Is it normal to have a hidden file named .file in /?
You can query the package receipt database.

pkgutil --file-info /.file


on a machine running OS X 10.6 the results are

volume: /
path: /.file

pkgid: com.apple.pkg.BaseSystem
pkg-version: 10.6.0.1.1.1249291854
install-time: 1252683091
uid: 0
gid: 80
mode: 0

pkgid: com.apple.pkg.Essentials
pkg-version: 10.6.0.1.1.1249291854
install-time: 1252683099
uid: 0
gid: 80
mode: 0