Look inside a file

INPUT · Slides

What a file is made of

01 / 08

The bit between the name and the contents

You can now see the name (ls) and see the contents (cat).

But a file holds information that belongs to neither. When it was made, whose it is, how many bytes it is, whether it is even a file or a box.

stat is what shows you this "information about the file".

02 / 08

ls -l was already showing you a bit of it

You saw some of it back in chapter 1. There was quite a lot packed into one line of ls -l.

The - on the far left is the mark for "an ordinary file" (a box would be d). After that come the permissions, then 1 is the link count, learner is the owner and the group, 6 is the size, and then the time it was last changed.

stat is the tool that spreads all of that out instead of cramming it into one line.

~ $ ls -l cafe.txt-rw-r--r--    1 learner  learner         6 Aug 21 06:06 cafe.txt

03 / 08

stat — everything, spread out

Give stat a file name and you get something like this.

Size is the size and regular file is the kind. Inode is a number attached to the file, which identifies it separately from its name (that gets used in the chapter on the filesystem).

The interesting part is that there are three times: Access, Modify and Change. It remembers when it was read, when the contents changed, and when the information changed, each on its own.

~ $ stat cafe.txt  File: cafe.txt  Size: 6               Blocks: 1          IO Block: 8192   regular fileDevice: 13h/19d Inode: 4           Links: 1Access: (0644/-rw-r--r--)  Uid: (  100/learner)   Gid: (  101/learner)

04 / 08

Pull out one thing with -c

When you do not want all of it, -c gets you just the piece you asked for. You say which with a short code starting with %.

  • %s — size, in bytes
  • %F — kind (regular file / directory)
  • %a — permissions in octal (644)
  • %h — link count
  • %n — name

What comes out is the bare number, which is the good part: you can hand it straight to a calculation or the next command.

~ $ stat -c %s cafe.txt6

05 / 08

od — the bytes themselves

cat turns the contents into something a person can read before it puts them out. But sometimes you want to know what is really in there.

od -c lays it out one byte at a time. od is short for octal dump.

Look and you can see that café is c a f 303 251 — the plain letters take one byte each, and the é takes two. You can check that with your own eyes.

~ $ od -c cafe.txt0000000   c   a   f 303 251  \n0000006

06 / 08

hexdump and xxd — the same thing in hex

The same job in hexadecimal is hexdump -C and xxd.

Down the right you get "the character if it is readable, a . if it is not", which often makes them easier to read than od.

The point to notice is that a newline shows up as 0a. Characters you never normally see can be checked this way.

~ $ hexdump -C english.txt00000000  61 62 63 20 64 65 66 20  67 68 69 0a 6a 6b 6c 0a  |abc def ghi.jkl.|

07 / 08

file is not here

An ordinary Linux has a command called file that looks at the contents and works out what kind of thing it is. Type file photo.jpg and it tells you JPEG image data.

But it is not in this environment. Working out a kind from the contents needs about 10MB of lookup tables, which will not fit in something sent to a browser.

So here we use stat (the facts about it) and od (the bytes). When you graduate and type on your own computer, remember that file is available too.

08 / 08

Now have a go

The times and the Inode number change every time you type, so marking never uses them.

All it looks at are the values that are fixed — size, kind, permissions and link count. Type away.