Identify files by their magic numbers using the file command. 23.11.2025 | reading time: 2 min The `file` command inspects the leading bytes of a file and reports its type using a magic database; learn to trust signatures, not extensions, and spot mismatches early. Quick lab Reproduce this short session on a shell to see `file` in action. Run the commands shown and then inspect the results with `file`:\n```bash\n$ echo "Hello world" > hello.txt\n$ printf '\\x89PNG\\r\\n\\x1a\\n' > image.png\n$ gzip -c hello.txt > archive.gz\n$ file hello.txt image.png archive.gz /bin/ls\n```\nTypical output follows; results vary by system and file contents:\n```bash\nhello.txt: ASCII text\nimage.png: PNG image data\narchive.gz: gzip compressed data, was "hello.txt"\n/bin/ls: ELF 64-bit LSB shared object, x86-64\n``` Options worth trying Try `file -b` for brief output, `file -i` or `file --mime-type` to get MIME types, `file -z` to peek inside compressed archives, `file -k` to continue matching after the first hit, and `file -L` to follow symlinks; consult the magic database usually at `/usr/share/file/magic` to see what signatures are consulted. Companion tools When `file` reports something surprising, open the bytes with `hexdump` or `xxd`, search printable content with `strings`, or run `binwalk` for embedded firmware analysis; these tools let the investigator prove or disprove a `file` guess. Where to next Mastering `file` sharpens fast triage on a Linux system; practice with varied samples, read the magic entries, and consider formal study such as CompTIA Linux+ or LPIC-1 for deeper system knowledge and exam readiness at bitsandbytes.academy. Join Bits & Bytes Academy First class LINUX exam preparation. utilities filesystem scripting troubleshooting storage
