Navigating and Managing Files

The everyday verbs are a short list — ls, cd, pwd, cp, mv, rm, mkdir, touch — and you will type some of them thousands of times. They sit on top of two ideas that decide what they actually do: how a path is resolved (absolute versus relative, with ., .., and ~ as shorthands), and the fact that the shell, not the command, expands the wildcards you type. Get those two right and the commands are predictable.

The flags are where the cost lives. cp without -a silently drops permissions, ownership, timestamps, and symlinks; rm -r with one stray space deletes the wrong tree; mv across a filesystem boundary is not an atomic rename but a copy-then-delete that can leave a half-written file if it fails. There is no recycle bin and no undo — a wrong rm is gone the instant the link count hits zero and no process holds the file open.

The Path Model

An absolute path starts at the root and is unambiguous from anywhere: /var/log/syslog means the same thing in every directory. A relative path is resolved against your current working directory — log/syslog only works if you are sitting in /var. The shell tracks where you are in $PWD and remembers the previous directory in $OLDPWD, which is what cd - jumps back to.

Three shorthands cover almost every move. . is the current directory, .. is the parent, and ~ expands to your home directory (~user to that user's home). These are not magic files — . and .. are real directory entries present in every directory, while ~ is tilde expansion done by the shell before the command runs. That distinction matters in scripts: a command never sees the literal ~, only the path it expanded to.

cd /var/log        # absolute: same target from anywhere
cd ../cache        # relative: up one, then into cache → /var/cache
cd -              # jump back to $OLDPWD
echo "$PWD"       # where am I right now
cd ~deploy/app     # the deploy user's home, then app/

Listing and Inspecting

ls on its own hides almost everything you need on a server. ls -l gives the long form: type and permission bits, link count, owner, group, size, and mtime. Add -a to show dotfiles, -h for human-readable sizes (KiB/MiB instead of raw bytes), and -i to print the inode number — the only reliable way to tell whether two names are hard links to the same file. The combination ls -lah is muscle memory for a reason.

When you need facts ls rounds off, drop to stat: it prints exact byte size, all three timestamps, the inode, link count, and the permission bits in both octal and symbolic form. file answers a different question — what a file actually is — by reading its magic bytes rather than trusting the extension, which is how you avoid cat-ing a binary and scrambling your terminal.

ls -lah /etc            # long, hidden, human sizes
ls -li                  # show inode numbers (spot hard links)
stat deploy.tar.gz      # exact size, atime/mtime/ctime, links
file /usr/bin/python3   # reads magic bytes, not the name

Copying and Moving

A plain cp src dst creates a new file owned by you, with a fresh timestamp, default permissions filtered through your umask, and any symlink in the source dereferenced into a full copy. For configuration trees, backups, or anything where metadata is part of the content, that is data loss in slow motion. cp -a (archive) is the safe default: it recurses, preserves owner, group, mode, and timestamps, and copies symlinks as symlinks instead of following them.

mv behaves in two completely different ways depending on geography. Within one filesystem it is a rename — it rewrites a directory entry, touches no data blocks, and is atomic: the file is either fully at the old name or fully at the new one, never both, never neither. Across a filesystem boundary it cannot rename, so it falls back to copy-then-unlink. That cross-device move is not atomic, takes time proportional to the data, and can leave a partial file at the destination if it is interrupted — which is exactly why deploy scripts stage to a temp file on the same filesystem and then rename into place.

Command	Permissions / owner	Timestamps	Symlinks
cp src dst	reset to your umask defaults	set to now	followed (copied as files)
cp -a src dst	preserved	preserved	kept as symlinks
mv (same fs)	unchanged (rename only)	unchanged	unchanged
mv (cross-device)	copied, then original removed	copied	copied as symlinks

Creating and Removing

mkdir -p path/to/dir creates every missing parent in one call and, critically, does not error if the directory already exists — which makes it idempotent and safe to run repeatedly in scripts. touch creates an empty file if it is absent and updates the mtime if it is present; that second behavior is useful for triggering rebuilds and rotating sentinel files, not just for making blank files.

rm deletes a directory entry; rm -r walks a tree and deletes all of it; rm -f suppresses prompts and ignores missing files. The danger is that the shell expands wildcards and variables before rm runs, so rm -rf $DIR/* with DIR unset becomes rm -rf /*, and rm -rf /var/tmp /old with an accidental space targets two trees instead of one. GNU rm enables --preserve-root by default, so a bare rm -rf / is refused — but that only guards the literal /: the glob /* expands to /bin, /etc, and every other top-level entry, which rm deletes one by one. There is no undelete — recovery means restoring from backup.

mkdir -p releases/2026/05   # makes all parents, no error if present
touch .rebuild              # create, or bump mtime if it exists
ls -d /tmp/cache-*          # LIST the glob first
rm -r -- /tmp/cache-*       # then delete what you just confirmed

Wildcards in Practice

The single most important fact about wildcards is that rm, cp, and mv never see them. The shell expands *.log into the matching filenames first and hands the command the finished list; the program receives a hundred arguments, not one pattern. That is why rm *.log in an empty directory passes the literal *.log through (and errors on a missing file), and why a filename with a leading dash can look like a flag once the glob expands.

The operational consequence is a habit, not a flag: preview every destructive glob with ls or echo first, because that shows you the exact same list the dangerous command will act on. Use -- to mark the end of options so a file named -rf or -i is treated as a filename rather than a switch. The full mechanics of brace, tilde, and pathname expansion get their own topic later — here the rule is simply: look before you delete.