DEV Community

NJEI
NJEI

Posted on

Understanding Linux File System: ls -ltr Decoded and Directory Structure Explained

#linux #tutorial #beginners #devops

The Problem

You run ls and see filenames. But is it a file or folder? Who owns it? Can you even edit it?

On day two with Linux, I learned ls can tell you way more than just names.

The Command: ls -ltr 

ls -ltr
Enter fullscreen mode Exit fullscreen mode

What the flags mean:

  • -l = Long format (detailed info)
  • -t = Sort by time
  • -r = Reverse (newest at bottom)

Terminal Output Example 

drwxr-xr-x  2 ubuntu ubuntu    4096 Dec 01 10:23 documents
-rw-r--r--  1 ubuntu ubuntu     156 Dec 02 14:45 config.txt
lrwxrwxrwx  1 ubuntu ubuntu      15 Dec 03 09:12 link_to_file -> /home/ubuntu/file
-rwxr-xr-x  1 ubuntu ubuntu    8192 Dec 04 16:30 script.sh
drwxr-xr-x  3 root   root      4096 Dec 05 11:20 logs
crw-rw----  1 root   tty     136, 0 Dec 06 08:15 tty0
brw-rw----  1 root   disk      8, 0 Dec 06 10:00 sda
srwxrwxrwx  1 root   root         0 Dec 04 12:30 mysql.sock
Enter fullscreen mode Exit fullscreen mode

Let's decode this.

Reading the Output

Column 1: File Type + Permissions 

drwxr-xr-x
│└────┬────└─── Others (r-x)
│     └──────── Group (r-x)
│           └── Owner (rwx)
└────────────── File Type (d)
Enter fullscreen mode Exit fullscreen mode

First Character = File Type:

Symbol Type Description
d Directory It's a folder
- Regular file Normal file
l Symbolic link Shortcut to another file
c Character device Keyboard, terminal
b Block device Hard drive, USB
s Socket Inter-process communication
p Named pipe Process communication

Next 9 Characters = Permissions:

  • r = Read
  • w = Write
  • x = Execute
  • - = No permission

Example: rwxr-xr-x

  • Owner: read, write, execute
  • Group: read, execute (no write)
  • Others: read, execute (no write)

Columns 2-9: The Details 

-rw-r--r--  1 ubuntu ubuntu  156 Dec 02 14:45 config.txt
│           │ │      │       │   │            │
│           │ │      │       │   │            └─ Filename
│           │ │      │       │   └────────────── Last modified
│           │ │      │       └────────────────── Size (bytes)
│           │ │      └────────────────────────── Group owner
│           │ └───────────────────────────────── User owner
│           └─────────────────────────────────── Number of links
└─────────────────────────────────────────────── Type + Permissions
Enter fullscreen mode Exit fullscreen mode

File Types in Detail

Regular Files (-) 

-rw-r--r--  1 ubuntu ubuntu  156 Dec 02 14:45 config.txt
Enter fullscreen mode Exit fullscreen mode

Your typical files: text, images, binaries, scripts.

Directories (d) 

drwxr-xr-x  2 ubuntu ubuntu 4096 Dec 01 10:23 documents
Enter fullscreen mode Exit fullscreen mode

Folders. Note: size shows metadata, not actual contents.

Symbolic Links (l) 

lrwxrwxrwx  1 ubuntu ubuntu   15 Dec 03 09:12 link -> /home/file
Enter fullscreen mode Exit fullscreen mode

Like shortcuts. If original file is deleted, link breaks.

Character Devices (c) 

crw-rw----  1 root tty  136, 0 Dec 06 08:15 tty0
Enter fullscreen mode Exit fullscreen mode

Transfer data character by character. Terminals, keyboards. Found in /dev/.

Block Devices (b) 

brw-rw----  1 root disk  8, 0 Dec 06 10:00 sda
Enter fullscreen mode Exit fullscreen mode

Transfer data in blocks. Hard drives, USB drives. In /dev/.

Sockets (s) 

srwxrwxrwx  1 root root     0 Dec 04 12:30 mysql.sock
Enter fullscreen mode Exit fullscreen mode

For inter-process communication. Usually in /var/run/ or /tmp/.

Named Pipes (p) 

prw-r--r--  1 ubuntu ubuntu  0 Dec 03 15:20 mypipe
Enter fullscreen mode Exit fullscreen mode

Allow processes to communicate. Less common.

Linux Directory Structure

Everything starts from / (root):

/                           Root directory
├── bin/                    Essential commands (ls, cp, cat)
├── boot/                   Bootloader, kernel
├── dev/                    Device files
├── etc/                    Configuration files
├── home/                   User directories
│   └── ubuntu/             Your home directory
├── lib/                    Shared libraries
├── media/                  Removable media mount points
├── mnt/                    Temporary mounts
├── opt/                    Optional software
├── proc/                   Process information (virtual)
├── root/                   Root user's home
├── run/                    Runtime process data
├── sbin/                   System admin commands
├── srv/                    Service data (web, FTP)
├── sys/                    Kernel/hardware info (virtual)
├── tmp/                    Temp files (cleared on reboot)
├── usr/                    User programs
│   ├── bin/                User commands
│   ├── lib/                Program libraries
│   └── local/              Locally installed software
└── var/                    Variable data
    ├── log/                Log files
    ├── www/                Web server files
    └── tmp/                Temp files (preserved on reboot)
Enter fullscreen mode Exit fullscreen mode

Key Directories

Directory Purpose Example Use
/home/ Your personal files /home/ubuntu/documents/
/etc/ System configuration /etc/nginx/nginx.conf
/var/log/ Log files /var/log/syslog
/tmp/ Temporary files Cleared on reboot
/dev/ Device files /dev/sda (hard drive)
/usr/bin/ Programs /usr/bin/python3

Practical Commands

Basic listing 

ls -ltr
Enter fullscreen mode Exit fullscreen mode

Include hidden files 

ls -ltra
# Shows files starting with . like .bashrc
Enter fullscreen mode Exit fullscreen mode

Human-readable sizes 

ls -ltrh
# Shows 1.5M instead of 1572864
Enter fullscreen mode Exit fullscreen mode

Check specific directory 

ls -ltr /var/log
Enter fullscreen mode Exit fullscreen mode

Only directories 

ls -ltrd */
Enter fullscreen mode Exit fullscreen mode

Sort by size 

ls -lSrh
# -S = sort by size
Enter fullscreen mode Exit fullscreen mode

Common Mistakes

❌ Mistake #1: Not using -h 

ls -ltr
# Output: -rw-r--r-- 1 ubuntu ubuntu 1572864 Dec 06 10:00 file.txt
# Who knows what 1572864 bytes is?
Enter fullscreen mode Exit fullscreen mode

✅ Better: 

ls -ltrh
# Output: -rw-r--r-- 1 ubuntu ubuntu 1.5M Dec 06 10:00 file.txt
# Instantly readable
Enter fullscreen mode Exit fullscreen mode

❌ Mistake #2: Missing hidden files 

ls -ltr
# Doesn't show .bashrc, .ssh/, .gitconfig
Enter fullscreen mode Exit fullscreen mode

✅ Better: 

ls -ltra
# Shows all files including hidden ones
Enter fullscreen mode Exit fullscreen mode

❌ Mistake #3: Looking for logs in wrong place 

ls /tmp/application.log  # Wrong
Enter fullscreen mode Exit fullscreen mode

✅ Better: 

ls /var/log/application.log  # Correct
Enter fullscreen mode Exit fullscreen mode

Real-World Examples

Check who owns a config file 

ls -l /etc/nginx/nginx.conf
-rw-r--r-- 1 root root 1234 Dec 01 10:00 /etc/nginx/nginx.conf
# Owned by root, group root
Enter fullscreen mode Exit fullscreen mode

Find recently modified logs 

ls -ltr /var/log/*.log | tail -5
# Shows 5 most recently modified logs
Enter fullscreen mode Exit fullscreen mode

Check device files 

ls -l /dev/sda*
brw-rw---- 1 root disk 8, 0 Dec 06 10:00 /dev/sda
brw-rw---- 1 root disk 8, 1 Dec 06 10:00 /dev/sda1
# b = block device (hard drive)
Enter fullscreen mode Exit fullscreen mode

Verify symbolic link 

ls -l /usr/bin/python
lrwxrwxrwx 1 root root 9 Dec 01 08:00 /usr/bin/python -> python3.8
# Link points to python3.8
Enter fullscreen mode Exit fullscreen mode

Quick Reference Table

Flag What It Does
-l Long format (detailed)
-t Sort by time
-r Reverse order
-a Show hidden files
-h Human-readable sizes
-d List directories themselves
-S Sort by size
-R Recursive (subdirectories too)

Combining Flags 

# Most useful combination
ls -ltrah
# Long format, time-sorted, reversed, all files, human sizes

# Find largest files
ls -lSrh | tail -10

# Recently modified, human-readable
ls -ltrhA
Enter fullscreen mode Exit fullscreen mode

Key Takeaways

  1. ls -ltr is your diagnostic tool - shows type, permissions, owner, size, date
  2. First character = file type - Learn these 7: d, -, l, c, b, s, p
  3. Linux is one tree from / - Everything branches from root
  4. Know your key paths:
    • Your files: /home/username/
    • Configs: /etc/
    • Logs: /var/log/
    • Devices: /dev/
  5. Always use -h flag - Human-readable sizes are essential

Once you can read ls -ltr output fluently, navigating Linux feels natural. You're seeing the full story, not just filenames.

What ls flag combo do you use most? Drop it in the comments—I'm collecting useful patterns.

Follow for more Linux learning notes as I document my journey into DevOps and cloud engineering.

Top comments (0)