Linux › Module 1 › Lesson 3
Linux File System Structure
Understand /home, /etc, /var, and the Linux directory tree
Visual · linux_filesystem
A branching directory tree rooted at / — every file on a Linux system lives somewhere in this hierarchy.
Opening
In Linux, everything is a file
Windows uses C:\\ and D:\\. Linux uses one tree starting at / (root). Configs, logs, programs, and your homework all live as files or folders in predictable places. Learn the map once—you will navigate every server and lab faster.
1. The Root of It All: /
The forward slash / is the top of the filesystem. There is no "C drive." When you see a path like /home/student/notes.txt, read it left to right: from root, into home, into the student folder, to the file.
2. Directories You Must Know
These appear in almost every Linux box you will touch:
/home
Personal folders for normal users. Your files usually live in /home/yourname. This is your workspace.
/root
The home directory for the superuser (root). Not the same as /. Regular users cannot browse here without permission.
/etc
Configuration files—network settings, SSH settings, service configs. Attackers and defenders both care about /etc.
/var
/tmp
Temporary files. World-writable and often cleaned on reboot. Malware sometimes hides here—know it exists.
/usr
Most user programs and libraries (not "user files"—historical name). Binaries often live in /usr/bin.
/bin and /sbin
Essential commands (ls, cp) and system admin binaries. On modern distros many are symlinks into /usr/bin.
3. Absolute vs. Relative Paths
An absolute path starts with / (example: /etc/passwd). A relative path starts from where you are now (example: Documents/report.txt). The shell tracks your current folder with pwd. Two special shortcuts: . means "here" and .. means "parent folder."
Security mindset
During incident response, analysts quickly check /etc for persistence, /var/log for evidence, and /tmp for dropped tools. Knowing the layout is not trivia—it is navigation under pressure.
4. Hidden Files
Files starting with a dot (.) are hidden by default—like .ssh for SSH keys or .bashrc for shell settings. Use ls -a to see them. Attackers love hiding configs in plain sight; defenders learn to look.
Knowledge Check
Where do normal users typically store personal files on Linux?
Multiple choice
Knowledge Check
Which directory usually contains system log files?
Multiple choice
Knowledge Check
What does an absolute path always start with?
Multiple choice