Basic file management

The shell expands globs, not the command

When you type rm *.txt, rm never sees an asterisk: the shell expands it and passes the resulting file names. * matches any run of characters including none, ? matches exactly one, [abc] matches one of a set and [!abc] matches anything outside it. A pattern that matches nothing is passed through unchanged by default, which is why a mistyped pattern produces a "no such file" naming the pattern itself.

Because expansion happens first, quoting a pattern hands it to the command literally — which is what find requires: find . -name "*.txt" must be quoted or the shell expands it in the current directory before find runs.

Moving things about safely

cp copies, with -r or -a needed for directories; -a additionally preserves permissions, timestamps and links, which is what you want for a backup. mv both moves and renames, since renaming is moving within a directory. rm deletes, -r recursively and -f without asking; rmdir removes only an empty directory, which is occasionally the safer tool. -i on any of these prompts before overwriting or deleting.

mkdir -p creates a whole path at once and does not complain if it already exists. touch creates an empty file or, on an existing one, updates its timestamps. file guesses a file's type from its contents rather than its name — the correct answer whenever a question notes that extensions mean nothing on Linux.

Archives and compression are two separate things

tar collects many files into one archive and does not compress by itself; gzip, bzip2 and xz compress a single file and do not archive. Combining them is why tar has compression flags: tar -czf a.tar.gz dir creates with gzip, -cjf uses bzip2, -cJf uses xz, and swapping c for x extracts while t lists. The f flag names the archive file and must come last in a bundled group, because the file name follows it.

Each compressor has three spellings and they are all one operation: gzip compresses and gunzip or gzip -d reverses it, bzip2 compresses and bunzip2 or bzip2 -d reverses it, xz compresses and unxz or xz -d reverses it. Every one of them REPLACES the file it was handed unless -k is given to keep it, so bunzip2 dump.sql.bz2 leaves dump.sql and no .bz2 behind. The -c flag writes to standard output instead, leaving the original alone. cpio is the older archiver that reads its file list from standard input, which is why it appears alongside find.

dd copies blocks rather than files and is the odd one out in this whole objective, because it takes no conventional options at all — every part of it is a key=value operand. dd if=source of=target names the input and output, and each falls back to standard input or standard output when it is left off. bs= sets the block size; count= stops the copy after that many INPUT blocks, so bs=1M count=100 copies exactly a hundred megabytes and no more; skip= skips blocks at the start of the input and seek= skips them at the start of the output, which is the pair most often confused; conv= asks for a transformation such as conv=notrunc. Nothing asks for confirmation and a block device accepts raw writes, which is why of= is the operand to read twice and why swapping if and of destroys the wrong disk.