Three small commands answer three questions that come up constantly: what exactly is this file, how big and how old is it really, and which of the possibly many programs named python will run? stat, file, and which are the interrogators.

stat: the metadata, all of it #

Full metadata of one file
$ stat deploy.sh
  File: deploy.sh
  Size: 512         Blocks: 8          IO Block: 4096
Device: 10301h/66305d  Inode: 998244    Links: 1
Access: (0755/-rwxr-xr-x)  Uid: ( 1000/ ana)
Modify: 2026-10-21 09:14:53.112 +0000

The three timestamps trip everyone once: Modify is when the content changed, Access is the last read, Change is when the inode changed — permissions, rename, anything but content. A file "modified yesterday" with a Change time of two minutes ago was chmodded or renamed, not edited.

A tidy custom view with -c:

Just the fields you want, machine-friendly
$ stat -c '%n %s bytes, modified %y' *.log
app.log 4021 bytes, modified 2026-10-21 09:00:03

file: what is really inside #

file reads the first bytes and names the true format — the antidote to trusting extensions:

Identify anything
$ file backup photo.img
backup: POSIX tar archive (gzip compressed)
photo.img: JPEG image data, 4000 x 3000

The classic catch it solves: a "script" that is not a script, an "image" that is actually text, an executable that is dynamically linked and for which architecture.

which: what will actually run #

The shell searches PATH in order; which reports the winner:

Which binary is first in PATH
$ which python3
/usr/bin/python3
$ which -a node    # every candidate, in order

-a lists all matches — the debugging form for "why is the wrong version running". type -a python3 adds shell built-ins and aliases to the same picture.

Link inspection belongs to ln, sizes at scale to du. The rest of the terminal notes series is on the journal.