Skip to content

Beginner · Linux and the shell · topic 4 of 57 · 35 min

Working with files: ls, cp, mv, rm, links and find

Explanation

ls lists files, mkdir and touch create them, cp copies, mv moves or renames, and rm deletes for good. ln makes hard and soft links. find searches the tree by name, size, owner or age, and can run a command on every match.

Listing files

bash
$ ls -l /etc/hosts
-rw-r--r--. 1 root root 158 Jun 23  2020 /etc/hosts
$ ls -la ~
drwx------. 3 asha asha  95 Oct 19 10:01 .
drwxr-xr-x. 4 root root  32 Oct 18 09:12 ..
-rw-------. 1 asha asha 512 Oct 19 10:05 .bash_history
-rw-r--r--. 1 asha asha  18 Oct 18 09:12 .bash_profile
drwxr-xr-x. 2 asha asha   6 Oct 19 10:01 reports
Files whose names start with a dot are hidden; -a shows them. -l shows the long form.

In the long form, the first letter is the type: - for a normal file, d for a directory, l for a symbolic link. Then come the permissions (next module), the link count, the owner, the group, the size, the date changed, and the name. Useful options: -h (sizes like 1.2M), -t (newest first), -r (reverse), -R (recursive), -d (the directory itself, not its contents).

Creating, copying, moving, deleting

bash
$ mkdir -p projects/2026/reports    # -p also creates the missing parent folders
$ touch notes.txt                   # creates an empty file (or updates its time)
$ cp notes.txt notes.bak            # copy a file
$ cp -r projects projects-old       # copy a directory and everything inside (-r = recursive)
$ cp -a /etc/ssh /root/ssh-backup   # -a = archive: keep owners, permissions, times
$ mv notes.bak old-notes.txt        # rename
$ mv old-notes.txt projects/        # move into a directory
$ rm projects/old-notes.txt         # delete a file
$ rmdir projects/2026/reports       # delete an EMPTY directory
$ rm -r projects-old                # delete a directory and all inside it
Careful: rm has no recycle bin. rm -rf removes everything under a path without asking. A space in the wrong place, like rm -rf / home/asha/tmp instead of /home/asha/tmp, can destroy the whole system. Read the command twice. Use rm -i (ask before each delete) when unsure.

Wildcards (globbing) let one name match many files. The shell expands them before the command runs: * matches anything, ? matches one character, and [abc] matches one of those characters. ls *.log lists all files ending in .log; rm report?.txt removes report1.txt to report9.txt. Braces make lists: mkdir dir{1..3} creates dir1, dir2 and dir3.

A file's data lives in an inode, a record on disk with the owner, permissions and where the data blocks are. A filename is just a pointer to an inode. A hard link is a second name for the same inode: both names are equal, and the data stays until the last name is deleted. A symbolic link (symlink, soft link) is a small file that holds a path to another file, like a shortcut.

bash
$ ln report.txt report-hard.txt          # hard link
$ ln -s /var/log/httpd logs              # symbolic link named "logs"
$ ls -li report.txt report-hard.txt logs
33575012 -rw-r--r--. 2 asha asha 120 Oct 19 10:30 report.txt
33575012 -rw-r--r--. 2 asha asha 120 Oct 19 10:30 report-hard.txt
33575019 lrwxrwxrwx. 1 asha asha  14 Oct 19 10:31 logs -> /var/log/httpd
Same inode number (33575012) and link count 2 for the hard link. The symlink shows -> and its target.
Hard linkSymbolic link
Points toThe inode (the data itself)A path (a name)
Works for directoriesNoYes
Works across file systemsNo, same file system onlyYes
If the original is deletedData still there through the other nameLink breaks (dangling)

find: searching the tree

bash
$ find /etc -name "*.conf"                 # by name (quote the pattern!)
$ find /home -user asha                    # owned by asha
$ find /var/log -size +100M                # bigger than 100 MiB
$ find /tmp -mtime +7                      # changed more than 7 days ago
$ find / -perm -4000 -type f 2>/dev/null   # files with the SUID bit; hide errors
$ find /home -user asha -exec cp -a {} /root/asha-files/ \;
-exec runs a command on each match; {} is the match and \; ends the command.

find searches live, so it is slow on a whole disk but always current. locate (from the mlocate/plocate package) searches a database and is fast but may be out of date until updatedb runs.

Common mistakes

  • find /etc -name *.conf without quotes: the shell expands *.conf in your current directory first, and find gets the wrong pattern. Always quote.
  • cp -r instead of cp -a when backing up config: you lose the owner and permissions. Use -a for backups.
  • Making a symlink with a relative target from the wrong directory, so it points nowhere. ls -l shows the target; check it.
Tip: Before any rm with a wildcard, run the same pattern with ls first: ls /tmp/*.log. If the list is right, press the up arrow and change ls to rm.

Need help?

Stuck on a word or an idea? Search this course, or every course, and jump straight to the explanation or a worked question.

Try:

Watch the lesson

Working with files: ls, cp, mv, rm, links and find · 1/7

Files

In this lesson you will create, copy, move, delete and find files.

Prefer a video by a teacher? Find free videos on “linux cp mv rm find command hard link soft link tutorial” on YouTube ↗

In real life: Cleaning old reports at a GST filing office

A tax-filing firm in Delhi generates PDF reports on a RHEL server every night. The disk fills up every quarter. The admin first lists reports older than 90 days, checks the list, and then moves them to an archive disk instead of deleting them, because clients sometimes ask for old reports.

bash
$ find /srv/reports -name "*.pdf" -mtime +90 | wc -l
1843
$ mkdir -p /archive/reports
$ find /srv/reports -name "*.pdf" -mtime +90 -exec mv {} /archive/reports/ \;
$ df -h /srv
Filesystem              Size  Used Avail Use% Mounted on
/dev/mapper/vgdata-srv   50G   21G   30G  42% /srv

Practice (0/3 done)

Task 1 · Question

What does mv report.txt final.txt do?

Task 2 · Question

Which line has the bug? (Goal: find all .conf files under /etc.) 1: cd /home/asha 2: find /etc -name *.conf 3: echo done

Task 3 · Practice

In your lab: create ~/lab/{a,b,c}, put a file in each, make a hard link and a symlink to one file, then use find to list every file in ~/lab owned by you and changed in the last day.

Quick quiz

Question 1

1.Which command copies the folder /etc/ssh with all owners and permissions kept?

Question 2

2.You delete the original file. Which kind of link still shows the data?

Question 3

3.Which find option matches files bigger than 1 GiB?

Question 4

4.Which directory listing type letter means a symbolic link?

Question 5

5.What does mkdir -p a/b/c do when a does not exist?

Read more (free)

Before this, learn

This topic builds on these. If something here feels new, open them first.

Open a question to see the answer and why. The first ones are this topic's own quiz, so try the quiz above before you peek.

Which command copies the folder /etc/ssh with all owners and permissions kept?

Answer: cp -a /etc/ssh /backup

-a (archive) copies recursively and keeps owner, permissions and times.

You delete the original file. Which kind of link still shows the data?

Answer: Hard link

A hard link points to the same inode, so the data stays until the last name is removed.

Which find option matches files bigger than 1 GiB?

Answer: -size +1G

-size +1G means larger than 1 GiB.

Which directory listing type letter means a symbolic link?

Answer: l

l = link, d = directory, - = regular file.

What does mkdir -p a/b/c do when a does not exist?

Answer: Creates a, a/b and a/b/c

-p creates every missing parent directory.

What does mkdir -p /opt/app/releases/v2 do if /opt/app does not exist yet?Related

Answer: Creates all missing folders in the path

The -p flag creates every missing parent folder and does not complain if they exist.

From The Linux filesystem and everyday commands

A file moved with mv from /home/asha to /var/www/html gives 403. Why?Related

Answer: mv keeps the old user_home_t label

Moved files keep their context; run restorecon.

From Contexts and file labels: ls -Z, semanage fcontext and restorecon

Why do many apps use a soft delete (is_active = 0) for customers?Related

Answer: Old orders, invoices and audits still need the row

The row is hidden from normal use but kept for history.

From UPDATE and DELETE safely

Which command shows the ACL of a file?Related

Answer: getfacl

getfacl prints all ACL entries.

From Access control lists (ACLs)

Pass the quiz (60% or more) or mark this topic as done when you are ready.

Your progress is saved on this device only.

Next: Reading text: grep, less, pipes and redirection →

Next steps

  1. 2 more topics in “Linux and the shell” before its exam: Reading text: grep, less, pipes and redirection, Editing files with vim.
  2. Module 1 exam: Linux and the shell · 13 questions · 20 min, without help. 6 topics of this module still to finish first.
  3. Then the next module, Permissions, users and sudo. 57 topics left in the course before the final exam.

← Previous: Shell basics and getting help