So, I'm looking for a command-line approach to get a short(ish) textual dump of relatively low-level metadata for a file, approximately the same way that
stat does on *nix systems.
In other words, information that's readily available through Win32 or NT file APIs without actually reading the contents of the file, and definitely without having to go anywhere near the Shell (as seen in Explorer and the Save/Open dialogs, and anything using
On NTFS, this info would tend be stored in the file's MFT entry, though I've heard that exactly which attributes end up in the MFT proper depends largely is largely a matter of which will fit, since many attributes are optional, repeatable, and/or variable size, some can be , though it's also possible to use more than one slot in the MFT. (In fact, it's even possible to store a file/directory's full contents in the MFT if the other attributes don't take too much space!) So, um, obviously "appears in the MFT" can't be use to actually define what I'm looking for.
Also, I'm not looking for tools that parse NTFS itself, or only work on NTFS filesystems: I only mention NTFS because, well, what other local FS is going to support more NT-specific things?
For concreteness, here's the
stat on the Debian box I'm using as a router:
hydrogen% stat . File: ‘.’ Size: 4096 Blocks: 8 IO Block: 4096 directory Device: fe00h/65024d Inode: 507974 Links: 4 Access: (0755/drwxr-xr-x) Uid: ( 1000/ naesten) Gid: ( 1000/ naesten) Access: 2016-08-31 14:12:47.650440935 -0400 Modify: 2016-09-20 17:26:15.935591584 -0400 Change: 2016-09-20 17:26:15.935591584 -0400 Birth: - hydrogen%
And here's the one from Git for Windows:
Sam@Sam-laptop MINGW64 ~ $ git --version git version 2.8.2.windows.1 Sam@Sam-laptop MINGW64 ~ $ stat . File: '.' Size: 0 Blocks: 32 IO Block: 65536 directory Device: 147ac391h/343589777d Inode: 1970324836977201 Links: 1 Access: (0755/drwxr-xr-x) Uid: (197608/ Sam) Gid: (197121/ UNKNOWN) Access: 2016-09-18 18:32:28.072538600 -0400 Modify: 2016-09-18 18:32:28.072538600 -0400 Change: 2016-09-18 18:32:28.072538600 -0400 Birth: 2014-08-21 18:52:08.217444400 -0400 Sam@Sam-laptop MINGW64 ~ $
At this point, I was going to say that the "Birth" timestamp field is a Windowsism, but clearly that's not quite true because Debian's stat shows the field, only it's empty above because the filesystem doesn't actually have that field. (Which is, at least, much clearer than the "Access" timestamps: neither system is updating those in the traditional
Also note how the Windows port is displaying made-up file access permissions, an implausibly-large "inode number", and what I can only assume are also made up UID/GID numbers (on account of how NT uses variable-length hierarchical identifiers rather than fixed-size numbers to identify users and groups, and doesn't permit both user and group ownership at the same time; that is, on NT a file is owned by a single user OR group, and anyone else just gets their rights from the ACL).
Does MS provide a tool of this sort, presumably one that shows more actual information and less fairyland information?
My original text follows:
Yes, I know there are ports of
stat, but (a) I'm concerned that information might fall through the cracks if:
- It doesn't commonly appear in Unix
- It's missing from whichever
statupstream's code (if any)
- The porter(s) either
- Don't notice Windows provides the information
- Are building on a POSIX layer that doesn't plumb it through
- Aren't sure how best to present the information (or that it's even appropriate to do so) in the context of
- Don't have an unlimited amount of time on their hands
and (b) I was wondering if Microsoft supplied any analogous tool(s).
But really, any command-line way get sort of information
stat might provide (regardless of whether it involves a program called
stat), along with a description of the more-or-less NTFS-specific information it provides, would be of interest.
P.S. I'm on Windows 7, but don't let that stop you from mentioning things first shipped for/in later versions of Windows.