On Linux, a file’s extension (like .txt or .jpg) is merely a naming convention—it has no real meaning at the operating system level. A file named report.txt could actually contain a JPEG image, a compiled binary, or even a compressed archive. The Linux kernel does not rely on extensions to determine how to handle a file.
The file command solves this problem by examining the actual contents of a file, reading its internal structure and magic bytes, and reporting the true file type regardless of its name or extension. This makes it an essential tool for system administrators, security analysts, and anyone working with unfamiliar data.
Basic Usage
To identify the type of a file, pass its name as an argument:
file document.pdf
Output: document.pdf: PDF document, version 1.7, 24 pages
The file command does not rely on the .pdf extension to produce this result. It physically reads the first few bytes of the file (known as the “magic number” or “file signature”) and matches them against a comprehensive database of known file formats.
Identifying Misnamed Files
This behaviour is particularly useful for detecting misnamed or suspicious files:
file mystery_file.txt
Output: mystery_file.txt: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked
Despite the .txt extension suggesting a harmless text file, the file command reveals it is actually a compiled Linux executable binary. This kind of analysis is critical for security investigations.
Checking Multiple Files at Once
You can pass multiple filenames to the file command in a single invocation:
file image.png archive.tar.gz script.sh config.yaml
Each file will be analysed and its type displayed on a separate line, making it easy to audit an entire directory of mixed files.
You can also use wildcard patterns to check all files matching a specific pattern:
file /var/log/*
This will identify the type of every file inside the /var/log directory.
Outputting Only the MIME Type
The default human-readable output of the file command is descriptive but inconsistent in formatting, making it difficult to parse in scripts. If you need a standardised, machine-readable identifier, use the --mime-type flag (or its shorthand -i).
file --mime-type report.pdf
Output: report.pdf: application/pdf
file --mime-type photo.jpg
Output: photo.jpg: image/jpeg
MIME types follow a standardised format (type/subtype) that is universally used by web servers, email clients, and file managers. This output is ideal for scripting logic such as:
if file --mime-type -b "$f" | grep -q "image/"; then echo "It's an image"; fi
The -b (brief) flag suppresses the filename prefix, outputting only the MIME type string itself (e.g., image/jpeg instead of photo.jpg: image/jpeg).
Following Symbolic Links
By default, if you run file on a symbolic link, it will report on the symlink itself rather than the file it points to. To make file follow the symlink and report on the target file, use the -L flag:
file -L /usr/bin/python3
This will follow the chain of symlinks and report the type of the actual binary that python3 ultimately resolves to.
Analysing Compressed Archives
The file command can look inside compressed files to report on their contents. When you run it on an archive, it identifies both the compression method and the underlying archive format:
file backup.tar.gz
Output: backup.tar.gz: gzip compressed data, last modified: Mon Aug 17 10:30:00 2026, from Unix, original size modulo 2^32 1048576
By integrating the file command into your daily workflow, you gain the ability to reliably identify any file you encounter, regardless of its name, extension, or origin.