How to Use the file Command to Determine File Types and Encoding in Linux

In consumer desktop operating systems like Windows, file identities are almost entirely governed by their trailing three-letter extensions (such as .txt, .exe, or .docx). If a user renames an executable to report.pdf, Windows often treats the binary as a document. In the Linux and Unix philosophy, filenames and extensions are purely cosmetic labels; a file without an extension or with an intentionally deceptive suffix can still be an executable ELF binary, a compressed tarball, or a shell script. To determine what a file actually is, Linux administrators rely on the file command. By inspecting filesystem headers, magic numbers, and character encodings, the file utility determines true file identities in milliseconds.

How the file Command Inspects Files (The Magic System)

The file command performs three sequential inspection tests to classify a target file:

1. Filesystem Tests: Checks system stat() metadata to identify special file types, including directories, symbolic links, named pipes (FIFOs), block devices, and Unix domain sockets.
2. Magic Number Tests: Examines the very first bytes (the binary header) of the file against compiled signatures stored in the system magic database (usually located at /usr/share/misc/magic.mgc). For example, PNG images always begin with hex bytes 89 50 4E 47, and PDF documents begin with %PDF-.
3. Language and Encoding Tests: If the file contains printable characters, file examines character sets to determine whether the content is ASCII, UTF-8, ISO-8859, or binary data, alongside programming syntax (such as Python, Bash, or C source code).

Basic Usage: Identifying Unknown Files

The standard syntax simply takes the target path as an argument:

file unknown_payload

Output example: unknown_payload: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, stripped

In a single line, the command reveals that the file is not text, but a compiled 64-bit x86 Linux binary stripped of debugging symbols.

Determining MIME Types for Web Development and APIs (-i)

When building automated web upload scripts, API gateways, or Nginx configurations, human-readable descriptions are difficult to parse programmatically. Pass the -i (or --mime) flag to output official RFC-compliant MIME types and character encodings:

file -i document.csv

Output: document.csv: text/csv; charset=utf-8

To extract strictly the MIME type without character encoding tags:

file --mime-type -b sample_image

Output: image/png

Inspecting Compressed Archives Without Extracting (-z)

When analyzing compressed archives, standard file execution merely reports that the file is gzip or bzip2 compressed data. Passing the -z flag instructs the utility to look inside the archive and classify the uncompressed payload without extracting it to disk:

file -z archive.tar.gz

Output: archive.tar.gz: POSIX tar archive (GNU) (gzip compressed data, max compression)

Brief Mode (-b) for Shell Script Automation

By default, file prepends the filename and a colon before the description. When writing shell scripts or piping into downstream filters, suppress the filename using the brief mode (-b) flag:

file -b script.sh

Output: Bourne-Again shell script, ASCII text executable

Essential file Command Flags Reference

Option	Syntax Example	Functionality
-i / --mime	file -i file.txt	Outputs standardized MIME type and charset encoding
-b	file -b data.bin	Brief mode: suppresses filename prefix in output
-z	file -z package.tar.gz	Peeks inside compressed files to identify inner contents
-s	sudo file -s /dev/sda1	Inspects block or character devices to identify filesystem (ext4, NTFS)
-L	file -L my_symlink	Dereferences symlinks (inspects target instead of link itself)
-f	file -f list_of_files.txt	Batch inspects all files listed inside a text file

Inspecting Hard Drive Partitions and Storage Filesystems (-s)

The file command can also identify storage partitions directly on raw disk blocks:

sudo file -s /dev/nvme0n1p2

Output: /dev/nvme0n1p2: Linux rev 1.0 ext4 filesystem data, UUID=9b4e1a2f-..., volume name "cloud-root" (extents) (64bit) (large files)

Frequently Asked Questions

Can the file command be tricked by malicious actors?

While an adversary can manipulate trailing file extensions easily, spoofing magic headers requires deliberately prepending specific binary bytes to a payload. While possible in sophisticated exploits, the file command remains orders of magnitude more reliable than trusting file extensions alone.

What does “data” mean when reported by the file command?

If file outputs simply file.bin: data, it means the binary headers do not match any known signatures in the magic database, and the contents contain non-printable control characters (typical of proprietary encrypted blobs or raw dumps).

Can file inspect files in bulk across a directory?

Yes. You can use standard wildcards: file * will inspect every file and folder in the current directory, or combine with find: find . -type f -exec file {} +.