How does one inspect the directory structure information of a unix/linux file?
In Unix file systems directories are just special files with special directory structures that hold the child filename, filename size and inode reference number. The actual file metadata beyond this is normally stored in the inode itself. My question is. How does one read the actual special directory structure in its raw form instead of its interpreted form. Yes I know you can use ls to see the files there. That’s not what I am looking for.
5 Answers 5
The simple answer is that what you want to do is to read the directory file, with a command like cat . , cat /etc , or cat mydir . Of course, since this is “raw” data, you’d want to use a program that’s better suited to displaying non-ASCII data in a human-friendly way; e.g., hexdump or od .
Unfortunately, as discussed in When did directories stop being readable as files?, most versions of Unix that were released in the past two decades or so don’t allow this. So the answer to your question may be “find a version of Unix that still allows reading directories”. AIX, most versions of BSD, and all but the most recent versions of Solaris may qualify. Finding a Linux that allows it may require the use of a time machine.
The structure is entirely dependent on the specific filesystem being used, and the only way to read it is by directly reading from the disk ( i.e. /dev/sda1 ), and interpreting the filesystem yourself.
@Biff Yes, you need to write a program that understands the on-disk data structures of the particular filesystem type in use (or uses a library that does that for you). Also, you probably don’t want to run such a program while the filesystem is mounted.
I know it’s an old question but I was looking for information on the structure of the directory and found this.
To get the raw data inside a directory file, you can use debugfs . For example:
The you can ls , cd , and so on as usual, or cat a directory. This isn’t very readable so you can use:
This creates a file called dumproot in the location where you invoked debugfs . To get the raw content of it you can use xxd . For example:
xxd dumproot | head -n2 00000000: 0200 0000 0c00 0102 2e00 0000 0200 0000 . 00000010: 0c00 0202 2e2e 0000 0b00 0000 1400 0a02 . This shows the . and .. entries of my / directory, both have inode number 2, that’s the 02000000 at the start. With bigger inode numbers you see them at the start of an entry in little endian. . is hex 2e, so that’s visible in there as well. I’m not quite sure what «0c00 0102» represents, or how an end of an entry is specified. That’s what I was looking for when i found this thread.
Hi, welcome on the Unix SE! You are a good linuxer, you can type in complex expressions without a single mistake in the command line, I would suggest to do the same with the «I» if you write on English. 🙂
A programming interface exposes the directory entry as a special type of stream, handled by functions opendir , readdir , closedir and other related functions. The file entry that you get out of it is described in the man page (it contains file inode and some other data):
Anything more low level than that will depend on the actual implementation of the filesystem. It is completely up to the filesystem design what to use to store its directory tree. Some use B trees, some use B+ trees, some use flat tables and so on. There may even be redundant copies of inode data, checksums, encryption, extended attributes and so on.
Note that even for filesystems that are not based on inodes (FAT for instance), the kernel driver abstracts it so that the user doesn’t have to care about this difference.
Linux: Display File Properties via Terminal
We commonly need and want to know more about the files and directories that we are working with.
Most people know one of the ways, which is simply to Right Click > Properties on the wanted folder or file to view their properties. Though, for the more terminal-savvy, here’s how you can get the same (and more) information via the Terminal in Linux.
The ls Command
One of the most commonly used commands is the ls command, which lists all of the files and directories you’re located in, alongside their names.
Once you position yourself on a file path that you want, you can list all present files/folders via:
$ ls Folder_one large.jpg os.zip Alternatively, you can supply a directory name to list files from, without having to move to that directory:
$ ls Folder_one cpfile.c Direct fileinfo.c Though, these are just the names, and we can’t infer much from them. The ls command has several non-mandatory options which, when turned on, give us much more about these files when listing them.
You can use them alone, or by combining a few of them, depending on what exactly you are looking for.
Getting Details With the -l Option
The -l option will modify the ls command to give you much more detailed info, such as whether an entry is a file or directory, the size (usually in bytes), modified date and time, permissions, and more:
The result of this command should look something like:
total 15168 drwxrwxr-x 3 marija marija 4096 Jul 18 19:26 Folder_one -rwxrwxrwx 1 marija marija 164461 Sep 12 2017 large.jpg -rw-rw-r-- 1 marija marija 15354276 Oct 25 2018 os.zip Here we can see that we have one directory (d in drwxrwxr-x ), named Folder_one , and 2 files. We can also see their owner and group, marija , and their size in bytes, as well as their modification date/time.
The number following the permissions is the number of links to the file or directory.
If you’d like to read more about permissions and how to change them via the terminal, read our Guide to Understanding chmod.
Note: You can get far with the -l flag, and by combining other flags with it, the ls command will get you far for this task.
Human-Readable -lh Option
If you want a more human-readable form, you can add the joined extension -lh or simply -h after the -l option:
$ ls -lh total 15M drwxrwxr-x 3 marija marija 4,0K Jul 18 19:26 Folder_one -rwxrwxrwx 1 marija marija 161K Sep 12 2017 large.jpg -rw-rw-r-- 1 marija marija 15M Oct 25 2018 os.zip Now, we can see the size of files shown in KB, MB, GB, etc. instead of showing only in bytes, which can be very helpful. Though, that’s mostly the benefit you get from this flag.
Showing Hidden Files With the -la Option
Hidden files start with a dot symbol ( . ) and aren’t meant to be picked up by most GUI software, or the ls command. These are typically files that you don’t want to see, so this makes perfect sense.
On the other hand, if you’d specifically like to also include hidden files while listing the files of a directory — you can add the -a flag. Combining the -l flag and -a flag, you can print the hidden files alongside regular files — with their information:
$ ls -la total 15212 drwxr-xr-x 3 marija marija 4096 Jul 18 20:03 . drwxr-xr-x 29 marija marija 4096 Jul 18 20:13 .. drwxrwxr-x 3 marija marija 4096 Jul 18 19:26 Folder_one -rwxrwxrwx 1 marija marija 164461 Sep 12 2017 large.jpg -rw-rw-r-- 1 marija marija 15354276 Oct 25 2018 os.zip -rw-r--r-- 1 marija marija 12288 Jan 29 2018 .tekst.txt.swn -rw-r--r-- 1 marija marija 12288 Jan 29 2018 .tekst.txt.swo -rw-r--r-- 1 marija marija 12288 Jan 29 2018 .tekst.txt.swp Displaying Block Size With the -s Option
Free eBook: Git Essentials
Check out our hands-on, practical guide to learning Git, with best-practices, industry-accepted standards, and included cheat sheet. Stop Googling Git commands and actually learn it!
The -s option displays the file’s size in blocks, rather than regular bytes:
$ ls -s total 15168 4 Folder_one 164 large.jpg 15000 os.zip Note: Blocks are the smallest writable unit for your system and hardware.
Sorting Files by Size with the -lS Option
The -S flag, not to be confused with the lowercase -s from earlier, is a sorting flag. It sorts the files by size, in descending order:
$ ls -lS total 15168 -rw-rw-r-- 1 marija marija 15354276 Oct 25 2018 os.zip -rwxrwxrwx 1 marija marija 164461 Sep 12 2017 large.jpg drwxrwxr-x 3 marija marija 4096 Jul 18 19:26 Folder_one Recursive Listing with the -R Option
If you want to list subdirectories, you’ll have to make a recursive ls call. The -R option makes this a really simple endeavor.
It will give you a tree representation of all of the files or directories that happen to be in a particular place:
$ ls -R directory Screenshot 2021-07-26 at 18.53.05.png file.txt Screenshot 2021-07-26 at 21.15.20.png mpl directory/dvp-articles: axis-off directory/dvp-articles/axis-off: app.py get-pip.py directory/mpl: mpl-chapter-2-1.png Here, we’ve recursively called ls on the directory . Within it, there’s another directory — dvp-articles , and within it, yet another — axis-off . Within axis-off , there’s an app.py and get-pip.py .
Of course, you can chain the -l flag here as well, but the output might get a bit messy:
ls -lR directory [email protected] 1 david staff 369705 Jul 26 23:57 Screenshot 2021-07-26 at 23.57.34.png [email protected] 1 david staff 103861 Jul 27 00:05 Screenshot 2021-07-27 at 00.05.16.png drwxr-xr-x 3 david staff 96 Jun 17 18:00 dvp-articles -rw-r--r-- 1 david staff 0 Jun 25 17:11 file.txt drwxr-xr-x 3 david staff 96 Jul 16 20:19 mpl directory/dvp-articles: total 0 [email protected] 4 david staff 128 Jun 17 18:03 axis-off directory/dvp-articles/axis-off: total 3800 -rw-r--r-- 1 david staff 463 Jun 17 18:08 app.py -rw-r--r-- 1 david staff 1937800 Jun 17 18:03 get-pip.py directory/mpl: total 376 [email protected] 1 david staff 192506 Jul 16 20:18 mpl-chapter-2-1.png Option -i
To use inode, we can add the -i flag:
$ ls -i 688193 Folder_one 680393 large.jpg 680392 os.zip Of course, you can chain it with other flags such as:
$ ls -li 49323 [email protected] 3 david staff 96 Jun 16 20:39 Applications 34615 drwx------+ 15 david staff 480 Jul 27 00:05 Desktop . The stat Command
The stat command is much more like the good old Right Click > Properties approach, because it formats all of the data and properties in a very readable format. It requires a filepath and isn’t as customizable as ls :
File: 'Folder_one' Size: 4096 Blocks: 8 IO Block: 4096 directory Device: 805h/2053d Inode: 688193 Links: 3 Access: (0775/drwxrwxr-x) Uid: ( 1000/ marija) Gid: ( 1000/ marija) Access: 2021-07-18 20:04:03.205402891 +0200 Modify: 2021-07-18 19:26:00.681976407 +0200 Change: 2021-07-18 20:03:51.617219116 +0200 Birth: - For some, this is a much better solution than the ls command.
With stat , you can also format the printed info via —printf . You can filter out data such as the user name of the owner, group name of owner, or time of last status change, in even more human-readable form:
$ stat --printf='%U\n%G\n%z\n' Folder_one/ Which will in this case results in:
marija marija 2021-07-18 20:03:51.617219116 +0200 Notice that we are putting »\n» after each wanted property, so that each is printed in a new line.
Conclusion
Using the terminal, it’s easy to find file properties, using ls with any of its accepted flags or via stat .
In this short guide, we’ve taken a look at how to display file properties using Linux.