How to View File and System Status Using the stat Command in Linux

When you are executing a high-level forensic audit on a compromised Linux server, standard commands like ls -l are mathematically insufficient. They only provide surface-level data, such as basic read/write permissions and a simplified modification date. If you need to know the exact millisecond a file was accessed, the exact block size it occupies on the hard drive, or its highly specific cryptographic Inode number, you must force the kernel to bypass the graphical shell and dump the raw file system telemetry directly to your screen. To execute this deep architectural interrogation, you must use the stat command.

Executing a Deep File System Audit

The stat (Status) command is a diagnostic engine that rips the hidden metadata architecture entirely out of a file or directory and formats it into a highly dense, human-readable report.

To execute a deep scan on a highly sensitive configuration file (e.g., /etc/passwd), type:

stat /etc/passwd

The exact millisecond you execute this command, the terminal will instantly output a massive block of raw structural data:

• File: The absolute path of the target.
• Size: The exact mathematical byte count of the file.
• Blocks: The exact number of physical sectors the file occupies on the hard drive disk platter.
• IO Block: The optimal mathematical chunk size the kernel uses to read the file.
• Inode: The highly specific, mathematically unique identification number assigned to the file by the Linux kernel.
• Links: The exact number of hard links tethered to the file.
• Access (Permissions): The exact cryptographic permission string (e.g., 0644/-rw-r–r–).

Decoding the Triple Time Stamp

The most powerful capability of the stat engine is its ability to extract the absolute, millisecond-precise triple timestamp architecture (MAC times) of the file, which is critical for security audits.

The output will clearly define three highly distinct chronological events:

1. Access (atime): The exact millisecond the file was last opened or read by a user or a script. If a hacker opened the file to steal the data, this timestamp will prove it.
2. Modify (mtime): The exact millisecond the actual contents of the file were last altered or saved.
3. Change (ctime): The exact millisecond the file’s metadata (such as its permissions, ownership, or filename) was last altered, even if the contents remained completely untouched.

By comparing these three mathematically precise timestamps, a forensic engineer can reconstruct the exact sequence of events that occurred during a server breach.