Getting back to your practice folder
Every exercise in this lesson happens inside the sandbox you created in Lesson 2. Open your terminal and go there now:
cd ~/linux-essentialsEverything below assumes you are sitting inside this folder. If a command ever looks like it did something unexpected, your first move should always be pwd to confirm where you actually are.
Absolute vs relative paths, properly this time
Lesson 2 introduced the difference between absolute and relative paths in passing. It is worth sitting with for a moment, because misreading a path is one of the most common ways people run a command against the wrong file entirely.
An absolute path starts from the very top of the filesystem, the root directory written as a single /, and spells out every folder in between. It always means the same location, no matter where your shell currently happens to be sitting. /home/alex/linux-essentials is an absolute path. A relative path has no leading / and instead means “starting from wherever I am right now.” notes, ../notes, and ./notes are all relative.
Two special relative names come up constantly:
mkdir -p project/subfolder
cd project/subfolder
pwd
cd .
pwd
cd ..
pwd
cd ~/linux-essentials. always means “this same directory,” so cd . is a no-op, you stay put. .. always means “the parent of this directory,” one level up. You will see both symbols again in a moment when you look at hidden entries with ls -a, because every directory on a Linux system quietly contains a . and a .. entry pointing at itself and its parent.
Reading a path carefully matters more than it sounds like it should. rm notes and rm ../notes are one character apart and can delete two completely different things depending on where you are standing when you run them. When in doubt, run pwd first, or just use the absolute path and remove the ambiguity entirely.
Hidden files: what dotfiles are, and why defenders care
Run this inside your practice folder:
touch .hidden-config
ls
ls -aPlain ls shows your project folder from a moment ago, but not .hidden-config; ls -a shows all of it, project, .hidden-config, and the ever-present . and .. entries. Lesson 2 mentioned that ls -a reveals entries whose name starts with a dot, and that plain ls hides them. That convention exists for an ordinary reason: most dotfiles are configuration and state, things like .bashrc or .gitconfig, that you rarely need to see while just browsing for your actual work, so the tools quietly keep them out of the way by default.
That same convention is exactly why dotfiles matter to a defender. A folder that is quiet by default is a folder people stop looking at closely. Malware authors and intruders know this, and it shows up in real incidents: a payload dropped as .cache, a cron job pointed at a script tucked inside .config/systemd/.hidden/, a backdoor named to look like a routine dotfile rather than anything suspicious. None of this is exotic or hard to pull off; it works precisely because the default view of a directory does not show it. The practical habit worth building right now, while it is still low stakes, is this: when you are actually investigating a system rather than just browsing it, ls -a is not optional. An unfamiliar dotfile, or a dotfile sitting somewhere it has no reason to be, is worth a second look every time.
Building structure: mkdir and touch
Two commands create things. mkdir makes directories, and you already used it with -p in Lesson 2 to create parent folders as needed:
mkdir -p reports/2024
ls -la reportstouch creates an empty file if it does not already exist, or just updates its modification time if it does:
touch reports/summary.txt
ls -la reportsBetween the two, you can build out any directory structure you need to practice with, entirely inside ~/linux-essentials, without touching anything real.
Copying, moving, and removing
cp copies a file, leaving the original in place:
cp reports/summary.txt reports/summary-backup.txt
ls -la reportsmv moves or renames a file; unlike cp, the original location stops existing once the move completes:
mv reports/summary-backup.txt reports/2024/summary-backup.txt
ls -la reports/2024rm removes a file outright:
rm reports/2024/summary-backup.txt
ls -la reports/2024Sit with that last one for a second, because it is the most important sentence in this lesson: rm has no undo. There is no recycle bin, no trash folder, no confirmation prompt waiting to save you by default. The file is simply gone. That is precisely why every single example in this lesson happens inside ~/linux-essentials: you can run rm here as many times as you like, get it wrong, and lose nothing that matters. The same command run one folder in the wrong direction, on a real system, against a real file, is unrecoverable. Never run a deletion you have not first double-checked with pwd and ls unless you are completely certain of both the path and the target.
To remove a whole directory, plain rm will refuse and tell you it is a directory. Add -r (recursive) to remove the directory and everything inside it:
mkdir scratch
touch scratch/throwaway.txt
rm -r scratch
ls -la-r is what makes rm dangerous at scale: one command, one flag, and an entire tree of files disappears with no second chance. Treat it with the same caution you would treat any irreversible action on a real system, even while you are safely practicing it here.
Wildcards: acting on many files at once
Real work rarely involves exactly one file at a time. Wildcards let a single command match a whole pattern of names. Create a few files to try this on:
touch app.log error.log access.log notes.txt readme.txt
lsThe * wildcard matches any sequence of characters, including none at all:
ls *.log
rm *.log
lsThat removed all three .log files in one command, and left the two .txt files untouched, because *.log only matches names ending in .log. The ? wildcard is narrower: it matches exactly one character, no more and no less:
touch notes.txt note1.txt note2.txt noteA.txt note10.txt
ls note?.txtnote?.txt matches notes.txt, note1.txt, note2.txt, and noteA.txt, each of which has exactly one character after note, but not note10.txt, because ? matches exactly one character and 10 is two.
Wildcards are a genuine productivity gain, and also a genuine risk multiplier. rm *.log is fine when you have just confirmed, with a plain ls *.log, exactly which files that pattern matches. rm * typed in the wrong directory, in a hurry, matches everything in that directory with no distinction at all. The habit worth carrying forward is small but important: run the same pattern with ls first to see what it actually selects, before you ever run it with rm, mv, or anything else that changes or deletes files.
What to notice
.and..are not quirks ofls -a, they are real entries that exist in every directory and make relative navigation withcd ..possible in the first place.- Hidden files are a convention for reducing visual clutter, not a security boundary, which is exactly why attackers lean on them to stay unnoticed.
rmandrm -rare the two commands in this lesson most worth being a little afraid of. That caution is appropriate, and it should scale up, not down, once you leave the practice folder.