arrow_backBack to field notes
DIGITAL FORENSICS Published 9 Aug 2026

Getting Started With the Linux Command Line

A practical glossary entry covering the Linux shell basics: navigation, file operations, permissions, and the habits that make you fast at it.

The command line is a text interface for talking directly to the operating system. Instead of clicking icons, you type instructions to a shell, and the shell runs them. On most Linux distributions that shell is bash, though zsh has become common too, especially since it's the default on macOS and increasingly popular in Linux setups. Learning the command line isn't about memorizing hundreds of commands. It's about internalizing a small set of tools and combining them well.

What the shell actually does

When you open a terminal, you're running a terminal emulator, and inside it a shell process is waiting for input. You type a command, hit enter, and the shell parses it, finds the program you named, and runs it with whatever arguments you gave. Output comes back as text. That's the entire loop. Understanding this separation between terminal (the window) and shell (the program interpreting your text) clears up a lot of early confusion.

Moving around and looking at things

Four commands cover most early navigation:

pwd          # print working directory
ls -la       # list files, including hidden ones, with details
cd projects  # change into a directory
cd ..        # go up one level

ls -la is worth typing out fully at first rather than relying on aliases, so you get used to seeing permissions, ownership, and file sizes in the output. The leading d or - in the permission string tells you if something is a directory or a regular file, which trips up a lot of beginners early on.

Reading and manipulating files

cat somefile.txt dumps a whole file to the screen. For anything longer, less somefile.txt lets you scroll and search with /pattern. head -n 20 file.log and tail -n 20 file.log show the first or last lines, and tail -f file.log follows a file as new lines get appended, which is how you watch a log in real time during debugging.

Copying, moving, and deleting use cp, mv, and rm:

cp report.txt report.bak
mv report.bak archive/
rm archive/report.bak

rm doesn't move things to a trash bin. It deletes them. Adding -i makes it ask for confirmation, which is a reasonable habit while you're still building muscle memory.

Permissions, without the mystery

Running ls -l on a file shows something like -rwxr-xr--. Break it into three groups of three: owner, group, others. Each group has read, write, execute. chmod 755 script.sh sets owner to read/write/execute (7), and group/others to read/execute (5). chmod +x script.sh is a shortcut for making a file executable without recalculating the full number. chown changes who owns a file, and usually needs sudo unless it's your own file already.

Piping and redirection

This is where the command line stops being a file browser and starts being a real tool. The pipe | sends the output of one command into another:

ps aux | grep nginx
ls -la | wc -l
cat access.log | grep 404 | sort | uniq -c | sort -rn

That last one counts how many times each 404-generating line appears in a log and sorts by frequency, built entirely from small commands chained together. Redirection with > and >> sends output to a file instead of the screen: > overwrites, >> appends. 2> redirects error output specifically, which matters once you start writing scripts that need to separate normal output from errors.

Finding things

find searches by name, type, or modification time:

find /var/log -name

Written with AI assistance, reviewed and published by Michal Pilch (CISSP), Korra Studio.

Ready to go further?

This is one note from the Korra Studio knowledge base — the platform pairs every topic with 1-to-1 mentoring.

Get started freearrow_forward