>

Identify Any File's Real Type with the file Command

Detect true file types from magic bytes, not from the filename extension.

LinuxfilemagicinspectiontypeLow risk
Run file suspicious-download.dat to print the real type, e.g. 'PE32 executable' or 'gzip compressed data'; add -b for terse output or -i for a MIME type.

01Command

Command
$ file suspicious-download.dat

02What it does

file reads the first bytes of a file and matches them against the magic database in /usr/share/misc/magic, so a renamed archive, a script posing as an image or a truncated download are all exposed instantly. It also reports architecture and linkage for executables and character-set information for text. This is the standard first step when inspecting unknown downloads or auditing what a script actually delivered.

03Risk

RiskLow risk
Requirementsfile package (preinstalled on most distros)
!Warning: Knowing a file's type does not make it safe — an executable identified as such can still be malware; do not execute unknown binaries.

04Undo

✓No undo needed — this command does not change persistent state.

05Sources

  • file(1) — determine file type
    Ubuntu manpages · community · 2026-09-17
    Evidence: Man page documents magic tests and options -b (brief), -i (mime), -L; confirms 'file', '-b' and 'magic' appear in the text.
  • file(1) — Debian man page
    Debian manpages · community · 2026-09-17
    Evidence: Man page header states 'file — determine file type' and describes MAGIC (the magic tests based on /usr/share/misc/magic); confirms MAGIC and file-identification behavior.

Last verified: 2026-09-19 · Category: Files & Folders