File Properties

File attributes are the descriptive data that travel with every file in an operating system, stored separately from the actual content inside the file. While the content represents whatever information a user or application wrote to disk, attributes describe the file itself—its type, size, ownership, access rights, and timestamps. Together, they form a category of metadata, often summarized as "data about data."

Understanding file attributes is fundamental to file management, permission control, and system administration. Whether you are troubleshooting a permission error, auditing unauthorized changes, or writing a backup script, you are ultimately working with file attributes.
Modern file systems generally store file content and file attributes in different locations. In Linux and other Unix-like systems, for example, the core attributes live in an inode (index node), while the file name is kept in a directory entry. This separation means a single file can have multiple names through hard links, yet all names point to the same inode and therefore share the same underlying attributes.

Windows NTFS uses a similar philosophy, storing metadata in MFT (Master File Table) records rather than inodes, but the underlying idea remains the same: the file system maintains a structured description of each file independently of the file's byte stream.

Major Categories of File Attributes

Although implementations vary across operating systems, file attributes generally fall into the following groups:

• Identifier attributes: File names, inode numbers, or Windows file object IDs. These allow the file system to locate a specific file uniquely.
• Type attributes: Regular file, directory, symbolic link, device file, socket, and so on. The type determines how the kernel and applications interact with the file.
• Ownership and permissions: User and group ownership, read/write/execute permissions, and special permission bits such as setuid or setgid. On Windows, this is primarily expressed through access control lists (ACLs).
• Timestamps: Common timestamps include last access time, last modification time, and status change time. Some systems also record creation time or "birth time."
• Size and space usage: Logical file size in bytes, plus the number of disk blocks actually allocated. These two figures can differ because of block allocation and sparse files.
• Link count: The number of hard links pointing to the same inode. A file is only truly deleted when its link count reaches zero and no process holds it open.
• Extended attributes: Additional metadata such as ACL entries, SELinux security contexts, user-defined key-value pairs, or Macintosh resource forks.

Viewing File Attributes on Linux

Linux offers several command-line tools for inspecting file attributes. The most common are ls, stat, and file.

The stat command displays the complete set of core attributes:

$ stat example.txt
  File: example.txt
  Size: 1024        Blocks: 8          IO Block: 4096   regular file
Device: 802h/2050d  Inode: 131073      Links: 1
Access: (0644/-rw-r--r--)  Uid: (1000/alice)  Gid: (1000/alice)
Access: 2024-05-01 10:00:00
Modify: 2024-05-01 09:30:00
Change: 2024-05-01 09:35:00

Each tool serves a different purpose:

• ls -l: Shows permissions, link count, owner, group, size, and modification time in a compact list. Ideal for everyday browsing.
• stat: Outputs all major attributes in detail. Better suited for scripting and deep troubleshooting.
• file: Determines file type by inspecting magic numbers in the content, rather than relying on the file extension.

Cross-Platform Comparison

Operating systems handle file attributes differently, which creates compatibility considerations when moving files between platforms.

Windows traditionally describes files with flag attributes such as read-only, hidden, system, and archive. Unix-like systems center on permission bits instead. When files are copied across platforms, attributes may be lost or remapped to the closest equivalent, so administrators should not assume that permission sets or timestamps survive a cross-platform transfer intact.

Typical Applications of File Attributes

File attributes are not just passive records; they actively support many system operations:

• Access control: Changing ownership and permission bits regulates which users or processes can read, write, or execute a file.
• Backup and synchronization: Tools such as rsync and tar compare timestamps and file sizes to decide whether a file needs to be copied again.
• Security auditing: Monitoring changes to attributes—especially status change time—can reveal unauthorized tampering or privilege escalation.
• Search and filtering: The find command can locate files by size, age, type, or permission pattern, enabling precise selection for batch operations.

Conclusion

File attributes provide the operating system's abstract description of a file's identity and state. They span identifiers, types, ownership, permissions, timestamps, size, link counts, and extended metadata. Grasping these concepts lays the groundwork for understanding how file systems operate as a whole. Deeper topics—such as inode internals, ACL design, extended attribute management, and timestamp semantics—deserve dedicated treatment in future articles.