How to View Detailed File Metadata and Inode Details in Linux Using stat

While the standard ls -l command lists basic file permissions, owners, and file sizes, it only provides a surface-level glimpse of a file’s state. When troubleshooting filesystem inconsistencies, debugging cache invalidations, auditing security permissions, or writing automated shell scripts, administrators require deeper access to underlying inode metadata.

The native stat command, included in the standard GNU Coreutils package on every Linux system, displays exhaustive metadata for files, directories, and filesystems. It exposes exact byte allocations, inode numbers, hard link counts, octal permissions, and four distinct timestamp vectors (including file birth time on modern filesystems).

---

Basic Syntax and Default stat Output

To inspect a file’s complete metadata block, pass its path to stat:

stat /var/log/syslog

Linux returns a comprehensive diagnostic report:

  File: /var/log/syslog
  Size: 2489201    Blocks: 4864       IO Block: 4096   regular file
Device: 801h/2049d Inode: 524312      Links: 1
Access: (0640/-rw-r-----)  Uid: (  104/  syslog)   Gid: (    4/     adm)
Access: 2026-11-03 14:15:22.482019342 +0000
Modify: 2026-11-03 14:15:21.902019001 +0000
Change: 2026-11-03 14:15:21.902019001 +0000
 Birth: 2026-10-28 06:00:12.110294821 +0000

---

Interpreting Critical Inode Diagnostic Fields

Understanding the metrics reported by stat helps you diagnose disk allocation and security anomalies:

Report Field	Metric Description	Diagnostic Application
Size vs Blocks	Size is apparent byte length; Blocks indicates actual 512-byte filesystem blocks allocated.	Identify sparse files where apparent size is vastly larger than allocated disk blocks.
IO Block	The optimal block size for filesystem I/O operations (typically 4096 bytes).	Tuning high-performance database write buffers to align with native sector geometry.
Inode	The unique numeric identifier for the file on the underlying storage partition.	Track hard links sharing identical inodes or diagnose filesystem inode exhaustion.
Links	The number of directory directory entries (hard links) pointing to this inode.	Verify whether multiple filenames reference the exact same underlying file.
Access (Octal/Symbolic)	Displays numeric octal permissions alongside symbolic flags (e.g. 0640 vs -rw-r-----).	Instant, unambiguous permission verification for automated deployment scripts.

---

Understanding the Four File Timestamps

Unlike simple operating systems that only report a single “modified” date, Linux tracks four distinct lifecycle moments:

• Access (atime): The last time the file was read by an application, script, or system utility (such as cat or grep). Frequently mounted with relatime or noatime on SSDs to optimize performance.
• Modify (mtime): The last time the actual contents or data payload of the file were changed and saved.
• Change (ctime): The last time the file’s metadata or inode properties were modified (e.g. altering permissions with chmod, renaming the file, or changing ownership with chown).
• Birth (btime / crtime): The original creation timestamp of the file. Supported natively on modern Linux filesystems such as ext4, Btrfs, and XFS.

---

Formatting stat Output for Shell Scripts

When writing Bash scripts, parsing the complete multi-line report with awk or grep is brittle. The stat command provides dedicated --printf and --format flags using format specifiers to return exact values cleanly.

Extracting Octal Permissions

stat -c "%a" /etc/shadow

Outputs: 640

Extracting Raw Byte Size

stat -c "%s" archive.tar.gz

Outputs: 104857600

Extracting Modification Timestamp in Unix Epoch Seconds

stat -c "%Y" config.json

Outputs: 1793715321

---

Inspecting Filesystem Status with stat -f

Passing the -f (filesystem) parameter instructs stat to inspect the mounted storage partition containing the target file rather than the file itself:

stat -f /

This reveals the fundamental partition attributes:

• Filesystem Type: Reports filesystem magic strings (e.g. ext2/ext3, btrfs, xfs).
• Free Blocks vs Free Inodes: Reports whether a “disk full” error is caused by exhausted physical disk space or depleted free inode capacity.
• Maximum Filename Length: Typically 255 characters on modern Linux systems.

Pairing stat with commands like realpath for symlink resolution and du for directory size auditing provides system administrators with unmatched visibility into Linux storage mechanics.