How To

file Command in Linux: Identify File Types Without Extensions

The file command inspects the actual contents of a file and reports its type — regardless of the name or extension. A file called photo.jpg could be a PNG, an ELF binary, or plain text. The file command shows you what it actually is.

How to Use the file Command in Linux

The syntax is:

bashfile [OPTIONS] [FILE...]

Pass a path to get the type:

bashfile /etc/hostname# /etc/hostname: ASCII text

Use -b (brief) to print the type only, without the filename:

bashfile -b /etc/hostname# ASCII text

Pass multiple files to get a result for each:

bashfile /bin/bash /etc/hostname /path/to/image.png

Shell wildcards work too:

bashfile /etc/*.conf

For a long list of paths, put them in a text file (one per line) and use -f:

bashfile -f filelist.txt

This avoids shell argument limits and is convenient for batch processing scripts.

MIME Types, Compressed Files, and Symlinks

Get the MIME type and character encoding with -i:

bashfile -i /var/www/html/index.html# /var/www/html/index.html: text/html; charset=us-ascii

Scripts that need to branch on file type benefit from -i — parsing a MIME string is far more reliable than parsing human-readable free text like “HTML document, ASCII text”.

Look inside compressed files with -z:

bashfile -z archive.gz# archive.gz: ASCII text (gzip compressed data, was "notes.txt", ...)

Without -zfile only reports gzip compressed data — you cannot tell what is inside. With -z, it reports both the compression wrapper and the actual content type.

Symlink handling: by default, file reports the symlink itself. Use -L to follow it and inspect the target:

bashfile /usr/bin/python3# /usr/bin/python3: symbolic link to python3.12file -L /usr/bin/python3# /usr/bin/python3: ELF 64-bit LSB pie executable, x86-64, ...

How the file Command Works: The Magic Database

file does not look at extensions. It tests file contents against a set of rules called the magic database, stored in /usr/share/misc/magic (or /usr/share/file/magic on some systems). Each rule describes a byte pattern at a specific offset and a type label to report when it matches.

Rules are tested in order. The first match wins — which is why file correctly identifies an ELF binary even if someone names it .txt.

To see which rule matched, add --debug:

bashfile --debug /etc/hostname

For custom binary formats, supply your own magic file with -m:

bashfile -m /path/to/custom.magic target-file

If a file starts with a shebang (#!/bin/bash#!/usr/bin/env python3), file reports it as a script and includes the interpreter name in the description.

Use file filename for a quick type check, -i for MIME output in scripts, -z to inspect compressed contents, and -L when working with symlinks. Leave a comment below if you run into any issues.

Cyber Defence

Recent Posts

Kali Linux Commands Cheat Sheet: Complete Quick Reference

This cheat sheet covers the essential Kali Linux commands every pentester and ethical hacker uses…

21 hours ago

What I Wish I Knew Before Learning Malware Analysis and Reverse Engineering

When I first started learning malware analysis and reverse engineering, I thought the hardest part…

5 days ago

git fetch vs git pull: How They Work and When to Use Each

Both git fetch and git pull talk to a remote repository, but they do very different things to your…

2 weeks ago

git cherry-pick Command: Apply Commits from Another Branch

Sometimes the change you need already exists, just on the wrong branch. A hotfix lands…

2 weeks ago

Best Email APIs for Secure Business Email: Why Developers Are Moving Beyond SMTP

Email is still one of the most important communication channels inside modern applications. Password resets,…

2 weeks ago

Nginx Commands in Linux: Start, Stop, Reload, Test, and Log

Nginx is a high-performance web server and reverse proxy trusted by some of the largest…

3 weeks ago