Linux File Operations

Working with Files Safely

Linux gives you powerful file commands, but power requires care. A single rm -r in the wrong location can remove important data. The good news is that the core file operations are consistent and easy to learn once you practice them.

This lesson covers the commands you will use constantly in development, troubleshooting, and server administration.

Creating Files and Directories

Use mkdir to create directories.

mkdir project
mkdir -p project/config/environments

The -p flag creates parent directories as needed and does not fail if parts already exist.

Use touch to create an empty file or update a file’s timestamp.

touch notes.txt
touch app.log

Tip: mkdir -p is very common in automation because it is safe for repeated runs.

Copying Files with cp

The cp command copies files or directories.

cp app.conf app.conf.bak
cp -r site/ site-backup/
cp -v *.log archive/

Useful flags:

• -r copies directories recursively
• -v shows what is being copied

A common admin pattern is to back up a config before editing it:

sudo cp /etc/nginx/nginx.conf /etc/nginx/nginx.conf.bak

Moving and Renaming with mv

The mv command moves or renames files.

mv draft.txt final.txt
mv report.txt docs/

If the target is a directory, the file is moved into it. If the target is a new filename in the same directory, the file is renamed.

Removing with rm

The rm command deletes files. It does not move them to a recycle bin.

rm old.log
rm -r old-directory
rm -i important.txt

Useful flags:

• -r removes directories recursively
• -i asks for confirmation

Note: Many production mistakes start with removing the wrong path. Double-check with pwd and ls before destructive commands.

Reading File Content

cat

cat prints a file’s full contents.

cat /etc/hosts
cat app.log

It is best for small files.

head

head shows the first lines of a file.

head app.log
head -n 20 app.log

tail

tail shows the last lines of a file.

tail app.log
tail -n 50 app.log
tail -f /var/log/nginx/access.log

tail -f is especially useful for watching logs as new entries appear.

less

less lets you scroll through file contents interactively.

less /var/log/syslog

Use the arrow keys or page navigation, type /error to search, and press q to quit.

Links: Hard Links and Symbolic Links

The ln command creates links.

Hard Links

A hard link is another directory entry that points to the same underlying file data.

ln original.txt hardlink.txt

Both names refer to the same inode. Deleting one name does not remove the data as long as another hard link still exists.

Symbolic Links

A symbolic link or soft link points to another path.

ln -s /var/log/nginx/access.log access-current.log

Symbolic links are more flexible because they can point across filesystems and to directories.

Tip: In DevOps, symbolic links are often used for versioned deployments, like linking current to the active release directory.

A Practical Example

Suppose you are preparing a simple app directory:

mkdir -p myapp/{config,logs,bin}
touch myapp/config/app.conf
cp myapp/config/app.conf myapp/config/app.conf.bak
mv myapp/config/app.conf.bak myapp/config/app.conf.old
ln -s myapp/logs latest-logs

You created a structure, added a file, made a backup, renamed it, and created a symbolic link.

Choosing the Right Command

• Use cp when you need a duplicate
• Use mv when you want to rename or relocate
• Use rm when you are sure you want permanent removal
• Use cat, head, tail, or less depending on file size and what part you need
• Use ln -s when you want a flexible pointer to another path

Beginners often overuse cat for huge logs. On large files, less or tail is usually better.

Test Your Understanding

Exercise 1: Creating directory trees

Question: Which command from the lesson creates project/config/environments in one step without failing if parent directories are missing?

Exercise 2: Following a growing file

Scenario: You want to watch new Nginx access log lines appear during troubleshooting.

Question: Which command is the best match?

Exercise 3: Using flexible links

Question: Why would ln -s be a good fit for a current release directory in a deployment?

---

Key takeaways

• rm has no undo and no trash. There is no recovery for an ordinary file.
• cp -r for directories, cp -a to preserve permissions, ownership and timestamps.
• A trailing slash changes cp and rsync behaviour: dir copies the directory, dir/ copies its contents.
• mv renames and moves with the same command; there is no separate rename.
• Use rm -i or an alias for interactive deletion rather than trusting yourself with -rf.
• less over cat for large files, and tail -F for one still being written.
• find -exec is powerful and unforgiving. Run it with -print first to see what it matches.

---

Frequently Asked Questions

Is there any way to undo rm in Linux?

Not for practical purposes. rm unlinks the file immediately with no trash directory, and while the blocks may survive on disk until overwritten, recovery tools such as extundelete or testdisk are unreliable on a mounted filesystem and rarely worth attempting. Prevention is the whole answer: alias rm to rm -i for interactive confirmation, use a trash utility such as trash-cli for interactive work, and keep backups. Before any rm -rf, read the path out loud. Most accidents are a stray space or an unquoted variable.

What is the difference between cp -r and cp -a?

-r copies a directory recursively but resets ownership to you and updates timestamps to now. -a (archive) preserves permissions, ownership, timestamps and symlinks, which is what you want when copying system files, a web root, or anything where metadata matters. A common symptom of using -r is a service refusing to start after a copy because files it needs are now owned by the wrong user. When in doubt on system files, use -a.

Why did cp put my files in the wrong place?

Almost always the trailing slash on the source. cp -a dir dest/ copies the directory itself, producing dest/dir; cp -a dir/. dest/ copies its contents into dest. rsync has the same distinction, where rsync -a src/ dest/ syncs contents and rsync -a src dest/ creates dest/src. The other cause is a destination that does not exist, in which case cp treats the last argument as a new filename rather than a directory.

How do I find files by name or size?

find /path -name "*.log" matches by name, -iname case-insensitively, and -type f restricts to regular files. find /var -size +100M finds large files, and -mtime -7 those modified in the last week. Combine with -exec to act on results, find . -name "*.tmp" -delete, but always run the find alone first to see what it matches, because -delete and -exec rm are as unforgiving as rm itself. For searching contents rather than names, use grep -r or rg.

What is the difference between cat, less, head and tail?

cat prints the whole file to your terminal, which is fine for something small and unhelpful for a 2 GB log. less pages through it without loading it all, supports / to search, and is the right default for anything large. head -n 20 shows the first lines and tail -n 50 the last, and tail -F follows a file as it grows, surviving log rotation, which the plain -f does not.

How do I create a file or directory tree in one command?

touch file.txt creates an empty file or updates an existing one's timestamp. mkdir -p a/b/c creates the whole path, creating parents as needed and succeeding silently if it already exists, which is what makes it safe in scripts, where plain mkdir errors on an existing directory. Brace expansion handles several at once: mkdir -p project/{src,tests,docs} creates all three subdirectories in one go.