File & Directory Operations

Introduction

Creating, copying, moving, and removing files are the most basic filesystem operations — and among the most dangerous when done carelessly. In forensic triage, incident response, or shared lab environments, these commands demand discipline. A misplaced rm -rf, an overwritten evidence file, or a temporary file left readable by other users can compromise an investigation or break a system.

This note covers mktemp, mkdir, cp, mv, and rm with a focus on safe practices, forensic integrity, and operational awareness.

mktemp — Isolated Environments

mktemp creates a uniquely named temporary file or directory in a safe location — typically /tmp. The randomised suffix prevents collisions with other processes or users sharing the same system.

Creating Temporary Files and Directories

mktemp                          # Creates a temporary file in /tmp
mktemp -d                       # Creates a temporary directory
my_workspace=$(mktemp -d)       # Capture the path in a variable

The path is printed to stdout, which is why capturing it in a variable is the standard pattern:

tmpdir=$(mktemp -d)
cp /var/log/auth.log "$tmpdir/"
# ... work on the copy ...
rm -rf "$tmpdir"

Custom Naming and Locations

By default, mktemp uses a template like tmp.XXXXXXXXXX in /tmp. You can override both:

mktemp /tmp/analysis_XXXXXX              # Custom prefix in /tmp
mktemp -t analysis_XXXXXX               # Same — -t uses $TMPDIR or /tmp
mktemp -d /opt/evidence/capture_XXXXXX   # Custom location for directories

The X characters are replaced with random alphanumeric values. At least three Xs are required for sufficient uniqueness.

Forensic Workflow Pattern

When triaging a suspicious system, work on copies — never on originals:

evidence_dir=$(mktemp -d /tmp/evidence_XXXXXX)
cp -a /var/log/* "$evidence_dir/"
chmod 700 "$evidence_dir"
# ... analyse within $evidence_dir ...

This keeps your work isolated, prevents naming collisions with previous triage runs, and makes cleanup trivial — rm -rf "$evidence_dir" removes everything in one command.

Key Flags

Security note: Temporary files created with mktemp have restrictive permissions by default — only the creating user can read or write them. This prevents other users on a shared system from snooping on your working data.

mkdir — Directory Creation

mkdir creates new directories. Its most important flag is -p, which creates parent directories as needed and silently succeeds if the target already exists.

Recursive Creation

mkdir -p /opt/evidence/2024/03/case_47

This creates the entire path — evidence, 2024, 03, case_47 — in one command, regardless of which intermediate directories already exist.

Without -p, mkdir fails if any parent directory is missing:

mkdir /opt/evidence/2024/03/case_47    # Fails if /opt/evidence/2024/03 doesn't exist

Setting Permissions at Creation

mkdir -m 700 /opt/evidence/sensitive   # Create with restricted permissions

The -m flag sets permissions directly — no need for a separate chmod call. Mode 700 means the owner has full access and everyone else is locked out.

Key Flags

Scripting note: mkdir -p is idempotent — running it twice produces the same result without error. This makes it safe in automated workflows where the directory’s existence isn’t guaranteed.

cp — Copying with Integrity

cp copies files and directories. In forensic and security work, the flags you choose determine whether the copy is faithful to the original or a loose approximation.

Archive Mode

The -a flag (archive) is the forensic standard for copying. It preserves everything — permissions, ownership, timestamps, symbolic links, and extended attributes:

cp -a /var/log/auth.log /tmp/evidence/auth.log.bak
cp -a /etc/ /tmp/evidence/etc_backup/

Without -a, copied files receive new timestamps and may lose ownership or permission data — unacceptable when preserving evidence integrity.

Recursive Copying

cp -r /etc/nginx/ /tmp/nginx_backup/      # Copy directory tree
cp -a /etc/nginx/ /tmp/nginx_backup/       # Same, but preserves metadata

Use -a instead of -r whenever metadata matters. In practice, -a subsumes -r — it copies recursively and preserves attributes.

Interactive and Safe Copying

cp -i important.conf /etc/important.conf   # Prompt before overwriting
cp -n data.txt /backup/data.txt            # Never overwrite — skip silently
cp --backup=numbered data.txt /backup/     # Create numbered backups of existing files

Copying Across Filesystems

cp handles cross-filesystem copies transparently — /tmp (often tmpfs) to /opt (often a physical disk) works without flags. However, when copying device files or special filesystem objects, use cp --preserve=all to retain extended attributes that -a might not cover on certain systems.

Key Flags

Forensic standard: Always use cp -a when copying evidence. If you need to prove the copy is identical to the original, follow with a hash comparison:

cp -a /var/log/auth.log /tmp/evidence/
sha256sum /var/log/auth.log /tmp/evidence/auth.log

mv — Moving and Renaming

mv relocates or renames files and directories. Within the same filesystem, it’s an instant metadata operation — no data is copied. Across filesystems, it behaves like cp followed by rm.

Basic Usage

mv old_name.txt new_name.txt          # Rename
mv report.txt /opt/reports/           # Move to a different directory
mv *.log /var/log/archive/            # Move all .log files

Safe Moving

mv -i important.conf /etc/            # Prompt before overwriting
mv -n data.txt /backup/               # Never overwrite — skip silently
mv --backup=numbered file.txt /dest/  # Keep numbered backups of overwritten files

Moving Across Filesystems

When source and destination are on different filesystems, mv silently falls back to copy-then-delete. This means:

• Metadata may not be preserved unless you use cp -a explicitly
• Large files will take time proportional to their size
• The operation is not atomic — there’s a window where both copies exist

For cross-filesystem moves where metadata matters, do it explicitly:

cp -a /tmp/staging/evidence.tar.gz /opt/evidence/
rm /tmp/staging/evidence.tar.gz

Key Flags

Gotcha: mv -f is the default. Unlike cp, there’s no implicit prompting unless you add -i. If you’re scripting, always use -i or -n to prevent accidental overwrites.

rm — Removal

rm deletes files and directories. It is permanent — there is no trash bin, no undo, no recovery window. On Linux, rm unlinks the inode immediately. Once the filesystem reclaims those blocks, the data is gone.

Removing Files

rm file.txt                    # Remove a single file
rm -i file.txt                 # Prompt before removal
rm -f nonexistent.txt          # Suppress errors if file doesn't exist

Removing Directories

rm -r directory/               # Recursively remove directory and contents
rm -rf directory/              # Force — no prompts, suppress errors
rm -ri directory/              # Interactive — prompt before each removal

The Danger of rm -rf

rm -rf is the most destructive command in Linux. A single typo can erase an entire system:

# This destroys your system:
rm -rf / home/user/data        # Space between / and home makes / the target

# This is what was intended:
rm -rf /home/user/data

Mitigations:

# 1. Use -i for interactive confirmation:
rm -ri directory/

# 2. Define an alias in your shell profile:
alias rm='rm -i'

# 3. Use a safe delete wrapper:
safe_rm() {
    local target
    for target in "$@"; do
        if [[ "$target" == "/" || "$target" == "/*" ]]; then
            echo "Refusing to remove $target"
            return 1
        fi
    done
    command rm -i "$@"
}

Lab discipline: In a shared EVE-NG or forensic lab environment, never run rm -rf without first listing what will be deleted. Use ls to verify the target, or prepend echo to dry-run:

echo rm -rf /tmp/evidence_*    # Preview what would be deleted
rm -rf /tmp/evidence_*         # Execute only after verification

Key Flags

-i vs -I: Use -i when working on critical files — it confirms every single deletion. Use -I when batch-deleting many files — it asks once for the whole operation and only if more than three files are involved. This is a good default for interactive shell sessions:

alias rm='rm -I'

Bonus: touch — Timestamp Manipulation

touch creates empty files or updates an existing file’s timestamps without modifying its content. It’s lighter than echo "" > file and more precise.

Creating Empty Files

touch newfile.txt                  # Create an empty file
touch /tmp/evidence/markers/{a,b,c}.txt   # Create multiple files at once

Updating Timestamps

touch -t 202403150930 report.txt   # Set timestamp to 2024-03-15 09:30
touch -r reference.txt target.txt  # Copy timestamp from reference file
touch -d "2 hours ago" log.txt     # Set to relative time

Forensic Context

touch can be used to verify timestamp behaviour — set a known timestamp, then check how a tool or process interacts with file modification times. It’s also useful for creating placeholder files during evidence staging.

Key Flags

Forensic Copying Workflow

A complete evidence collection pattern combining these tools:

# Step 1: Create an isolated working directory
evidence=$(mktemp -d /tmp/evidence_XXXXXX)
chmod 700 "$evidence"

# Step 2: Copy with full metadata preservation
cp -a /var/log/ "$evidence/logs/"
cp -a /etc/passwd "$evidence/"
cp -a /etc/shadow "$evidence/"

# Step 3: Verify integrity
sha256sum /var/log/auth.log "$evidence/logs/auth.log"
find "$evidence" -type f -exec sha256sum {} \; > "$evidence/hashes.txt"

# Step 4: Restrict access
chmod -R 400 "$evidence"

# Step 5: When done — clean removal
rm -ri "$evidence"

Tool Comparison

Core principle: rm is the only truly irreversible operation here. Treat it with appropriate caution — every other mistake can be recovered from.