How to View Deep File Metadata Using the stat Command in Linux

When you run the ls -l command on a Linux server, you only see a very basic, high-level overview of a file: its owner, basic permissions, byte size, and the date it was last modified. However, the Linux filesystem (ext4 or XFS) stores significantly more metadata behind the scenes, hidden inside a data structure known as the “inode”. To view the complete, raw metadata profile of any file or directory, you must use the stat (status) command.

How to View Full File Status

The command requires no complex flags for basic execution. Simply point it at any file or directory on your system:

stat /etc/passwd

The terminal will output a dense block of highly specific data. Here is what the most important fields mean:

• Size & Blocks: It shows the exact byte size, but more importantly, it shows exactly how many physical 512-byte filesystem blocks the file consumes on the hard drive.
• Inode: The unique index number the filesystem uses to track the physical location of the file’s data on the storage platter.
• Links: The number of hard links pointing to this exact inode.
• Access (Permissions): It displays the permissions in both the human-readable rwxr-xr-x format and the absolute numerical octal format (e.g., 0755), making it perfect for debugging security issues.

Understanding the Three Timestamps

The ls command only shows you one timestamp (usually when the file was last modified). The stat command reveals all three timestamps tracked by the Linux kernel, down to the exact nanosecond.

• Access (atime): The exact time the file was last read or opened by a user or an application.
• Modify (mtime): The exact time the actual contents (the data payload) of the file were last changed or saved.
• Change (ctime): The exact time the metadata of the file was altered. If you use chmod to change a file’s permissions, the data is untouched (mtime remains the same), but the ctime will update to reflect the security change.

Formatting the Output for Bash Scripts

If you are writing an automated bash script—for example, a script that triggers an alert if a file’s permissions are insecure—parsing the massive default output block is difficult. You can use the -c (format) flag to instruct stat to extract only one specific piece of metadata.

To extract only the numerical octal permissions of a file (ignoring the timestamps and inodes entirely), run:

stat -c "%a" /etc/passwd

This will cleanly output a single number, like 644, which can be easily captured by a bash variable for further processing.