File Concepts

When you look at a file in your operating system's file browser, you see far more than just the file's name. You see its size, when it was last modified, perhaps an icon indicating its type, and maybe even a preview of its contents. All of this information—everything except the file's actual data—is collectively called file attributes or file metadata.

File attributes answer fundamental questions:

• How big is this file? (Size)
• When was it created, modified, or last accessed? (Timestamps)
• Who owns it? (Ownership)
• Who can read, write, or execute it? (Protection)
• What type of file is it? (Type indicators)
• Where is it actually stored? (Location metadata)

Understanding file attributes is crucial for system programming, administration, and security. This page explores every major attribute type in depth.

File attributes serve several critical purposes in operating system design:

1. User Information: Attributes like size, modification time, and file type help users understand and manage their files. When you sort files by date or size in a file manager, you're using attributes.

2. System Management: The operating system uses attributes to make decisions. Location attributes tell the OS where to find the file's blocks. Protection attributes determine access control. Type attributes may influence how the file is opened.

3. Application Behavior: Programs read attributes to make decisions. A backup program checks modification times to detect changed files. A compiler checks timestamps to avoid recompiling unchanged source files.

4. Security Enforcement: Permission and ownership attributes form the foundation of access control. The OS reads these attributes on every file access to determine if the operation is allowed.

5. Forensics and Auditing: Timestamps and ownership records support security investigations. When was a file changed? By whom? These questions are answered by attributes.

Every file system, regardless of its design, must track certain fundamental attributes. These core attributes are universal across virtually all operating systems:

Let's examine each of these core attributes in detail:

The size attribute seems simple—it's just a number indicating how many bytes the file contains. But there's surprising subtlety here.

Logical Size vs. Physical Size:

The logical size is the number of bytes from the file's start to its end—what an application sees when it reads the entire file. The physical size is the actual disk space consumed, which may differ due to:

• Block allocation: Files are stored in fixed-size blocks (typically 4 KB). A 1-byte file consumes 4 KB on disk.
• Sparse files: Files with large "holes" of zeros may not allocate physical blocks for those regions.
• Compression: Some file systems compress data transparently, using less physical space.
• Metadata overhead: Space for the inode itself, extended attributes, etc.

File systems maintain multiple timestamps to track file history. The exact timestamps available vary by file system, but most support at least three:

Unix/Linux Standard Timestamps (POSIX):

Additional Timestamps on Modern Systems:

Common Confusion: ctime vs Creation Time

On Unix/Linux, ctime stands for "change time," NOT "creation time." It records when the file's inode (metadata) was last modified. This includes:

• Changing file permissions (chmod)
• Changing file ownership (chown)
• Renaming the file
• Modifying the data (which also updates mtime)

ctime cannot be manually set by users (except root with special filesystem operations). This makes it useful for security auditing—you can't fake when a file's permissions were changed.

Every file in a multi-user operating system has an owner—the user primarily responsible for and with control over the file. On Unix-like systems, files also have a group owner.

User ID (UID) and Group ID (GID):

Internally, the file system doesn't store usernames—it stores numeric IDs:

$ ls -ln /etc/passwd
-rw-r--r-- 1 0 0 2853 Jan 15 10:30 /etc/passwd
              ^--UID  ^--GID

The mapping from UID/GID to human-readable names is stored in /etc/passwd and /etc/group (or provided by LDAP, Active Directory, etc.).

Ownership Determines:

1. Default permissions checked: The 'owner' permission bits apply to the file owner
2. Who can change permissions: Only the owner (and root) can chmod a file
3. Who can change ownership: Only root can chown a file (prevents users stealing ownership)
4. Which quota is charged: File storage counts against the owner's disk quota

Protection attributes define who can access a file and what operations they can perform. This is the heart of operating system security.

Unix Permission Bits:

The classic Unix model uses 9 permission bits arranged in three groups:

-rwxr-xr--
 │││││││││
 │││││││└─ Others: Execute (x) - No
 ││││││└── Others: Write (w) - No
 │││││└─── Others: Read (r) - Yes
 ││││└──── Group: Execute (x) - Yes
 │││└───── Group: Write (w) - No
 ││└────── Group: Read (r) - Yes
 │└─────── Owner: Execute (x) - Yes
 └──────── Owner: Write (w) - Yes
 └───────── Owner: Read (r) - Yes

Numeric Representation:

Permissions are often expressed as octal numbers:

• r = 4, w = 2, x = 1
• Add values for each category
• Example: rwxr-xr-- = 7 (4+2+1), 5 (4+0+1), 4 (4+0+0) = 754

Special Permission Bits:

Beyond the 9 basic bits, three special bits exist:

Modern file systems support extended attributes (xattrs)—arbitrary name-value pairs attached to files. These extend beyond the traditional fixed set of attributes.

Namespaces (Linux):

Linux organizes extended attributes into namespaces:

Working with Extended Attributes:

# Set an extended attribute
$ setfattr -n user.author -v "John Smith" document.txt

# List extended attributes
$ getfattr -d document.txt
# file: document.txt
user.author="John Smith"

# Get a specific attribute
$ getfattr -n user.author document.txt
# file: document.txt
user.author="John Smith"

# Remove an extended attribute
$ setfattr -x user.author document.txt

Operating systems use various mechanisms to identify file types. No single approach dominates—different systems use different strategies, and multiple indicators may coexist.

1. File Extension (Name-Based)

The most visible type indicator is the filename extension:

• document.pdf → PDF file
• image.jpg → JPEG image
• program.exe → Windows executable

This is a convention, not enforcement. A file named malware.jpg could contain executable code. Extensions are:

• Pro: Human-readable, easily changeable
• Con: Trivially spoofed, not reliable for security

2. Magic Numbers (Content-Based)

Many file formats begin with specific byte sequences called magic numbers:

The Unix file command uses /usr/share/misc/magic to identify file types by content, regardless of extension.

3. File System Type Field

Unix file systems store a type field in the inode:

This is the first character shown by ls -l:

drwxr-xr-x  2 user user 4096 Jan 15 10:30 directory/
-rw-r--r--  1 user user 1234 Jan 15 10:30 file.txt
lrwxrwxrwx  1 user user    8 Jan 15 10:30 link -> file.txt

Perhaps the most critical metadata—from the file system's perspective—is where the file's data actually resides on storage. This location information is essential for reading and writing the file.

Block Pointers (Unix/ext4 style):

Traditional Unix file systems store block pointers in the inode:

Inode for 'largefile.dat'
├── Size: 15,000,000 bytes
├── Direct blocks [12 pointers]
│   └── blocks 1000, 1001, 1002, ..., 1011
├── Single indirect block
│   └── pointer to block 2000 containing 1024 more block addresses
├── Double indirect block
│   └── pointer to block 3000 containing pointers to indirect blocks
└── Triple indirect block
    └── pointer to block 4000 (for truly massive files)

This multi-level structure enables files of any size while keeping small files efficient.

Extents (Modern Approach):

Modern file systems use extents—contiguous ranges of blocks—rather than individual block pointers:

Extent-based layout for 'largefile.dat':
├── Extent 1: Start block 1000, length 1000 blocks (4 MB)
├── Extent 2: Start block 5000, length 2500 blocks (10 MB)
└── Extent 3: Start block 10000, length 125 blocks (500 KB)

Advantages of extents:

• Dramatically fewer pointers for large contiguous files
• More efficient tree traversal
• Better representation of actual disk layout
• Enables preallocation of space

Beyond the core and extended attributes, different operating systems and file systems support unique, specialized attributes.

Linux/ext4 File Attributes (chattr/lsattr):

NTFS Attributes (Windows):

macOS-Specific Attributes:

Different tools are used to view and modify file attributes across operating systems:

Linux/Unix:

# Basic attributes (ls)
$ ls -l file.txt
-rw-r--r-- 1 user group 1234 Jan 15 10:30 file.txt

# Detailed attributes (stat)
$ stat file.txt
  File: file.txt
  Size: 1234        Blocks: 8          IO Block: 4096   regular file
Device: 801h/2049d  Inode: 12345678    Links: 1
Access: (0644/-rw-r--r--)  Uid: ( 1000/   user)   Gid: ( 1000/  group)
Access: 2024-01-15 10:30:00.000000000 +0000
Modify: 2024-01-15 10:25:00.000000000 +0000
Change: 2024-01-15 10:25:00.000000000 +0000
 Birth: 2024-01-14 09:00:00.000000000 +0000

# Extended attributes
$ getfattr -d file.txt
$ lsattr file.txt          # Linux-specific attributes
----i--------e-- file.txt

Windows (PowerShell):

# Basic attributes
> Get-ItemProperty .\file.txt

# File system info
> Get-Item .\file.txt | Format-List *

# Modify attributes
> Set-ItemProperty .\file.txt -Name IsReadOnly -Value $true

# View NTFS streams
> Get-Item .\file.txt -Stream *

macOS:

# Extended attributes (crucial for Mac files)
$ xattr -l file.txt
com.apple.quarantine: 0083;5a123456;Chrome;ABC123

# Remove quarantine flag
$ xattr -d com.apple.quarantine file.txt

# Show all metadata including resource fork
$ ls -l@ file.txt

We've explored the complete landscape of file attributes—from basic properties like size and timestamps to advanced features like extended attributes and system-specific flags. Let's consolidate:

What's next:

Now that we understand what properties files have, we'll explore file operations—the actions you can perform on files. Opening, reading, writing, seeking, closing, and the many variations and subtleties of each operation are essential for system programming.