The Linux Command Line: Navigation and File Management
Objective. Students use core shell commands to navigate the directory tree, manage files, and read file contents accurately.
This lesson, its worked examples and its practice questions has not yet been verified by an industry-certified professional or by a certification or approval body. It is a study draft and may contain errors. Do not use it as instructions for work on a job site or on live equipment. Always follow your instructor, your supervising professional, and current official references and regulations.
VoTechWorks program approval and accreditation are still in progress. Credentials are issued only by the certifying bodies named in each program, after their own exams.
The Linux Command Line: Navigation and File Management
Linux is the dominant operating system in server environments, cloud infrastructure, and security tools. As a cybersecurity professional, you will spend significant time at the command line — reading logs, investigating file systems, and organizing evidence. Mastering core shell commands is not optional; it is a foundational job skill tested directly on CompTIA Security+, CySA+, and ISC2 CC exams.
The Directory Tree
Linux organizes all files in a single inverted tree rooted at `/` (the root directory). Every file and directory has a path. An absolute path starts from root, for example `/home/analyst/logs`. A relative path starts from your current location, for example `logs/auth.log`. Understanding this distinction prevents misdirected file operations that can destroy evidence or system files.
Essential Navigation Commands
`pwd` (print working directory) displays your exact location in the file system. Run it first whenever you open a terminal — knowing where you are prevents accidental actions in the wrong directory.
`ls` lists directory contents. Common flags: `-l` shows long format (permissions, owner, size, timestamp); `-a` shows hidden files (names beginning with `.`); `-lh` makes file sizes human-readable. In security work, hidden files often conceal malware or attacker artifacts.
`cd` (change directory) moves you through the tree. `cd ..` goes up one level; `cd ~` returns to your home directory; `cd -` returns to the previous directory. Typing a full absolute path after `cd` takes you directly to any location.
File Management Commands
`mkdir` creates a new directory. Use `mkdir -p parent/child` to create nested directories in one command, which is useful when building evidence storage hierarchies.
`cp` copies files or directories. The syntax is `cp source destination`. Add `-r` to copy a directory and all its contents recursively. Always copy before modifying log files so the original is preserved for forensic integrity.
`mv` moves or renames files. `mv oldname.txt newname.txt` renames in place; `mv file.txt /home/analyst/logs/` relocates the file. Unlike `cp`, `mv` does not retain the original at the source — use it carefully when handling evidence.
`rm` removes files. Add `-r` to remove directories recursively. There is no Recycle Bin on the command line. Deleted files are gone unless a backup exists. Never run `rm -rf /` or any command you do not fully understand, as it can wipe the entire file system. In a lab environment, restrict destructive commands to directories explicitly assigned by your instructor.
Reading File Contents
`cat` outputs an entire file to the terminal at once. It is fast for short files but difficult to read for large logs.
`less` opens a file in a scrollable viewer. Use the arrow keys to scroll; press `q` to quit; press `/` followed by a keyword to search. `less` is preferred over `cat` for log files because you control the pace and can search.
`head` displays the first 10 lines of a file by default. Use `-n 20` to specify a different number. Useful for checking file headers and configuration file syntax.
`tail` displays the last 10 lines. The flag `-f` (follow) streams new lines in real time as they are written — invaluable for watching live log output during an incident.
`file` determines a file's type by examining its contents, not just its name. Attackers frequently rename malicious executables with innocent extensions. Running `file suspicious.txt` may reveal it is actually an ELF executable.
Using Man Pages and Help Flags
The `man` command opens the manual page for any command: `man ls`. Man pages are organized into sections — section 1 covers user commands. Press `q` to exit. When a man page is unavailable, most commands respond to `--help` with a concise usage summary. Practicing with man pages builds the self-sufficiency employers expect and directly prepares you for exam scenarios involving unfamiliar commands.
Capturing Your Session with `script`
The `script` command records everything typed and displayed in a terminal session to a file. Start logging with `script session.log`; end with `exit`. Your instructor will review this log to verify correct command use. Treat `script` logs as evidence: do not edit them after the session.
Safety and Best Practices
- Work in your assigned VM only. Never practice destructive commands on a production system or shared server.
- Verify your current directory with `pwd` before any `rm` or `mv` command.
- Copy before modifying any file that may serve as forensic evidence.
- Read the full command before pressing Enter. A single misplaced flag can have irreversible consequences.
- In a professional environment, file system actions on seized media must follow chain-of-custody procedures; your lab habits now build those instincts.
Key terms9
Materials: Linux VM, terminal emulator, GNU Coreutils man pages, CompTIA Linux+ Study Guide (Sybex) chapters on file management
Check: Instructor reviews script session log; student must execute each core command correctly with no unrecoverable errors; pass = 90% of commands produce expected output.
Practice check8
Answer each question, then check it. Nothing is recorded; this is your own practice.
