How to Use the stat Command in Linux to Inspect File Metadata and Inodes

While the standard ls -l command provides a quick summary of file sizes, owners, and permissions in Linux, it omits critical filesystem details needed for forensic analysis, backup verification, and debugging. When tracking down exactly when a file was created versus modified, checking underlying inode numbers, verifying storage block allocations, or extracting octal permissions for shell scripts, the stat command is the definitive tool.

Included in GNU Coreutils across all major Linux distributions, stat reads raw inode and superblock data directly from the filesystem kernel layer. In this guide, we examine standard stat output, demystify the four essential Linux timestamps (atime, mtime, ctime, and btime), format custom outputs, and inspect filesystem metadata.

Standard Output of the stat Command Explained

To inspect any file, directory, or socket, execute stat followed by the target path:

stat /var/log/syslog

Linux returns a structured metadata report formatted as follows:

  File: /var/log/syslog
  Size: 1048576   	Blocks: 2048       IO Block: 4096   regular file
Device: 8,1       	Inode: 142058      Links: 1
Access: (0640/-rw-r-----)  Uid: ( 104/ syslog)   Gid: (   4/    adm)
Access: 2026-10-10 14:22:15.124589000 +0000
Modify: 2026-10-10 14:20:00.000000000 +0000
Change: 2026-10-10 14:20:00.000000000 +0000
 Birth: 2026-10-01 08:00:00.000000000 +0000

Here is what each field represents:

Field Name	Technical Meaning	Administrative Utility
Size & Blocks	Apparent byte length vs physical 512-byte filesystem blocks allocated	Detecting sparse files and wasted storage allocation
IO Block	Optimal block size for filesystem I/O operations (typically 4096 bytes)	Performance tuning for high-throughput database storage
Inode	Unique index node number tracking the file on the partition	Hard link tracing and filesystem indexing
Links	Quantity of hard links pointing to this physical inode	Verifying shared file handles and directory structures
Access (Octal)	File permissions in numeric (e.g., 0640) and symbolic format	Auditing security compliance and script permission checks

When measuring total file records alongside metadata parameters, pairing inode inspection with the wc command in Linux allows administrators to verify row counts against byte allocations.

Demystifying the Four Linux Timestamps

One of stat‘s primary advantages is displaying nanosecond-accurate timestamps. Linux maintains four distinct time attributes:

• Access Time (atime): The last moment the file’s contents were read by an application (e.g., via cat, grep, or a backup daemon). Many modern systems mount disks with relatime to minimize disk writes.
• Modify Time (mtime): The last moment the file’s actual data contents were edited, written to, or truncated.
• Change Time (ctime): The last moment the file’s inode metadata changed (e.g., changing permissions with chmod, renaming the file, or changing owners with chown). ctime cannot be spoofed by user tools like touch.
• Birth Time (btime / crtime): The moment the file was initially created on the filesystem. Supported natively on modern filesystems like ext4, Btrfs, and XFS.

Extracting Custom Fields for Automation Scripts (–format)

Parsing human-readable text blocks inside shell scripts is inefficient. The stat command supports -c (or --format=) format specifiers to output only the exact values needed:

1. Printing Pure Octal Permissions

stat -c "%a" /etc/shadow

Returns: 640

2. Printing File Size in Bytes

stat -c "%s" archive.tar.gz

3. Printing Inode Number and Owner Name

stat -c "%i %U" myfile.txt

Inspecting Filesystem Status with stat -f

Appending the -f flag instructs stat to inspect the hosting filesystem partition rather than an individual file:

stat -f /

Output displays the filesystem magic type (e.g., ext2/ext3/ext4), total and free inode quantities, and block allocation limits across the disk partition.

If you encounter failing processes holding locked file descriptors discovered via metadata, pairing your inspection with the strace command in Linux reveals active filesystem syscalls in real time.

Frequently Asked Questions

Why does Birth Time (btime) display as ‘-‘ on some systems?

If btime shows a hyphen (-), the underlying filesystem format (such as older ext3 filesystems or NFS network shares) or Linux kernel version does not record file creation timestamps.

Can users manually alter the ctime timestamp using touch?

No. While the touch utility can artificially modify atime and mtime, the kernel automatically updates ctime to the current system clock whenever any modification occurs. This makes ctime a reliable indicator in security audits.

Does stat dereference symbolic links by default?

By default, running stat against a symlink displays metadata for the symlink itself. To follow the link and inspect the destination target file, pass the -L (dereference) flag: stat -L /path/to/symlink.