How to View File Metadata Using the stat Command in Linux

When you run the standard ls -l command in the Linux terminal, you are only viewing a tiny fraction of the information the operating system actually knows about a file. It shows the basic owner, the file size, and a single timestamp. However, the Ext4 filesystem tracks significantly more metadata, including the exact millisecond a file was created, when its permissions were last modified, and its physical inode address on the hard drive. To extract this deeply hidden metadata, you must use the stat command.

How the stat Command Works

The stat (Status) command bypasses the high-level file name and directly interrogates the filesystem’s raw inode table. It dumps every single piece of metadata the kernel has stored regarding that specific file or directory.

To view the raw metadata of a file named critical_backup.tar.gz, run:

stat critical_backup.tar.gz

The terminal will output a highly detailed block of text containing multiple distinct data points.

Understanding the Three Timestamps (MAC)

The most powerful feature of the stat command is its ability to reveal the precise, microscopic history of a file by breaking down the MAC (Modify, Access, Change) timestamps.

• Access (atime): Displays the exact date and millisecond the file was last opened or read by a user or an application (even if they didn’t edit it).
• Modify (mtime): Displays the exact millisecond the actual contents of the file were changed (e.g., someone opened the text document, added a sentence, and saved it).
• Change (ctime): Displays the exact millisecond the file’s metadata was altered. This updates when a user changes the file permissions (using chmod) or changes the owner (using chown), regardless of whether the file’s contents were edited.

This level of precision is absolutely critical for digital forensics and security auditing, allowing you to prove exactly when a rogue user accessed a confidential database file.

Extracting Specific Metadata for Scripts

If you are writing a bash script and you only need one highly specific piece of information (like the raw file size in bytes), the massive block of text generated by stat is annoying to parse. You can use the -c (format) flag to forcefully instruct the command to only output a single, isolated variable.

To print only the numerical file permissions (e.g., 644 or 755), run:

stat -c "%a" critical_backup.tar.gz

To print only the user name of the person who owns the file, run:

stat -c "%U" critical_backup.tar.gz

This surgical extraction makes stat an indispensable tool for automating complex system administration tasks.