Getting More Information About Filesystem Objects

You might be used to being able to tell what type of file you’re working with by looking at its filename. Typically, a three or four-letter extension gives it away. For example, foo.pdf is a PDF file, logo.png is a graphics file, and foo.txt is a plain-text file. But sometimes there’s no extension, and sometimes the files are named incorrectly.

The file command can help you figure out what type of file you’re working with. Try it out by pointing it at the greetings.txt file you created in the Desktop directory within your home directory:

The output tells you what’s in the file by looking at its content. Create a file called test.html in your home directory with touch and try to identify it:

This time file tells you it’s an empty file, despite having the .html extension. Now throw some HTML into the file:

Now it says it’s an ASCII text file. You might have expected it to report something like “HTML file”, but that’s not quite how it works. Sure, there’s HTML in it, but find looks at the first few bytes of the file to try to determine what it is, and it isn’t quite sure.

Put an HTML5 doctype at the beginning of the file:

This time, file tells you it’s an HTML document:

Since file is looking at the contents of the file instead of the filename, it’s great for figuring out files that have been mislabeled, like graphics files with a png extension that are actually jpeg files. You can use file to identify the correct type and rename the file appropriately.

The file command is great for determining the type of file, but you might want more information about the file itself, such as when it was last accessed. The ls command is fine for collecting basic information about a file, directory, or other filesystem object, but the stat command will tell you much more.

Use the stat command to view details about the test.html file you just worked with:

macOS Has Different Output and Options
	The stat command on macOS doesn’t produce the same output as the one on Ubuntu by default. Use stat -x instead, or install the GNU version on your Mac by following ​Installing coreutils​.

This gives you a nice detailed view of the file, its size on disk, what type of file it is (a regular file in this case), the inode, permissions, ownership, user and group IDs, and timestamps for when the file was last accessed, modified, or changed.

The Access timestamp is the last time something read the file. The Modify timestamp shows the last time the file’s contents changed. The Change timestamp reflects when the file’s inode changes, such as when permissions or other metadata about the file is updated. This can also include the file’s content.

Time to experiment. Add a line of text to the file:

Now, run the stat command again. Since you changed the file, both the Modify and Change fields updated, but the Access timestamp did not:

Display the file with cat and run stat again. The Access timestamp has changed.

This makes sense, since you didn’t change anything. Still, you’re probably wondering why both the Modify and Change timestamps updated when you added content, even though you only changed the file’s contents. Remember that the Change time reflects a change to the underlying inode, so a change to the content affects both the Modify time and the Change time. But if you change the permissions on the file, you’ll see that reflected only in the Change time. Give it a try. Change permissions on the file so that your user is the only person with access:

Now run stat again:

This time, the Change entry is the only timestamp that’s updated. Note that the output also shows the updated permissions.

The stat command works on directories as well. Run the stat command against the app directory you created in ​Working with Links​:

This time, the output reports that you’re looking at a directory. Now run stat on the app/current directory, which is a symlink:

The output shows you’re looking at a symlink.

You can also use stat to get information about the underlying filesystem by using the -f flag:

Finally, you can control the output you want to see. On Linux versions of stat, you do this using the --printf option. For example, use this command to print out the access time:

The %x value shows the human-readable access time, and adds a line break. You can add other text, as well, to create a label:

If you use %y and %z, you can display the modified and changed times, respectively:

On macOS or BSD versions of stat, you’ll use different formatting options. Use the man stat command to see the values you can display for your version of stat.

The stat command can give you insight into when a file was updated or accessed, and tell you more about the underlying filesystem, which can be very helpful when debugging a file access issue.