How to View File Metadata and Timestamps Using the stat Command in Linux

When you use the standard ls -l command in a Linux terminal, it outputs a basic overview of a file: its owner, its size, and the last time it was modified. However, the Linux filesystem (Ext4, XFS, etc.) tracks significantly more metadata about a file than ls can display. If you need to know the exact millisecond a file was originally created, or the precise filesystem block it resides on, you must bypass the standard list tools and query the filesystem directly using the stat command.

How to Read the stat Output

The stat (Status) command queries the file’s raw “inode” (the underlying data structure that tracks the file’s existence on the physical hard drive).

To view the comprehensive metadata for a specific file, open your terminal and run:

stat document.txt

The command will instantly output a highly detailed block of text containing critical forensics data. Here is how to interpret the most important fields:

• Size: The exact size of the file in bytes.
• Blocks: The physical number of 512-byte filesystem blocks the file consumes on the hard drive.
• Inode: The unique numeric identifier (the serial number) that the Linux kernel actually uses to track the file. (e.g., 14680070).
• Links: The number of hard links pointing to this exact inode.
• Access (Permissions): The raw octal permission code (e.g., 0644/-rw-r--r--).

Understanding the Three Timestamps

The most crucial aspect of the stat command is its ability to reveal all three distinct timestamps associated with a Linux file, down to the exact nanosecond.

Look at the bottom of the output block. You will see three dates:

• Access (atime): The exact time the file was last opened and read by any user or piece of software. (e.g., A user opened the script to read the code but did not save any changes).
• Modify (mtime): The exact time the actual contents of the file were changed and saved. (e.g., A user added a new line of code to the script).
• Change (ctime): The exact time the file’s metadata was altered, even if the contents remained exactly the same. (e.g., A user ran the chmod command to change the file’s permissions, or the chown command to change its owner).

Note: You may also see a fourth timestamp called Birth (btime). This indicates the exact moment the file was originally created, but many older Linux filesystems do not natively track birth times, so this field often displays as empty (-).