File System Hierarchy

First PublishedFeb 22, 2026ByAtif Alam

The Linux file system is a single tree rooted at /. The Filesystem Hierarchy Standard (FHS) defines the purpose of major directories. Understanding this layout and how filesystems work helps you navigate, troubleshoot full disks, and reason about where the kernel and boot files live (see Boot Process for /boot and the kernel).

Key directories (FHS)

Directory	Purpose
/	Root of the tree; contains top-level directories.
/bin	Essential user binaries (e.g. ls, cat). Often a symlink to /usr/bin.
/etc	System-wide configuration (e.g. /etc/fstab for mounts).
/var	Variable data: logs, caches, spool files.
/usr	User programs and read-only data; /usr/bin, /usr/lib, /usr/share.
/home	User home directories.
/tmp	Temporary files; often cleared on reboot.
/dev	Device files (block and character devices).
/proc	Pseudo-filesystem: process and kernel info (see below).
/sys	Pseudo-filesystem: kernel objects, devices, drivers (see below).
/mnt	Traditional mount point for temporarily mounted filesystems.
/media	Mount points for removable media.

/proc and /sys

/proc and /sys are not on disk; the kernel serves them. They expose runtime state:

• /proc — Per-process directories (/proc/<pid>/), system info (/proc/meminfo, /proc/cpuinfo), and more. For example, /proc/mounts lists currently mounted filesystems.
• /sys — Kernel objects, device topology, and tunables. Used by udev, sysfs, and tools like lsblk.

How filesystems work

A filesystem stores file data and metadata on a block device (disk or partition). Key concepts:

• Superblock — Stored at a fixed place; describes the filesystem (type, block count, block size, inode count).
• Inodes — One per file; store metadata (permissions, size, timestamps, pointers to data blocks). The filename is not in the inode; it lives in directory data.
• Directories — Special files whose content is a list of names and inode numbers. Lookup: resolve name → inode number → inode → data blocks.
• Blocks — Units of space for file data; size is fixed (e.g. 4 KiB). Large files use multiple blocks; indirect blocks can extend the pointer chain.
• Mounting — A filesystem on a device is attached to a directory (mount point). The root filesystem is mounted at / during boot; others are mounted per /etc/fstab or manually.

Common Linux filesystems: ext4 (default on many distros), XFS, btrfs. To see types: df -T or file -s /dev/sda1.

Reading a file (e.g. cat file.txt): open the directory, find the inode for file.txt, open that inode, read the block pointers, then read the data blocks from disk.

Relevant tools

Tool	Purpose
ls, tree	List directory contents.
stat	File/inode metadata.
df, du	Disk space (filesystem and directory usage).
mount, umount, findmnt	Mount and list mounts.
/etc/fstab	Static mount configuration.
lsblk, blkid	Block devices and UUIDs.
lsof	Open files (and which process has them).
cat, less, grep	View and search file content.
uname -r	Kernel release (e.g. for matching kernel modules or docs).

Using the tools

Navigation and inspection

• Use ls -la and tree to explore. stat <path> shows inode, size, blocks, and timestamps.
• Which disks are mounted: findmnt, mount, df, or read /proc/mounts. lsblk shows the block device tree and mount points.

Checking disk space / full drive

When a drive is full, applications may fail with “No space left on device”. Check:

1. Filesystem usage — df -h shows usage per mounted filesystem. High percentage or 100% means the filesystem is full.
2. Directory usage — du -sh /var/* (or other suspect directories) finds large trees. du -h --max-depth=1 helps narrow down.
3. Largest files — find /var -type f -exec du -h {} + 2>/dev/null | sort -rh | head -20 (adjust path). Alternatively use ncdu if available.

Freeing space: remove or rotate logs, clear caches, delete unneeded files, or extend the filesystem if using LVM.

Mounts and fstab

• Mount manually: mount /dev/sda1 /mnt (or by UUID with mount UUID=... /mnt). Unmount with umount /mnt.
• /etc/fstab defines mounts at boot. See Boot Process for how the root filesystem and fstab are used during boot.

Block devices and /proc, /sys

• lsblk and blkid show block devices and filesystem labels/UUIDs.
• Examples of pseudo-files: cat /proc/meminfo, cat /proc/uptime, ls /sys/block.

Open files

• lsof lists open files per process. lsof +D /var shows processes with files under /var. Useful when a “device busy” error prevents unmounting — find and close the process.