Overview
Linux organizes everything under a single tree starting at the root (/). Files, devices, and configuration all live somewhere in this hierarchy. This lesson gives a high-level map of the Linux filesystem, which later lessons explore directory by directory.
Learning objectives
- Describe the single-rooted Linux filesystem hierarchy.
- Identify the purpose of key top-level directories.
- Understand the "everything is a file" philosophy.
Core concept
Unlike systems with separate drive letters, Linux has one unified tree rooted at /. All storage, devices, and files appear somewhere within it. Key top-level directories include:
/— the root of everything./home— users' personal directories./etc— system-wide configuration files./var— variable data such as logs./bin,/usr— programs and system software./tmp— temporary files./dev,/proc,/sys— special virtual files representing devices and system state.
Linux famously treats "everything as a file" — even devices and system information are accessed through file-like paths.
How it works
Additional storage devices are mounted into the tree at a directory (a mount point) rather than appearing as separate drives, so the whole system remains one navigable hierarchy. The "everything is a file" model means you can read system state and interact with devices using the same tools you use for ordinary files — for example, kernel and process information appears as readable files under /proc. This consistency is a defining Linux trait.
Practical example
Starting at /, you can reach a user's config in /home/user, the system's network configuration under /etc, and recent logs under /var/log. Listing / shows the top-level directories; each is a branch of the single tree. Reading a file like /proc/cpuinfo returns CPU details as text — an illustration of system information exposed as a file.
Cybersecurity relevance
Knowing the filesystem map is essential for security work: configuration lives in /etc, logs in /var/log, user data in /home, and process/system state in /proc. During authorized assessment or incident response, you navigate directly to these locations to enumerate a system, find misconfigurations, or investigate activity. The upcoming lessons drill into /, /home, /etc, and /var specifically.
Common mistakes
- Expecting drive letters — Linux uses one tree with mount points, not
C:/D:. - Overlooking virtual filesystems like
/procand/sys, which expose live system state. - Not knowing where things live, slowing down enumeration and investigation.
Key takeaways
- Linux has a single filesystem tree rooted at
/; all files and devices live within it, with extra storage mounted in rather than shown as separate drives. - Key directories:
/home(users),/etc(config),/var(logs/variable data),/bin//usr(programs),/proc//sys//dev(virtual/device files). - "Everything is a file" lets you access devices and system state with ordinary file tools — a core Linux concept and a practical aid to security work.
Check your understanding
- How does the Linux filesystem handle additional storage devices, compared with drive letters?
- Which top-level directories would you check first for system configuration and for logs?