The Linux File System for Beginners

Linux does not organize storage the way Windows does. There are no drive letters like C:\ or D:\. Instead, everything — local disks, USB drives, network shares, even running processes — hangs off a single unified tree rooted at /. Once that mental model clicks, navigating any Linux system becomes intuitive.

The Root of Everything: /

The forward slash / is called the root directory. It is the top of the entire file system hierarchy. Every file and directory on a Linux machine lives somewhere beneath it. When you plug in a USB stick, it does not appear as a new drive letter — it gets attached (mounted) at a path inside this tree, such as /media/username/mydrive.

Run this command to list the top-level directories on your system:

ls /

You will see a predictable set of directories on almost any Linux distribution. Their layout is defined by the Filesystem Hierarchy Standard (FHS), which most distros follow closely.

Key Directories and What Lives in Them

/home — Your Personal Space

Each regular user gets a subdirectory here: /home/alice, /home/bob, and so on. Your shell configuration, downloads, documents, and application settings all live here. The shorthand ~ always expands to your own home directory.

echo ~
pwd   # run from a fresh terminal; should show /home/yourusername

The root user's home is not under /home — it is /root, kept separate for security and recovery reasons.

/bin, /usr/bin — Essential and User Commands

Executable programs (binaries) live here. Historically, /bin held commands needed for early boot and single-user recovery (ls, cp, bash), while /usr/bin held everything else. On modern distributions (Debian 12+, Fedora, Arch, Ubuntu 20.04+), /bin is a symbolic link to /usr/bin — the split no longer matters in practice.

ls -la /bin   # likely shows: /bin -> usr/bin

/etc — System-Wide Configuration

Plain-text configuration files for the OS and installed services live here. Examples: /etc/fstab (mount table), /etc/hostname, /etc/ssh/sshd_config. Editing files in /etc requires root privileges and affects every user on the machine.

/var — Variable Data

Data that grows and changes while the system runs: log files (/var/log), mail spools, package manager caches (/var/cache/apt or /var/cache/dnf), and database files. On busy servers, /var/log can fill a partition quickly — it is often given its own mount point.

/tmp — Temporary Files

Applications write scratch files here. On most modern systems /tmp is a tmpfs mount — it lives in RAM and is wiped on every reboot. Do not store anything here you need to keep.

findmnt /tmp   # shows tmpfs if your distro mounts it in RAM

/dev — Device Files

Every hardware device (and many virtual ones) appears here as a file. Your first SATA or NVMe disk is /dev/sda or /dev/nvme0n1; its partitions are /dev/sda1, /dev/sda2, etc. Writing to the wrong device file can destroy data, so tread carefully.

/proc and /sys — Kernel Interfaces

These are virtual file systems — the kernel generates their contents on the fly in memory; nothing is written to disk. /proc exposes running process information (/proc/1/status is PID 1, which is systemd on modern systems). /sys exposes kernel and hardware parameters you can sometimes tune by writing to them.

/boot — Bootloader and Kernel

The kernel image (vmlinuz-*), initial RAM disk (initrd or initramfs), and GRUB configuration live here. On UEFI systems you will also have a separate /boot/efi (or /efi) FAT32 partition. Avoid manually deleting files here.

/opt and /usr/local — Third-Party and Local Software

/opt is for self-contained third-party packages (a vendor might install their application entirely under /opt/vendor/). /usr/local is for software you compile and install yourself, keeping it separate from distribution-managed packages.

Understanding Mount Points

A mount point is just an existing directory where a storage device or file system is attached to the tree. When the kernel mounts a partition at /home, all reads and writes to paths under /home are redirected to that partition. The directory itself still exists in the root file system; mounting simply overlays it.

To see all currently mounted file systems:

findmnt          # tree view, very readable
mount | column -t  # traditional flat list

A typical desktop might have:

• / — the main partition (ext4, btrfs, or xfs)
• /boot/efi — the EFI system partition (FAT32)
• /home — optionally a separate partition so reinstalling the OS does not wipe user data
• tmpfs mounts at /tmp, /run, and /dev/shm

The file /etc/fstab tells the kernel what to mount at boot and where:

cat /etc/fstab

Each line has the format: device mountpoint fstype options dump pass. Modern systems increasingly use UUIDs instead of device names like /dev/sda1 so the mapping survives disk reordering.

Absolute vs. Relative Paths

An absolute path starts with / and fully describes the location from the root: /etc/ssh/sshd_config. A relative path is relative to your current working directory: if you are in /etc/ssh, you can refer to the same file as just sshd_config or ./sshd_config.

cd /etc/ssh
ls sshd_config    # relative — works because we are already here
ls /etc/ssh/sshd_config  # absolute — works from anywhere

Checking Disk Usage by Directory

Once you understand the tree, it is natural to ask where your disk space is going. Two commands cover most needs:

df -h          # free space per mounted file system
du -sh /*      # size of each top-level directory (run as root for accuracy)

df shows partition-level usage; du walks the directory tree and totals file sizes. If /var is enormous, check /var/log first.

Verification

Confirm you can navigate and interpret the tree correctly with these quick checks:

# Confirm your home directory
echo $HOME

# List mounted file systems in tree form
findmnt

# Find where a command binary actually lives
which ls
ls -la $(which ls)   # check for symlinks

Troubleshooting

"No space left on device" but df shows free space

You may have run out of inodes rather than blocks. Check with df -i. Directories containing millions of tiny files (mail spools, session caches) are common culprits. Alternatively, a separate /tmp or /var partition is full even though / has room — df -h will show this if you read every line, not just the last one.

USB drive not visible after plugging in

On a desktop with a modern session, udisks2 auto-mounts removable media under /media/$USER/. On a headless server it will not auto-mount; use lsblk to find the device name, create a mount point, and mount it manually:

lsblk                        # identify the device, e.g. /dev/sdb1
sudo mkdir -p /mnt/usb
sudo mount /dev/sdb1 /mnt/usb
ls /mnt/usb

Always unmount before physically removing the device: sudo umount /mnt/usb.

Confused by symlinks in /bin, /lib, etc.

On merged-usr systems, /bin, /sbin, /lib, and /lib64 are all symlinks into /usr. This is intentional. Use readlink -f /bin to see where a symlink ultimately resolves.