YanoSecYou list a folder and do not see the note you expected. Before concluding it is missing, check whether its name begins with a dot. Many Linux listing tools omit these names by default even though the files still exist.
A filesystem organizes stored files and directories. Its root directory / starts the Linux path tree. Your home directory holds your account's personal files. A hidden file is a file with a name that ordinary listings conventionally omit; this name alone says nothing about who may read its content.
Before you begin
- Recommended first
- Install Ubuntu LTS and open a terminal, Where practice is allowed, Reading and making files
- Estimated time
- 15 min reading, 15 min activity. Setup and optional practice may take longer.
- Where you work
- Use Bash in your owned Ubuntu practice environment as an ordinary user. The supplied text files use UTF-8, a text encoding; where shown, LC_ALL=C requests consistent text ordering. Work only under your own new ~/yanosec-lab directory, never a host share or personal/system file. Refuse an existing exercise destination rather than overwriting it. No account, paid platform, or remote target is required. Optional extensions take about 10–15 minutes and are not part of the time above. A virtual machine is optional. You can also finish the reasoning from the printed evidence.
- Without a lab
- The page supplies the files, source and text records needed for the activity. Without a shell, follow the numbered steps on paper, label each result as predicted, and use the separate evidence supplied by the question. Running commands can wait until your lab is available. Reading works without JavaScript. Answer checking needs JavaScript and a secure context, such as HTTPS; saving a correct result also needs usable browser storage. Missing tools, managed or mobile hosts, or a deferred guest setup never require buying a service. Keep owned lab files for review; do not use broad deletion.
After this lesson you can:
- Locate root, home and temporary storage in a path model.
- Explain what a dot-name listing convention does and does not protect.
- Inspect an owned archive before extracting into a fresh destination.
01Example
This fictional directory contains note.txt and .notes. Compare the two command forms. -a changes which names ls includes; it does not change file content or access rights. The shown entry order and display format are illustrative.
Command:
ls desk-home
Predicted visible entry:
note.txt
Command:
ls -a desk-home
Predicted entries include:
. .. .notes note.txt
The dot name exists in both states. Only the listing changes.02Names are clues, not proof
In this lesson, .notes begins with a dot, whereas note.txt ends with an extension, .txt. An extension is a filename suffix that often suggests a format. Neither a leading dot nor an extension changes the stored bytes by itself.
ls lists directory entries; ls -a includes dot names. The listing may also show . for the directory itself and .. for its parent. Making a name visible does not decrypt data or change read permission. Encryption transforms data to protect it; a naming convention does not perform that operation.
/tmp holds temporary files and may be cleaned by the system. Keep important notes somewhere intended for retention. /root is typically the administrator's home directory; it is different from / and from an ordinary user's home. You only inspect the supplied lab tree here.
A listing changes visibility, while the supplied .notes name stays stored in desk-home.Model. A teaching model drawn by hand. It shows the idea, not real tool output.
Read the full explanation below.
Ordinary listing omits dot entries.
Immutable supplied teaching corpus
| Name | Entry meaning |
|---|---|
| . | current directory |
| .. | parent directory |
| .notes | stored dot-name |
| note.txt | stored ordinary name |
Result
note.txtls shows note.txt; .notes remains in the supplied tree.
Follow the explanation
- ls shows note.txt; .notes remains in the supplied tree.
- ls -a includes ., .., .notes and note.txt without changing storage.
Read every state and value
1. ls shows note.txt; .notes remains in the supplied tree.
- View
- ordinary
- Rows shown
- note.txt · stored ordinary name
- Highlighted Cell Refs
- Row: note.txt · stored ordinary name; Column: Name
- Result rows
- Source Row: note.txt · stored ordinary name; Cells: note.txt
2. ls -a includes ., .., .notes and note.txt without changing storage.
- View
- all
- Rows shown
- . · current directory · .. · parent directory · .notes · stored dot-name · note.txt · stored ordinary name
- Highlighted Cell Refs
- Row: .notes · stored dot-name; Column: Name
- Result rows
- Source Row: . · current directory; Cells: . · Source Row: .. · parent directory; Cells: .. · Source Row: .notes · stored dot-name; Cells: .notes · Source Row: note.txt · stored ordinary name; Cells: note.txt
03Try the owned home archive
The inventory below contains every file in the supplied desk-home archive, including the dot name and its complete text. The archive bundles entries; gzip compression makes the bundle smaller. Compression does not encrypt it.
Read the archive guide before the numbered steps. In the paper route, use the inventory as the directory state: predict which names each ls form includes, then copy the printed .notes content into your notes. You can finish those comparisons while extraction remains deferred.
Names shown by two listing forms
The following is the complete content inventory of the supplied
desk-home archive. Use it to predict each listing without extraction.
A leading dot changes default name visibility; it does not transform
the stored content or grant and remove read permission.
Ordinary UTF-8 files, no live home data.
desk-home/note.txt: visible note (newline)
desk-home/.notes: private practice label (newline; not a secret)
Predicted ls desk-home: note.txt (hidden names omitted by default)
Predicted ls -a desk-home: ., .., .notes, note.txt (format may vary)
Root directory /: top of Linux path tree; not the root user.
Home /home/desk: fictional user directory; actual home varies.
/tmp: temporary storage; do not rely on permanent retention.
Question file: .notes; no encryption operation has occurred.
Does its leading dot make it encrypted or hidden from ordinary ls?
Read an owned archive before extracting it
An archive bundles named entries. Extracting writes those entries back
to disk. A .tar.gz file uses tar bundling plus gzip compression; neither
operation encrypts the content. Use only the supplied owned archives.
All supplied archives contain original ordinary text files under one
named directory. No symlinks, executables with special modes, devices,
absolute paths or parent traversal entries are authored. Inspect first.
Save the chosen archive in the GUEST Downloads folder. If its actual
location differs, use that quoted absolute path; do not guess.
Use a new destination beneath ~/yanosec-lab, never an existing folder.
Example templates (replace ARCHIVE.tar.gz and NEW-DEST):
tar -tzf ~/Downloads/ARCHIVE.tar.gz
mkdir ~/yanosec-lab/NEW-DEST
tar -xzf ~/Downloads/ARCHIVE.tar.gz -C ~/yanosec-lab/NEW-DEST
Run the extraction only if mkdir succeeded and inventory matches.
t lists; x extracts; z handles gzip; f names archive; -C names target.
Keep original data; do not use sudo, overwrite flags or root extraction.
Stop on an unexpected path/link/member or download you cannot identify.
Fallback: read the full inline tree and contents; predict actions in notes.
Cleanup: leave scoped files for review; restore a guest baseline only
if all subsequent guest work is disposable. No broad rm command.
- Download desk-home.tar.gz into your guest Downloads or use its full printed contents. From your owned lab, inspect tar -tzf ~/Downloads/desk-home.tar.gz; expect only desk-home and its stated ordinary files.
- Create mkdir filesystem. Continue only if new; then extract with tar -xzf ~/Downloads/desk-home.tar.gz -C ~/yanosec-lab/filesystem. If Downloads differs, substitute its exact quoted absolute path.
- Compare ls filesystem/desk-home and ls -a filesystem/desk-home from the lab root. Formatting may differ.
- Read cat filesystem/desk-home/.notes. The same extract contained the line private practice label. Explain why being readable after -a is not a decryption event.
- On paper use the exact inventory to make the same predictions. Return to the lab root and keep the small folder; no host settings or system directories were changed.
04Optional challenge
Allow about ten extra minutes. Rename diary.txt to .diary.txt on paper. Identify what changes in a default listing and what does not change in the file content. Explain why permissions can limit access and why /tmp is a poor location for the only copy of an important note.
05Fresh cases for the checks
Use these fictional cases for the checks below. They have different inputs from the worked examples. Read them here or make notes; no installation or external service is needed.
Filesystem card A: supplied locationsOwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.
Account home: /home/luz
Paths to classify: /; /home/luz; /tmp/survey.txt; /root
Use the course Linux model. Do not inspect these paths on your computer.
Filesystem card B: fixed directory entriesOwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.
The owned folder cabinet contains only these named files:
agenda.txt; .draft; .settings
Compare ordinary ls cabinet with ls -a cabinet.
No rename, deletion, permission change or encryption occurs.
Ignore display order, columns, and the special . and .. entries for this comparison.
Filesystem card C: a rename, not a protection operationOwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.
An owned file ledger.txt is readable by another permitted user.
Its owner renames it to .ledger.txt in the same directory.
The bytes and permissions do not change; no encryption operation occurs.
Filesystem card D: inspect a fictional owned archiveOwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.
Complete expected manifest of kit.tar.gz:
kit/ directory
kit/readme.txt regular file
kit/.label regular file
The inspected manifest matches this inventory exactly; there are no linked members.
Candidate destination A: /home/bo/lab/review already contains earlier work.
Candidate destination B: /home/bo/lab/review-new has just been created empty.
Both destinations are owned by the learner. The task is to preserve earlier work.
Filesystem card E: a separate unexpected manifestOwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.
Expected inventory: parcel/ and parcel/note.txt, both ordinary owned entries.
Actual inspected entries: parcel/; parcel/note.txt; ../outside.txt
A new empty extraction destination is available. Extraction has not started.
06Explain visibility and storage choices
Optional self-check: explain why a missing ordinary listing entry does not prove deletion or protection. Then describe how you would choose a location for the only copy of important notes and a destination for an owned archive.
Review your explanation: distinguish dot-name visibility from content and permissions; avoid relying on temporary storage for the only retained copy; inspect every archive member; and use a new empty extraction destination. This explanation is self-reviewed.
07Common mistakes
If .notes seems missing, inspect the same directory with -a and verify the extracted root name. Do not assume hidden means nonexistent.
If tar lists an unexpected absolute, parent-traversal or linked member, stop extraction. The owned inventory and fallback are sufficient; do not use an overwrite or privileged extraction option.
If a filename extension conflicts with a file's behavior, inspect bytes with an appropriate read-only tool later rather than trusting the suffix. No actual malicious file is supplied.
References
- Ubuntu 24.04 packaged manual: ls(1)
Use the named command and option sections. This manual describes Ubuntu 24.04 packages; your installed version can differ. The lesson supplies the facts needed for its activity.
- Ubuntu 24.04 packaged manual: tar(1)
Use the named command and option sections. This manual describes Ubuntu 24.04 packages; your installed version can differ. The lesson supplies the facts needed for its activity.
- Ubuntu 24.04 packaged manual: bash(1)
Shell grammar, quoting, builtins, redirection and job control; use only the sections introduced in this lesson. Use the named command and option sections. This manual describes Ubuntu 24.04 packages; your installed version can differ. The lesson supplies the facts needed for its activity.