Skip to main content

File Types

Introduction to the file Command​

The file command in Linux and Unix-based systems is used to determine the type of a file. It analyzes the file contents and provides information about its format, such as whether it's a text file, executable, image, compressed file, or something else. Unlike relying on file extensions, the file command inspects the file's magic number and structure to give an accurate identification.

Basic Usage of file Command​

To determine the file type, simply use the file command followed by the filename:

file filename

For example, running:

file example.txt

Will output something like:

example.txt: ASCII text

This indicates that the file is a text file, with no special encoding.

Common File Types Detected by file​

  • Text Files: Identifies plain text files, including files with specific encodings such as UTF-8.

    • ASCII text
    • UTF-8 Unicode text
    • ASCII text with CRLF line terminators (used by Windows)

  • Executable Files: Identifies executable files like binaries or scripts.

    • ELF 64-bit LSB executable
    • POSIX shell script, ASCII text executable

  • Image Files: Identifies image files such as PNG, JPEG, and GIF by inspecting their headers.

    • PNG image data, 800 x 600, 8-bit/color RGBA, non-interlaced
    • JPEG image data, JFIF standard 1.01
    • GIF image data, version 89a, 500 x 300

  • Audio and Video Files: Identifies media files such as MP3, WAV, and MPEG files.

    • MP3 audio file
    • WAVE audio file, version 1
    • MPEG sequence, version 2

  • Compressed Files: Identifies compressed files based on their format.

    • gzip compressed data, deflate compression
    • bzip2 compressed data
    • XZ compressed data

  • Archive Files: Identifies archive formats like ZIP, TAR, and TAR.GZ.

    • Zip archive data, version 2.0
    • GNU tar archive
    • gzip compressed data, from Unix

Using the file Command with Multiple Files​

You can provide multiple file names to the file command to inspect several files at once. The command will display each file's type:

file file1.bin file2.jpg file3.zip

Example output:

file1.bin: data file2.jpg: JPEG image data, JFIF standard 1.01 file3.zip: Zip archive data, version 2.0

Displaying File Type with More Details​

You can use the -i option with the file command to get more detailed output, including MIME types:

file -i filename

For example:

file -i example.jpg

Output might be:

example.jpg: image/jpeg; charset=binary

Here, the MIME type image/jpeg indicates the file is a JPEG image, and charset=binary indicates it's a binary file.

File Command and Directory Traversal​

The file command can be used in conjunction with other tools like find to examine files across directories.

For example, to list and identify all files within a directory:

find /path/to/directory -type f -exec file {} ;

This will execute file on all files found by find, displaying the type of each.

Practical Applications​

  1. File Identification: Use file when you come across an unfamiliar file extension or if the file lacks an extension. It will help identify the actual content, ensuring that tools are used correctly.

  2. Security: Security professionals use file to analyze suspicious files. By determining whether the file is a valid executable or an attempted Trojan horse disguised as a harmless file, they can take necessary action to mitigate threats.

  3. Scripting and Automation: The file command can be used in shell scripts to dynamically check the types of files before applying actions like decompression, execution, or analysis.

  4. Forensic Investigations: When handling files forensics-style, you need to ascertain their format. The file command provides quick insights, especially in cases where filenames are misleading or missing altogether.

Conclusion​

The file command is an essential tool for analyzing the types of files in Linux and Unix-based systems. Whether you’re dealing with text files, executables, images, or archives, file offers a straightforward way to determine a file’s format based on its content, not its extension. This tool is invaluable in troubleshooting, security, and file system organization.