How to identify if a directory is created by Linux system and by user like root. Example: in /etc there is a directory named sys which is created by Linux. And I logged in using root and created the directory sys1. then how can I differentiate them?

Example : var is a system created directory where as test is a user created with user root.

drwxrwxrwx 34 root root 4096 Aug 25 22:52 var
drwxr-xr-x 2 root root 4096 Aug 25 23:19 test
  • ls -l (little L) will show the account and group owners.
    – Skrrp
    Commented Aug 25, 2015 at 9:52
  • 1
    how can i differentiate them? Let me think... by name? One is "sys", the other "sys1".
    – jimmij
    Commented Aug 25, 2015 at 9:59
  • on root / when i run ls -l i get following output. where 'var' is a system created directory and test is created by me as root user. drwxrwxrwx 34 root root 4096 Aug 25 22:52 var drwxr-xr-x 2 root root 4096 Aug 25 23:19 test Commented Aug 25, 2015 at 10:02
  • drwxrwxrwx 34 root root 4096 Aug 25 22:52 var - That is very wrong (drwxrwxrwx)
    – nkms
    Commented Aug 25, 2015 at 13:04

3 Answers 3


I don't think that there is a concept of "directory created by system". When you're installing your system, installation media often gets job done for you - you see the result(e.g. /etc directory created), but that really is done by user who happened to run script.

Anything created by "system" could be treated as created by root, but there's no way of telling if that was automated or not.

  • 1
    If you want to solve some problem and identifying creator of directory is one of steps, you may want to tell us your whole problem - you may be taking wrong approach. Commented Aug 25, 2015 at 10:06
  • I am not trying to solve any problem, it is just that Me and my friend were brainstorming the Linux concepts so we came up with this question. You answer does make sense. thank for it. Commented Aug 25, 2015 at 10:08
  • One thing that can help determine files that are from the base install is comparing their modify times. If the modify time is the same as when the OS was installed then the file originated from the installation.
    – Centimane
    Commented Aug 25, 2015 at 11:19
  • Dave - still not reliable, as touch can change their time stamp. Commented Aug 26, 2015 at 13:12

Depending on what you mean by "created by system", you may be able to use the packaging system to determine how a particular directory was created.

For example, on an RPM-based system (e.g. RedHat, Fedora, CentOS etc):

rpm -qf /var

will give something like


indicating it was installed as part of the filesystem package, whereas

rpm -qf /test

might give

file /test is not owned by any package

indicating that it's not part of the base install (though it may still have been created by a program, rather than a person).

Similarly for Apt-based systems (Debian, Ubuntu etc) you can use

dpkg -S /var

to perform the same check.


There is no difference between files (including directories) created by the system or by a user because in the end it is the same system call. Later on it is impossible to tell who was the owner of the process which created the file or directory. By the way, "the Linux system" is mostly the user root: there is no special user. Furthermore, installing always sets the owner of directories and files, so this would not be visible afterwards.

If you have a package manager you may find whether the directory was created by a package installation, e.g. with the Debian Package Manager:

dpkg -S /var

lists several packages which all would create the directory if not present. However,

dpkg -S /opt

does not list anything, although I can tell you that it was created by the system installer, either during the installation process or when running the post-install script of a certain package.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .