s0sta
EN NL عربي
Filters
How to search
  • Plain words find names, texts and examples.
  • "two words" finds the exact phrase.
  • --name or -x finds an option.
  • #word looks only inside commands.
  • @grep finds lessons and labs that use grep.
  • Filters: cat:network · in:labs · in:notes · level:rhcsa · ch:8 · root:yes. Put ! before a word to leave it out. OR between words means one of them.
  • ↑ ↓ to move · Enter to open · Esc to close · / to search

file

Find out what kind of data a file contains (text, script, program, image, archive …), whatever its name.

Level
Everyday Linux
Group
Files and folders
Needs root
No
Package
file

What it does

Linux does not need file endings: report can be a PDF and photo.jpg can be a script. file looks at the content (the first bytes, "magic numbers") and tells you the real type.

Use it before you open an unknown file, when you investigate a suspicious upload, or to see if a program is 32-bit, 64-bit or for ARM.

How to write it

file [OPTIONS] FILE...
file -C [-m MAGICFILES]

Options 30

Most used

-b, --brief
Print only the type, without the file name.
-i, --mime
Print the MIME type and charset, like text/plain; charset=utf-8.
--mime-type, --mime-encoding
Print only the MIME type / only the charset.
-z, --uncompress
Look inside compressed files.
-Z, --uncompress-noreport
Look inside compressed files, report only the content.
-L, --dereference
Follow symbolic links.
-h, --no-dereference
Do not follow links (the default).
-s, --special-files
Read block and character devices too (like a disk /dev/vda1).
-k, --keep-going
Do not stop at the first match: show all matching types.
-f, --files-from file
Read the file names from a file (one per line).
-F, --separator sep
Use another separator than : after the name.
-N, --no-pad
Do not pad the names to line up the output.
-0, --print0
Print a NUL after the name (for safe scripts).
-p, --preserve-date
Do not change the access time of the file.
-r, --raw
Do not translate unprintable characters.
-E
On errors (file not found), print an error and stop with a failure code.
-e, --exclude test
Skip one test: apptype, ascii, encoding, tokens, cdf, compress, csv, elf, json, soft, tar.
--exclude-quiet
Like --exclude, but no error for unknown tests.
--extension
Print the usual file endings for this type.
-l, --list
List the strength of each magic pattern.
-m, --magic-file list
Use these magic files instead of the default.
-C, --compile
Compile a magic file into a .mgc file.
-c, --checking-printout
Show a parsed form of the magic file (debug).
-P, --parameter name=value
Set limits of the parser (like bytes to read).
-n, --no-buffer
Flush the output after each file.
-S, --no-sandbox
Turn off the system call sandbox.
-d
Print debug information.
--apple
Print the Apple creator/type.
-v, --version
Show the version.
--help
Show help.

Examples 11

$ run as a normal user# run as root (or with sudo)

  1. 1What is this file?

    file mystery
mystery: PDF document, version 1.7

    The name had no ending; the content says PDF.

  2. 2Check a program's architecture

    file /usr/bin/ls
/usr/bin/ls: ELF 64-bit LSB pie executable, x86-64, dynamically linked …

    A download for the wrong CPU (ARM vs x86-64) gives "Exec format error"; file shows why.

  3. 3Get the MIME type for a script

    file -b --mime-type upload.jpg
image/jpeg

    Web apps should check the real type of uploads, not the file name.

  4. 4Find a disguised script in an upload folder

    file /var/www/uploads/* | grep -iv image

    A "picture" that is really PHP script is a typical web shell.

  5. 5Check the text encoding

    file -i data.csv
data.csv: text/plain; charset=iso-8859-1

    Convert to UTF-8 with iconv before an import.

  6. 6Look inside a compressed file

    file -z backup.sql.gz

    Shows the type of the data inside the gzip file.

  7. 7Check what is on a disk partition

    file -s /dev/vdb1
/dev/vdb1: SGI XFS filesystem data …

    Find the file system type of a partition (or "data" when it is empty).

  8. 8Check Windows line endings in a script

    file deploy.sh
deploy.sh: Bourne-Again shell script, ASCII text executable, with CRLF line terminators

    CRLF breaks bash scripts ("bad interpreter"). Fix it with sed -i 's/\r$//' deploy.sh.

  9. 9Check many files from a list

    find /tmp -type f -newer /tmp/marker > list.txt; file -f list.txt

    Classify every new file in one run (incident response).

  10. 10See if a binary is static or dynamic

    file /usr/local/bin/kubectl

    "statically linked" binaries do not need system libraries.

  11. 11Only the type, no name

    file -b /etc/passwd
ASCII text

    Easy to use in if tests in scripts.

Watch out

  • file guesses from patterns; very short or special files can be reported wrongly.
  • Running file on hostile files is mostly safe (it uses a sandbox), but do not open them in other programs to "check".

Files

/usr/share/misc/magic.mgc
The compiled database of file patterns.
/etc/magic
Your own extra patterns.

Tips to remember

  • The name lies, the content does not: use file.

Full manual

This page explains the command in simple words. The original manual has every detail.

In your terminal: man file

Open the man page (linux.die.net)man7.org