If you use the standard ls -l command in the Linux terminal, you will see a file’s basic permissions, its owner, its size, and the date it was last modified. However, this is only a tiny fraction of the metadata the Linux filesystem actually stores. If you need to deeply analyze a file for security auditing or troubleshooting—such as finding the exact millisecond a file was accessed or identifying its precise inode number—you must use the stat command.
How to Use the stat Command
The stat (status) command acts like an x-ray for your filesystem, pulling up the raw, granular metadata associated with any file or directory.
- Open your Linux terminal.
- Type the command followed by the name of the file you want to investigate. For example:
stat config.php
Press Enter.
Understanding the Output
Unlike the single-line output of ls -l, the stat command will output a dense, multi-line block of information. Here is what the critical fields mean:
- File: The exact name and path of the file.
- Size: The exact size of the file in bytes.
- Blocks/IO Block: How the file is physically stored on the hard drive.
- Device & Inode: The hexadecimal device ID and the unique Inode number (the internal serial number the filesystem uses to track the file).
- Links: The number of hard links pointing to this specific Inode.
- Access: The specific octal file permissions (e.g.,
0644/-rw-r--r--). - Uid/Gid: The user ID and Group ID of the file’s owner.
The Three Timestamps
The most powerful feature of the stat command is its ability to display all three highly precise Linux timestamps simultaneously down to the exact nanosecond:
- Access (atime): The exact time the file was last opened or read by a user or a script.
- Modify (mtime): The exact time the actual contents of the file were last edited or changed.
- Change (ctime): The exact time the file’s metadata (such as its permissions or its owner) was last changed, even if the contents remained untouched.
By analyzing these three distinct timestamps, system administrators can easily determine if a file was merely viewed, or if it was maliciously altered by an unauthorized user.