Linux Investigating File Contents

🔍 Investigating File Contents in Linux

1. file — Identify File Type

The file command inspects a file and tells you what type it is, without relying solely on the file extension.

Usage:

file filename

Example:

$ file notes.txt
notes.txt: ASCII text
$ file /bin/ls
/bin/ls: ELF 64-bit LSB executable, x86-64

✅ What you learn:

• Whether a file is text, binary, executable, archive, image, etc.
• Helpful for understanding what tools to use to inspect the file further.

---

2. head — View the Beginning of a File

The head command shows the first lines of a file. Default is 10 lines, but you can adjust it.

Usage:

head filename
head -n 20 filename  # show first 20 lines

Example:

$ head notes.txt
This is the first line of the file.
This is the second line.
...

✅ What you learn:

• Quickly inspect the start of a text file or log file.
• Useful to check headers or file metadata in plain-text files.

---

3. tail — View the End of a File

The tail command shows the last lines of a file. Very useful for log files.

Usage:

tail filename
tail -n 50 filename  # last 50 lines
tail -f filename     # follow live updates

Example:

$ tail /var/log/syslog
Sep 7 12:34:45 kernel: ...

✅ What you learn:

• Monitor logs in real-time (-f).
• Quickly see recent activity in large files.

---

4. objdump — Inspect Binary Executables

objdump is a tool for examining binary files and executables. You can look at headers, disassembly, or raw content.

Usage:

objdump -d filename       # disassemble executable
objdump -x filename       # show all headers

Example:

$ objdump -d /bin/ls | head -n 10

✅ What you learn:

• CPU instructions in binaries (-d).
• Section headers, symbols, and other metadata (-x).
• Useful for reverse engineering or debugging compiled programs.

---

5. od — Dump File in Octal/Hex/Binary

od stands for octal dump. It can display file contents in various number formats.

Usage:

od -c filename      # show ASCII characters
od -x filename      # show hexadecimal
od -b filename      # show octal bytes

Example:

$ od -c notes.txt
0000000   T   h   i   s       i   s       t   e   x   t  \n

✅ What you learn:

• Low-level view of file contents.
• See hidden characters, binary data, or encoding issues.

---

6. Other Useful Tools

• strings → extracts readable ASCII strings from binaries:

strings /bin/ls

• xxd → creates a hex dump and reverse:

xxd filename
xxd -r filename.hex  # convert hex back to file

• less → interactively scroll through files:

less filename

• cat → concatenate and print the full file:

cat filename

---

🔑 Summary

Command	Purpose
file	Identify file type
head	View first lines
tail	View last lines or follow logs
objdump	Inspect executables/binaries
od	View raw data in octal/hex/binary
strings	Extract printable strings from binary
xxd	Hex dump and reverse
less	Browse large files interactively
cat	Print entire file
These commands together allow you to explore any file type, from plain text to compiled binaries, giving both high-level and low-level views.