Linux · reading files

head

the start of a file

head prints the beginning of a file and stops. It is how you look at what a file contains without printing all of it, and at the end of a pipe it cuts long output down to the first few lines.

A glance at the top is usually enough to know what kind of file you are holding.

Prints

The first 10 lines

unless -n says otherwise

Opposite

tail

prints the last lines

In a pipe

Limits output

command | head

By bytes

-c NUM

instead of lines

At the terminal

Read the session first, then the notes: each numbered line in the output is answered by the note with the same number.

user@netflow — bashcoreutils

$ head -n 3 data.csv

1id,name,department,salary

1,Asha,Engineering,72000

2,Ravi,Support,41000

2$ ls -t | head -1

report-2026-09-30.txt

3$ head -n -1 data.csv | wc -l

120

Illustrative session · names, sizes and dates are examples, and every address is from a documentation or private range

Reading the output

What the numbered lines are telling you

The header and two rows

Three lines are enough to see the columns and the shape of the data without scrolling through the rest.

head at the end of a pipe

ls -t lists newest first; head -1 keeps only the first line. Together: the most recently changed file.

A negative count

-n -1 means "everything except the last line". The file has 121 lines, so 120 are passed on.

Switches

A switch changes how the command behaves. These are the ones used day to day; man head lists the rest. Single-letter switches can usually be joined, so -l -a may be written -la.

-n NUM: Print the first NUM lines instead of 10.
-n -NUM: Print everything except the last NUM lines.
-c NUM: Print the first NUM bytes.
-q: Do not print a header with the file name when given several files.

Variations worth knowing

The same tool, pointed at a narrower question. These four cover most of what it is reached for day to day.

head -c 100 file.bin

Prints the first 100 bytes rather than lines.

head -n 5 *.log

Prints the start of several files, each under a header with its name.

head -n 20 app.log | tail -n 5

Prints lines 16 to 20.

dmesg | head

Shows just the start of a long output.

In cybersecurity

Looking at the start of a file is a safe way to identify it before trusting it.

Check what a file really is

A file named invoice.pdf that begins with "MZ" or "#!/bin/sh" is a program, not a document. head -c 16 piped to xxd shows the first bytes.

Read scripts before running them

The first lines of an install script show its interpreter and intent. Read the whole thing before piping it to a shell.

Avoid printing whole secrets

When checking that a key file exists and looks right, head -1 shows the header line without putting the key on screen.

Filed under

Reading files

Read alongside

tailPrints the last lines of a file, and with -f keeps printing new lines as they are written.catPrints the contents of a file to the terminal, or joins several files into one stream.