Linux · navigation

stat

everything about one file

stat prints a file’s metadata in full. Where ls -l gives one line, stat gives the inode, the mode in octal, and three or four separate times — the detail you need when a permission or a date does not add up.

A file has three times, not one: when it was read, when its contents changed, and when its metadata changed.

Shows

Metadata

never the contents

Mode

Octal and letters

0644 and -rw-r--r--

Times

Access, Modify, Change

and Birth where supported

Custom output

-c FORMAT

for scripts

At the terminal

Read the session first, then the notes: each numbered line in the output is answered by the note with the same number.

user@netflow — bashcoreutils

$ stat notes.txt

File: notes.txt

1 Size: 2048 Blocks: 8 IO Block: 4096 regular file

2Device: 8,2 Inode: 1311234 Links: 1

3Access: (0644/-rw-r--r--) Uid: ( 1000/ user) Gid: ( 1000/ user)

Access: 2026-09-30 11:02:14.000000000 +0530

4Modify: 2026-09-30 10:40:51.000000000 +0530

Change: 2026-09-30 10:41:03.000000000 +0530

Birth: 2026-09-28 09:12:40.000000000 +0530

Illustrative session · names, sizes and dates are examples, and every address is from a documentation or private range

Reading the output

What the numbered lines are telling you

Size and type

2048 bytes, occupying 8 blocks of 512 bytes on disk, and an ordinary file rather than a directory or link.

The inode is the file’s real identity

A name is only a pointer to an inode. Links: 1 means one name points at this one.

Permissions both ways

0644 is the octal form chmod takes; the letters are what ls shows. Owner and group are given as number and name.

Modify and Change are different

Modify is when the contents last changed. Change is when the metadata did — here a chmod or chown twelve seconds later.

Switches

A switch changes how the command behaves. These are the ones used day to day; man stat lists the rest. Single-letter switches can usually be joined, so -l -a may be written -la.

-c FORMAT: Print only the fields named, such as %a for octal mode and %n for name.
-f: Describe the filesystem the file is on, not the file.
-L: Follow symbolic links and describe the target.
-t: Terse: print everything on one line, for scripts.

Variations worth knowing

The same tool, pointed at a narrower question. These four cover most of what it is reached for day to day.

stat -c "%a %U:%G %n" *

Prints octal mode, owner, group and name for every file here.

stat -c %s file.iso

Prints only the size in bytes.

stat -f /

Describes the filesystem rather than a file: type, block size, free space.

stat -L current

Follows a symbolic link and describes the file it points to.

In cybersecurity

The three timestamps are the basic evidence of what happened to a file.

Change time is hard to forge

touch can set Access and Modify to any date, but the kernel sets Change itself. A Modify older than Change means the date was altered or the metadata was.

Check the octal mode

A leading 4 or 2 — 4755 — is set-uid or set-gid. stat shows it plainly where ls shows only an s in the letters.

Reading changes the access time

On some mounts every read updates Access. Investigators copy or mount read-only first, so looking does not overwrite the evidence.

Filed under

Navigation

Read alongside

lsLists the contents of a directory — names, and with -l the type, permissions, owner, size and date of each entry.touchCreates an empty file, or sets the timestamps of one that already exists to now.