Command library / stat

Show a file's metadata and timestamps

Prints everything the filesystem knows about a file except its contents: size, owner, permissions, inode, and three timestamps. Modify is when the content last changed; Change is when the metadata last changed (permissions, owner, links); Access is when it was last read. In an investigation they help build the timeline: a Change time newer than Modify usually means the permissions or ownership were altered after the content was written.

Usage

Options and flags

• file

  the file(s) to describe

• -c, --format FORMAT

  print only the fields you ask for, e.g. %y (last modification) or %U (owner)

• -L, --dereference

  follow a symbolic link and describe the file it points to

• -t, --terse

  all fields on one line, for scripts

Examples

• stat /etc/passwd

  Owner, permissions, size and all three timestamps.

• stat -c %y /var/log/auth.log

  Only the time the content was last modified.

• stat -L /usr/bin/python3

  Describe the real file behind a symbolic link.

Common mistakes

Related commands