What kind of metadata does a file actually contain? I realize that this varies by the type of format, but I am specifically talking about the metadata universal for all files on a UNIX filesystem. Hence I will use plaintext as an example, since I'm not aware of any file specific metadata that would be in a plaintext file.

If I have a plaintext file, and I transfer it to another computer via a flash drive, is the inode for the file copied? I know you can get things from the inode like the last modification time, permissions, etc. But are there any types of metadata separate from the inode? Is it possible to figure out anything about the computer it came from?

What about in the case of an image file?

closed as off-topic by ISMSDEV, Tobi Nary, ThoriumBR, Xiong Chiamiov, Steve Nov 15 '17 at 18:20

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Tobi Nary, Xiong Chiamiov, Steve
If this question can be reworded to fit the rules in the help center, please edit the question.


I will use plaintext as an example...

A plain text file does not contain any meta data, i.e. it is only an octet stream without structure. The only thing meta on this octet stream is its size. But, if stored on a UNIX file system there are several meta data associated with this octet stream, like the file name, modification time, owner, group, permissions, maybe ACL's etc.

... I transfer it to another computer via a flash drive, is the inode for the file copied?

The inode itself is specific to the instance of the underlying file system. It will not be copied over to the flash drive. But some of the information contained in the inode might be, like the modification time. But the details depend on the capabilities of the underlying file system of the target, i.e. different file systems support different kind of information in the inode (or similar data structures). For example a (V)FAT file system which is usually used of flash drives does not support UNIX file permissions. It also depends on the way the copying was done, i.e. simply calling cp will not copy over the modification time but set it to the current time in the target. And even if the target system supports UNIX file permissions and owner, the original owner cannot be copied over unless the user doing the copy has the permissions to set the owner (i.e. is root).

... But are there any types of metadata separate from the inode?

The file name itself and the directory are not contained in the inode. In UNIX you could even have different file names or some file names within different directories point to the same inode, which essentially means that some same data can be accessed from different path.

What about in the case of an image file?

There are a variety of file formats for images with different capabilities. For example JPEG files can contain EXIF, IPTC or XMP blocks which are contains for a variety of meta data, like creation time of the photo, camera used, location where the photo was taken, copyright information and much much more. Since these information are contained in the octet stream of the image file these will be implicitly copied too when the file is copied.


Just a complement to the detailed @Steffen's answer. A file is normally nothing more than a sequence of bytes and may contains its own meta data. BUT meta data is also contained in the file system. For example in Unix filesystems, the name is contained in the directory and the size, last read an write access time, owner, etc. are contained in the inode. In that case when you copy the file only the data is copy, and not the meta data - even if you can ask the system to copy the times and owner and group ids.

But Windows NTFS is much richer. Any file is composed of data streams. The main one (the only one you normally access) contains the file data, but you can add as many streams as you want to store arbitrary meta data (or hidden data). They will not be accessible by normal accesses, but I can confirm that they are transported by (some) Microsoft tools like command line copy when the file is copied to another NTFS disk - simply they are discarded when you use another file system, upload them in an email or via any network protocol, because only the main data stream is concerned here.

In that case, a mere text file could transport arbitrary meta data. Example:

> echo foo > bar.txt
> echo bad > bar.txt:mood
> copy bar.txt bar2.txt
> type bar.txt
> type bar2.txt
> more < bar2.txt:mood

I think this question should be moved to the server fault section. This has nothing to do with information security.

You are mixing up file system and file format. File system usually deal with the file access, it has nothing to do with the content. While the file format define how the contents can be interpreted/parsed by program that read it.

Universally speaking, a file meta is always refer to file format. To quickly identify a file, standard is enacted to assign specific "signature" to a file. You can check out wikipedia file signature entry to learn about this.

Apparently, the question is about file transfer between file system. In fact, file system access right stayed with the assigned storage of the file system, it cannot cross the border.

  1. When file transfer from a Unix system to another unix system , the file will follow the destination file system access write assign with the user access. If

  2. If you happens to take out the whole Linux hard drive and mount it from another OS without encryption, the host OS actually able to access everything with little trouble, regardless of the access right constraints of the files rights assign in the mounted hard drive.

Not the answer you're looking for? Browse other questions tagged or ask your own question.