file – show the type of a file in Unix
file is one of the basic Unix commands which helps you confirm exactly what kind of files you’re working with. Using a special database of signatures for various types of files, it reads the first few bytes of a specified file and shows you whether it matches one of the signatures, thus confirming the file type.
file command: basic usage
The simplest way to use the file command is to run it and specify one or more file names as command line parameters. The file type description you expect will be given in plan English, showing you whether a file is a script or an executable, an ASCII text or a binary data:
rhel$ file /etc/passwd rhel$ file /bin/csh rhel$ file /bin/tcsh /bin/tcsh: ELF 64-bit LSB executable, AMD x86-64, version 1 (SYSV), for GNU/Linux 2.4.0, dynamically linked (uses shared libs), stripped
Examples of file types in Linux
Playing with the file command is fun. You can identify all sorts of files with this little command, but it’s important to be able to read its output correctly.
Below I give you just a few most common file types examples, taken from a Red Hat Enterprise System (RHEL).
This is how a typical shared library will be identified:
rhel$ file /lib/libc-2.3.2.so /lib/libc-2.3.2.so: ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV), not stripped
Note the 32-bit which confirms the bit-ness of this file and the Intel 80386 which confirms the architecture.
That’s the same library in 64bit:
rhel$ file /lib64/libc-2.3.2.so /lib64/libc-2.3.2.so: ELF 64-bit LSB shared object, AMD x86-64, version 1 (SYSV), not stripped
See how 32-bit is now changed to 64-bit, and AMD x86-64 shows the new architecture for it?
Binaries will look somewhat different, although the bit-ness and architecture will still be shown:
rhel$ file /bin/ls /bin/ls: ELF 64-bit LSB executable, AMD x86-64, version 1 (SYSV), for GNU/Linux 2.4.0, dynamically linked (uses shared libs), stripped
In this example, the important field is executable, which confirms this is a file you can run (vs previous example with shared objects which you can’t run directly)
Examples of file types in SPARC Solaris
Just to show you that Unix file formats aren’t this different, here’s a few examples from SPARC Solaris 10 system.
First, a library – in 32bit and 64 bit forms:
sparc$ file /lib/libc.so /lib/libc.so: ELF 32-bit MSB dynamic lib SPARC32PLUS Version 1, V8+ Required, dynamically linked, not stripped, no debugging information available sparc$ file /lib/64/libc.so /lib/64/libc.so: ELF 64-bit MSB dynamic lib SPARCV9 Version 1, dynamically linked, not stripped, no debugging information available
Observe how bit-ness is still shown where you’d expect to see it, as well as SPARC-based architecture (SPARC32PLUS for 32bit and SPARCV9 for 64-bit).
Here’s how a kernel driver will look:
sparc$ file /kernel/drv/sparcv9/zfs /kernel/drv/sparcv9/zfs: ELF 64-bit MSB relocatable SPARCV9 Version 1
And that’s how a typical SPARC Solaris binary is identified:
sparc$ file /bin/ls /bin/ls: ELF 32-bit MSB executable SPARC Version 1, dynamically linked, stripped