Linux filesystem and paths
Locate files consistently and distinguish logical paths from their targets.
The idea
Linux presents a filesystem hierarchy rooted at /. Absolute paths begin at that root; relative paths are interpreted from a current directory. Common directories organize configuration, user data, temporary data, and logs, though distributions and applications can differ. Symbolic links point to another path, so the name you access and the underlying target may differ. Investigators should record full paths and relevant filesystem context rather than only filenames.
In practice
Two files named config.json exist in different application directories. A report records the full path, host, and timestamp to distinguish them.
A common misunderstanding
A filename is not a unique identity across a system, and a temporary directory is not necessarily a safe permanent storage location.
Check your understanding
Why record an absolute path in evidence notes?
Think it through: It removes ambiguity about which location was examined and helps another analyst reproduce the observation.
A path describes a lookup in a context
A fictional analyst examines an application configuration on a Linux host. Recording only config.json leaves ambiguity because several applications use that filename. Record the host and full path, then consider whether symbolic links or mounted filesystems affect the location actually accessed. The visible name and underlying object are related but not always identical.
Relative paths depend on a process's working directory. A script launched manually and the same script launched by a service manager may start in different locations. An unexpected missing-file error can therefore be a context problem rather than evidence that the file disappeared. Inspect the execution environment before changing paths or permissions.
Directory structure also expresses operational intent. Configuration, logs, temporary work, and user data commonly live in different areas, but applications and distributions vary. Use documentation and observed configuration rather than assuming a familiar directory name proves its contents or trust level.
Trace a harmless file lookup
In a dedicated lab folder, create two subdirectories with identically named dummy files. Write down their absolute paths and demonstrate how changing directories affects a relative lookup. Add a symbolic link and explain which path names the link and which names its target.
For evidence work, preserve the relevant context before copying or modifying files. A copied file may not retain every metadata property, and a live path can change while the system runs. Record the acquisition method appropriate to the task. The beginner's goal is not to memorize every directory but to understand how names resolve and how to describe the exact object examined, allowing another analyst to reproduce the observation without guessing.
Keep exploring
References & further reading
Original explanations, with primary references for deeper study.
GNU Coreutils manualLinux man-pages: Path resolution