2.1 File Types: Regular, Directory, Device, Socket

The first character in the output of ls -l identifies the exact file type:

Indicator	File Type	Description	Example Location
-	Regular File	Standard text, executable binary, image, or archive data	/etc/hosts
d	Directory	A special file containing a list of filenames and inode numbers	/var/log
l	Symbolic Link	Pointer referencing another file path	/bin -> usr/bin
b	Block Device	Storage device transferring data in buffered blocks	/dev/sda
c	Character Device	Device transferring data unbuffered as raw byte streams	/dev/tty, /dev/null
s	Unix Domain Socket	Inter-process communication endpoint between local processes	/run/systemd/private
p	Named Pipe (FIFO)	Unidirectional first-in-first-out data pipe between programs	/run/systemd/initctl

3.2.2 Inodes and Metadata Architecture

On Linux filesystems (ext4, XFS), an inode (index node) is an internal data structure storing all attributes of a file except its name and actual content data blocks:

`What is Stored in an Inode?`

File Attributes:Size in bytes, owner UID, group GID, and permission mode bits (e.g., 0755).
Timestamps:Access time (atime), modification time (mtime), and inode change time (ctime).
Link Count:The number of directory directory entries (hard links) pointing to this inode.
Data Block Pointers:Direct and indirect pointers to physical storage sectors where the file bytes are stored on disk.
What is NOT in the Inode:The file name! File names are stored exclusively inside directory data tables, which map a string name to an inode integer.

3.2.3 File Extensions vs File Types

Unlike Windows, the Linux kernel does not rely on file extensions (like .exe or .txt) to determine file behavior or execution rights. A script without an extension will execute normally if its execute bit (+x) is set. Use file <filename> to detect format through magic numbers embedded in file headers.

3.3 Searching for Files

Modern operating systems contain hundreds of thousands of files. Locating specific files by metadata, modification time, or embedded text strings is a primary administrative task.

3.3.1 The find Command: Search by Name, Type, Size, and Time

`Practical find Command Patterns`

By Name (Case-Insensitive):find /var/log -iname "*.log" finds all log files regardless of capitalization.
By File Type:find /etc -type f searches only regular files, while find /etc -type d searches directories.
By Size:find /var -size +100M locates files strictly larger than 100 megabytes (use -size -10k for files under 10 kilobytes).
By Modification Time:find /home -mtime -7 finds files modified within the past 7 days (use -mmin -30 for the past 30 minutes).
By Permissions:find /var/www -perm 777 audits files configured with full world-writable permissions.

3.3.2 locate and updatedb

While find performs a live filesystem walk (which can be I/O intensive across large disks), locate queries an indexed database (/var/lib/mlocate/mlocate.db) returning matches instantly:

`Fast Index Searching`

locate nginx.conf:Instantly returns all indexed paths containing nginx.conf across the storage volume.
sudo updatedb:Manually triggers the mlocate background crawler to index newly added or renamed files before the daily cron task runs.

3.3.3 Executing Actions: find with -exec and xargs

`Processing Search Results`

find with -exec:Executes a command against each match directly: find /tmp -type f -mtime +14 -exec rm {} \; (replaces {} with the found file path).
Safe Batching with xargs:Piping results through xargs bundles multiple file arguments into single command invocations for efficiency: find . -name "*.bak" -print0 | xargs -0 rm (the -print0 and -0 flags handle spaces in filenames safely).

3.3.4 Searching File Content with grep -r

When searching inside text files rather than searching for filenames, use recursive grep:

`Recursive Content Searching`

grep -rn "listen 80" /etc/nginx/:Recursively (-r) searches all files in the directory, printing file paths with line numbers (-n).
grep -rnI "error" /var/log/:The -I flag automatically skips binary files, preventing terminal pollution from compressed or compiled data.

3.4 Hard Links and Symbolic Links

Linux provides two distinct methods to reference a file under multiple names or locations: hard links and soft (symbolic) links.

3.4.1 Creating Links: ln and ln -s

`Link Creation Commands`

Hard Link: ln source target:Creates a new directory entry pointing to the existing file inode (e.g., ln document.txt hardlink.txt).
Symbolic Link: ln -s source target:Creates a new small file of type l containing the path string of the target (e.g., ln -s /etc/nginx/sites-available/app /etc/nginx/sites-enabled/app).

3.4.2 Hard vs Soft Links Comparison

Feature	Hard Link (ln)	Symbolic Link (ln -s)
Inode Number	Shares the exact same inode as the source file	Allocates a separate unique inode
Cross-Filesystem	No. Restricted to the same filesystem partition	Yes. Can span across distinct mount points and drives
Link to Directories	No. Forbidden to prevent infinite filesystem loops	Yes. Can link directories normally
Original File Deleted	Data remains accessible; inode link count decrements	Link breaks (dangling symlink); target becomes missing

3.4.3 Broken Links and How to Fix Them

When the target of a symbolic link is moved or deleted, the link becomes a broken (dangling) link. Identify and clean them using find:

`Auditing Dangling Symlinks`

find . -xtype l:Scans for and prints all broken symbolic links in the current directory tree.
find . -xtype l -delete:Automatically removes dangling symbolic link pointers without touching valid files.

3.5 Disk Usage and Storage Analysis

Running out of storage or exhausting available inode tables crashes critical server services. System administrators track space per filesystem and per directory regularly.

3.5.1 df -h: Free Space per Filesystem

The df (disk free) utility inspects mounted filesystems:

`Filesystem Monitoring with df`

df -h:Displays total size, used space, available space, and mount points in human-readable gigabytes and megabytes.
df -i:Displays inode usage rather than byte usage. If a server reaches 100% inode capacity (common with millions of tiny session files), new files cannot be created even with gigabytes of free disk space.

3.5.2 du -sh: Directory Space Consumption

`Directory Auditing with du`

du -sh /var/log:Prints a summary (-s) human-readable (-h) total of space consumed by the target directory tree.
du -h --max-depth=1 /var:Lists individual folder footprints one level below /var to isolate where space is consumed.

3.5.3 Finding the Biggest Files and Folders

When diagnosing an alert for 95% disk usage, combine du, sort, and head to identify culprits:

`One-Liner Disk Triage`

du -ah /var | sort -rh | head -n 10:Calculates all file and directory sizes, sorts in reverse numeric order (largest first), and displays the top 10 space consumers.
find / -xdev -type f -size +500M:Finds files larger than 500MB while staying strictly on the root filesystem (-xdev prevents scanning remote NFS mounts).

3.5.4 Block Devices and Interactive Profiling: ncdu and lsblk

`Hardware and Interactive Profilers`

lsblk:Prints a clean tree visualization of physical block storage devices, partitions, RAID arrays, and LVM logical volumes.
lsblk -f:Adds filesystem types (ext4, xfs, swap) and filesystem UUID identifiers to the device tree.
ncdu dirname:NCurses Disk Usage, an interactive terminal UI allowing administrators to navigate large directory trees and delete space-wasting items with arrow keys.

3.6 Archives and Compression

In Linux, archiving (bundling multiple files and permission metadata into a single container) and compression (reducing byte footprint with algorithms) are modular, separate operations frequently combined together.

3.6.1 The tar Utility: Create, List, and Extract

The tar (tape archive) program bundles entire folder structures while preserving owner, group, permission bits, and directory hierarchy:

Operation	Tar Flag	Command Example	Explanation
Create	-c	tar -cvf backup.tar /etc	Creates a new uncompressed archive file
List	-t	tar -tvf backup.tar	Lists contents of an archive without extracting
Extract	-x	tar -xvf backup.tar -C /tmp	Extracts archive files into the target destination (`-C`)

3.6.2 Compression Tools: gzip, bzip2, xz, zip

`Algorithm Trade-Offs`

gzip (.gz, flag -z):Fastest compression and decompression speed with moderate space savings. The standard default for software packaging.
bzip2 (.bz2, flag -j):Slower compression speed with superior ratio compared to gzip.
xz (.xz, flag -J):Highest compression ratio for Linux kernel sources and major distribution releases; requires higher CPU overhead.
zip / unzip:Standard format for interoperability when exchanging files with Windows and macOS users.

3.6.3 Extracting .tar.gz Step by Step

When downloading source tarballs or application releases, follow standard inspection and extraction steps:

`Safe Tarball Workflow`

1. Inspect without extracting:Run tar -tzf app-1.0.tar.gz | head -n 20 to verify whether the archive extracts cleanly into a subfolder or dumps files directly.
2. Extract to current directory:Run tar -xzvf app-1.0.tar.gz (flags: -x extract, -z gzip, -v verbose file list, -f filename).
3. Extract to a custom path:Run tar -xzvf app-1.0.tar.gz -C /opt/my-app to route output directly to the destination.

3.6.4 Synchronizing and Backups with rsync

The rsync utility provides delta-transfer synchronization, copying only bytes that changed since the previous backup run:

`Production rsync Best Practices`

rsync -avz /src/ /backup/:Archive mode (-a preserves permissions, owners, symlinks, and timestamps), verbose (-v), and compressed transfer (-z).
The Trailing Slash Rule:A trailing slash on the source (/src/) copies the contents of the directory. Leaving off the slash (/src) copies the directory itself.
Dry-Run Safety Testing:Always run with --dry-run first when using --delete: rsync -avz --dry-run --delete /src/ /backup/ to preview deletions before execution.

Knowledge Check: Module 3 Filesystem and Directory Structure

1. What is stored inside a Linux inode structure?

2. Which command searches filenames using a prebuilt indexed database?

3. What happens to a hard link when the original source file is deleted?

4. Which flag makes du display human-readable file sizes?

5. Which directory contains virtual files exposing live kernel state?

6. Which tar flags extract a compressed .tar.gz archive?

Previous Next