List files with ls and inspect them with stat
ls means list. -l is the long listing (permissions, owner, size, date). -i adds the inode number. stat prints everything the kernel knows about one file.
After SSH, you are in a folder (usually /root). These three commands answer: what is here, which inode is it, and what is its full metadata.
ls -l — long listing
ls = LiSt. -l = long. Without -l you only get names. With it, each line is a row of facts.
ls -lls -l /etcls -ld /etcls -l /etc lists what is inside /etc. ls -ld /etc lists the directory itself (useful when you care about its permissions, not its children).
total 36drwx------ 2 root root 4096 Apr 12 09:11 .ssh-rw-r--r-- 1 root root 3106 Apr 12 09:11 .bashrc-rw------- 1 root root 220 Apr 12 09:14 .bash_history-rw-r--r-- 1 root root 675 Apr 12 09:11 .profile-rwxr-xr-x 1 root root 512 Apr 12 10:02 setup.shlrwxrwxrwx 1 root root 13 Apr 12 09:11 hostname -> /etc/hostname| Column | Example | Meaning |
|---|---|---|
| Type + mode | -rw-r--r-- | First character is the type (- file, d directory, l symlink, b block disk). Then owner / group / other rwx. |
| Links | 1 | How many directory entries point at this inode. Directories are often 2 or more. |
| Owner | root | User who owns the file (UID name). |
| Group | root | Group that owns the file (GID name). |
| Size | 3106 | Bytes. Use ls -lh for KiB/MiB. |
| Time | Apr 12 09:11 | Last modification time (mtime), unless you ask for another timestamp. |
| Name | hostname -> /etc/hostname | File name. A symlink prints the target after ->. |
total 36 is disk blocks used in this listing (usually KiB), not “36 files.”
755, typical for a script. -rw------- is 600 (only root) — history and SSH keys should look like that.ls -li — same listing, plus inode
-i = inode. An inode (index node) is the file’s ID on that filesystem: type, size, timestamps, and where the data blocks are. The name lives in the directory; the inode is the file itself. Two names can share one inode (a hard link).
ls -lils -li /etc/hostname /etc/hoststotal 36131074 drwx------ 2 root root 4096 Apr 12 09:11 .ssh131075 -rw-r--r-- 1 root root 3106 Apr 12 09:11 .bashrc131080 -rw------- 1 root root 220 Apr 12 09:14 .bash_history131076 -rw-r--r-- 1 root root 675 Apr 12 09:11 .profile131090 -rwxr-xr-x 1 root root 512 Apr 12 10:02 setup.sh131091 lrwxrwxrwx 1 root root 13 Apr 12 09:11 hostname -> /etc/hostnameThe new first column (131075, …) is the inode. A symlink has its own inode; it points at a path, not at another inode the way a hard link does.
What an inode stores
The directory only stores the name plus this number. Everything else lives in the inode (and, on modern ext4, optional extra attributes):
| Information | Example |
|---|---|
| File type | Regular file, directory, symlink, block device |
| Permissions | rwxr-xr-x |
| Owner and group | UID and GID (often 0/root) |
| File size | 512 bytes, or 1.2M with ls -lh |
| Timestamps | Accessed, modified, metadata changed, birth |
| Hard-link count | How many names point at this inode |
| Pointers to data blocks | Where the bytes live on disk |
| Extended attributes | Extra flags on ext4 (lsattr / getfacl) |
ls -l prints a few of those fields. stat prints the rest. The filename is not inside the inode — that is why renaming is cheap and why two names can share one file.
find / -xdev -inum 131075 2>/dev/nulldf -i is a different -i: how many inodes the filesystem has left, not the number of one file. A disk can be “full” of inodes while df -h still shows free bytes. See Disk & RAM usage.stat — full metadata for one file
stat = STATus. ls -l is the summary row. stat filename is the full card: size, inode, device, mode, owner, and four timestamps.
stat setup.shstat /etc/hostnamestat -c '%n inode=%i mode=%A size=%s' setup.sh File: setup.sh Size: 512 Blocks: 8 IO Block: 4096 regular fileDevice: 259,2 Inode: 131090 Links: 1Access: (0755/-rwxr-xr-x) Uid: ( 0/ root) Gid: ( 0/ root)Access: 2026-04-12 10:05:11.120000000 +0200Modify: 2026-04-12 10:02:44.010000000 +0200Change: 2026-04-12 10:02:44.010000000 +0200 Birth: 2026-04-12 10:02:44.010000000 +0200| Field | What it is |
|---|---|
| File | Path you asked about. Symlinks show the link name, not the target, unless you use flags. |
| Size / Blocks / IO Block | Logical size in bytes, 512-byte blocks on disk, and the filesystem block size (often 4096). |
| Device | Which block device holds this filesystem (259,2 is typical for NVMe). Same idea as lsblk. |
| Inode / Links | The ID from ls -li, and how many names point at it. |
| Access (mode) | Numeric mode (0755) and the ls -l string. Uid/Gid 0 is root. |
| Access time | atime — last read. Many servers mount with relatime, so this does not update on every read. |
| Modify time | mtime — last change to the file’s contents. |
| Change time | ctime — last change to metadata (mode, owner, or contents). Not “creation time.” |
| Birth | Creation time, when the filesystem stores it (ext4 usually does). Empty on some older disks. |
stat on a symlink describes the link by default. Use stat -L hostname or stat $(readlink -f hostname) to follow it to the real file.Related commands
Same job, extra flags. All of these work in Rescue and on the installed Ubuntu/Debian OS.
| Command | When to use it |
|---|---|
ls -lah | Long listing, include hidden names (. files), human sizes (4.0K). |
ls -l --time-style=long-iso | Unambiguous dates: 2026-04-12 09:11. |
ls -lS | Sort by size, largest first. Same idea as ls -lhS /var/log. |
ls -lR | Recursive. Easy to flood the screen; prefer find for hunting. |
pwd | Print Working Directory — where you are before you ls. |
file setup.sh | Guess type from contents (“Bourne-Again shell script”), not from the name. |
namei -l /etc/hostname | Walk each path component and show who can traverse it. |
readlink -f hostname | Resolve a symlink to the real absolute path. |
stat -c '%n %i %A %s' | One compact line: name, inode, mode, size. Good for scripts. |
getfacl / lsattr | Extra ACL permissions, or ext attributes like immutable (chattr +i). |
pwdls -lahls -listat /etc/hostnamefile /etc/hostnamereadlink -f /etc/hostname