Files in red, what do they mean

Question

What does it mean when a file is in red. I change into one of my directories and run ls and it shows these files I've never seen in red. duplicity-full.20120405T013825Z.vol10.difftar.gz and goes all the way to vol 20. What does this mean?

Solution 1

Red means the file is compressed. The .gz extension means it was gzipped.

Solution 2

What it probably means is that ls is aliased to ls --color=auto or ls --color=always. To check whether this is the case, you can run command ls, or /bin/ls, to get around the aliasing (and, if I'm right, it should print without special colors).

That being said, one of the ways you can figure out what the color means is through the documentation for ls, and by running dircolors. Or you can simply run file on the file to see what kind of thing your computer thinks the file is (IIRC, ls uses file to determine how it should colorize).

Incidentally, coloring can change based on terminal, platform, and shell, but red usually means either that the file is an archive, or that it is an executable.

Hope that helps.

Solution 3

A *.gz file is an archive, and I assume that you're accessing via terminal (there's no info to suggest that you're accessing via GUI).

Files highlighed in red in the terminal are archives, and are normally used by some applications to back-up their content.

Looking at the file names, they seem to be backups of your hard disk. If you never intended to use Duplicity, then I strongly advise you to run a full virus/malware/spyware scan on your system, and to take your system offline while doing so. If possible, have a look at your network logs to see if these files are being sent out; if so, this means that hackers are stealing your data.

It should be noted that the actual file type can differ from the extension (after all, the extension is mostly there to be human-readable)- the actual file type is stored as a signature within the file (these are also known as "magic bytes" and "magic numbers"). You can find out about these signatures here.

Also, your example file seems to have been created on 4th May 2012 (or 5th April 2012, if you're European), so they're extremely old (by the standards of backups). Ask anyone else who had access to the system on this date if they know anything about this.

Comments

[mpez0]

Try "man ls" to see what ls output means.

[AStopher]

It means more than that, especially if the OP didn't use the Duplicity tool to create these backups (that's what these archives are. See my answer for more info.

[Rodney Salcedo]

Also broken symbolic links are colored red, at least on my system (alias ls='ls --color=auto').