Cybersecurity Updates & Tools

file Command in Linux: Identify File Types Without Extensions

The file command inspects the actual contents of a file and reports its type — regardless of the name or extension. A file called photo.jpg could be a PNG, an ELF binary, or plain text. The file command shows you what it actually is.

How to Use the file Command in Linux

The syntax is:

bashfile [OPTIONS] [FILE...]

Pass a path to get the type:

bashfile /etc/hostname# /etc/hostname: ASCII text

Use -b (brief) to print the type only, without the filename:

bashfile -b /etc/hostname# ASCII text

Pass multiple files to get a result for each:

bashfile /bin/bash /etc/hostname /path/to/image.png

Shell wildcards work too:

bashfile /etc/*.conf

For a long list of paths, put them in a text file (one per line) and use -f:

bashfile -f filelist.txt

This avoids shell argument limits and is convenient for batch processing scripts.

MIME Types, Compressed Files, and Symlinks

Get the MIME type and character encoding with -i:

bashfile -i /var/www/html/index.html# /var/www/html/index.html: text/html; charset=us-ascii

Scripts that need to branch on file type benefit from -i — parsing a MIME string is far more reliable than parsing human-readable free text like “HTML document, ASCII text”.

Look inside compressed files with -z:

bashfile -z archive.gz# archive.gz: ASCII text (gzip compressed data, was "notes.txt", ...)

Without -zfile only reports gzip compressed data — you cannot tell what is inside. With -z, it reports both the compression wrapper and the actual content type.

Symlink handling: by default, file reports the symlink itself. Use -L to follow it and inspect the target:

bashfile /usr/bin/python3# /usr/bin/python3: symbolic link to python3.12file -L /usr/bin/python3# /usr/bin/python3: ELF 64-bit LSB pie executable, x86-64, ...

How the file Command Works: The Magic Database

file does not look at extensions. It tests file contents against a set of rules called the magic database, stored in /usr/share/misc/magic (or /usr/share/file/magic on some systems). Each rule describes a byte pattern at a specific offset and a type label to report when it matches.

Rules are tested in order. The first match wins — which is why file correctly identifies an ELF binary even if someone names it .txt.

To see which rule matched, add --debug:

bashfile --debug /etc/hostname

For custom binary formats, supply your own magic file with -m:

bashfile -m /path/to/custom.magic target-file

If a file starts with a shebang (#!/bin/bash#!/usr/bin/env python3), file reports it as a script and includes the interpreter name in the description.

Use file filename for a quick type check, -i for MIME output in scripts, -z to inspect compressed contents, and -L when working with symlinks. Leave a comment below if you run into any issues.