Understand UNIX / Linux Inodes Basics with Examples

by Himanshu Arora on January 16, 2012

Several countries provides a unique identification number (for example, social security number in the USA) to the people who live in that country. This makes it easier to identify an individual uniquely. This makes it easier to handle all the paper work necessary for an individual by various government agencies and financial institutions.

Similar to the social security number, there is a concept of Inode numbers which uniquely exist for all the files on Linux or *nix systems.

Inode Basics

An Inode number points to an Inode. An Inode is a data structure that stores the following information about a file :

  • Size of file
  • Device ID
  • User ID of the file
  • Group ID of the file
  • The file mode information and access privileges for owner, group and others
  • File protection flags
  • The timestamps for file creation, modification etc
  • link counter to determine the number of hard links
  • Pointers to the blocks storing file’s contents

Please note that the above list is not exhaustive. Also, the name of the file is not stored in Inodes (We will come to it later).

When a file is created inside a directory then the file-name and Inode number are assigned to file. These two entries are associated with every file in a directory. The user might think that the directory contains the complete file and all the extra information related to it but this might not be the case always. So we see that a directory associates a file name with its Inode number.

When a user tries to access the file or any information related to the file then he/she uses the file name to do so but internally the file-name is first mapped with its Inode number stored in a table. Then through that Inode number the corresponding Inode is accessed. There is a table (Inode table) where this mapping of Inode numbers with the respective Inodes is provided.

Why no file-name in Inode information?

As pointed out earlier, there is no entry for file name in the Inode, rather the file name is kept as a separate entry parallel to Inode number. The reason for separating out file name from the other information related to same file is for maintaining hard-links to files. This means that once all the other information is separated out from the file name then we can have various file names which point to same Inode.

For example :

$ touch a

$ ln a a1

$ ls -al
drwxr-xr-x 48 himanshu himanshu 4096 2012-01-14 16:30 .
drwxr-xr-x 3 root root 4096 2011-03-12 06:24 ..
-rw-r--r-- 2 himanshu family 0 2012-01-14 16:29 a
-rw-r--r-- 2 himanshu family 0 2012-01-14 16:29 a1

In the above output, we created a file ‘a’ and then created a hard link a1. Now when the command ‘ls -al’ is run, we can see the details of both ‘a’ and ‘a1′. We see that both the files are indistinguishable. Look at the second entry in the output. This entry specifies number of hard links to the file. In this case the entry has value ’2′ for both the files.

Note that Hard links cannot be created on different file systems and also they cannot be created for directories.

When are Inodes created?

As we all now know that Inode is a data structure that contains information of a file. Since data structures occupy storage then an obvious question arises about when the Inodes are created in a system? Well, space for Inodes is allocated when the operating system or a new file system is installed and when it does its initial structuring. So this way we can see that in a file system, maximum number of Inodes and hence maximum number of files are set.

Now, the above concept brings up another interesting fact. A file system can run out of space in two ways :

  • No space for adding new data is left
  • All the Inodes are consumed.

Well, the first way is pretty obvious but we need to look at the second way. Yes, its possible that a case arises where we have free storage space but still we cannot add any new data in file system because all the Inodes are consumed. This may happen in a case where file system contains very large number of very small sized files. This will consume all the Inodes and though there would be free space from a Hard-disk-drive point of view but from file system point of view no Inode available to store any new file.

The above use-case is possible but less encountered because on a typical system the average file size is more than 2KB which makes it more prone to running out of hard disk space first. But, nevertheless there exists an algorithm which is used to create number of Inodes in a file system. This algorithm takes into consideration the size of the file system and average file size. The user can tweak the number of Inodes while creating the file system.

Commands to access Inode numbers

Following are some commands to access the Inode numbers for files :

1) Ls -i Command

As we explained earlier in our Unix LS Command: 15 Practical Examples article, the flag -i is used to print the Inode number for each file.

$ ls -i
1448240 a 1441807 Desktop 1447344 mydata 1441813 Pictures 1442737 testfile 1448145 worm
1448240 a1 1441811 Documents 1442707 my_ls 1442445 practice 1442739 test.py
1447139 alpha 1441808 Downloads 1447278 my_ls_alpha.c 1441810 Public 1447099 Unsaved Document 1
1447478 article_function_pointer.txt 1575132 google 1447274 my_ls.c 1441809 Templates 1441814 Videos
1442390 chmodOctal.txt 1441812 Music 1442363 output.log 1448800 testdisk.log 1575133 vlc

See that the Inode number for ‘a’ and ‘a1′ are same as we created ‘a1′ as hard link.

2) Df -i Command

df -i command displays the inode information of the file system.

$ df -i
Filesystem            Inodes   IUsed   IFree IUse% Mounted on
/dev/sda1            1875968  293264 1582704   16% /
none                  210613     764  209849    1% /dev
none                  213415       9  213406    1% /dev/shm
none                  213415      63  213352    1% /var/run
none                  213415       1  213414    1% /var/lock
/dev/sda2            7643136  156663 7486473    3% /home

The flag -i is used for displaying Inode information.

3) Stat Command

Stat command is used to display file statistics that also displays inode number of a file

$ stat a
File: `a'
Size: 0 Blocks: 0 IO Block: 4096 regular empty file
Device: 805h/2053d Inode: 1448240 Links: 2
Access: (0644/-rw-r--r--) Uid: ( 1000/himanshu) Gid: ( 1001/ family)
Access: 2012-01-14 16:30:04.871719357 +0530
Modify: 2012-01-14 16:29:50.918267873 +0530
Change: 2012-01-14 16:30:03.858251514 +0530

Example Usage Scenario of an Inode number

  1. Suppose there exist a file name with some special character in it. For example:  ”ab*
  2. Try to remove it normally using rm command, you will not be able to remove it.
  3. However using the inode number of this file you can remove it.

Lets see these steps in this example :

1) Check if the file exists:

$ ls -i
1448240 a 1447274 my_ls.c
1448240 a1 1442363 output.log
1448239 "ab* 1441813 Pictures
1447139 alpha

So we have a file with name “ab* in this directory

2) Try to remove it normally:

$ rm "ab*
> ^C
$ rm "ab*
> ^C
$

See that I tried couple of times to remove the file but could not.

3) Remove the file using Inode number:

As we discussed earlier in our find command examples article, you can search for a file using inode number and delete it.

$ find . -inum 1448239 -exec rm -i {} \;
rm: remove regular empty file `./"ab*'? y
$ ls -i
1448240 a 1447274 my_ls.c
1448240 a1 1442363 output.log
1447139 alpha 1441813 Pictures

So we used the find command specifying the Inode number of the file we need to delete. The file got deleted. Though we could have deleted the file otherwise also by using the command rm \”ab* instead of using the complicated find command example above but still I used it to demonstrate one of the use of Inode numbers for users.


Linux Sysadmin Course Linux provides several powerful administrative tools and utilities which will help you to manage your systems effectively. If you don’t know what these tools are and how to use them, you could be spending lot of time trying to perform even the basic administrative tasks. The focus of this course is to help you understand system administration tools, which will help you to become an effective Linux system administrator.
Get the Linux Sysadmin Course Now!

If you enjoyed this article, you might also like..

  1. 50 Linux Sysadmin Tutorials
  2. 50 Most Frequently Used Linux Commands (With Examples)
  3. Top 25 Best Linux Performance Monitoring and Debugging Tools
  4. Mommy, I found it! – 15 Practical Linux Find Command Examples
  5. Linux 101 Hacks 2nd Edition eBook Linux 101 Hacks Book

Bash 101 Hacks Book Sed and Awk 101 Hacks Book Nagios Core 3 Book Vim 101 Hacks Book

{ 27 comments… read them below or add one }

1 BachiTux January 16, 2012 at 12:27 am

Excellent guide, boys! Thanks!!!

2 Anonymous January 16, 2012 at 4:38 am

Thanks, Now I have a clearer understanding of Inodes.

3 Prakashkumar January 16, 2012 at 5:09 am

Hi,

Nice info. i amazed the way you comparing the things, and you make the understanding more faster without compromising anything

4 Johan Volkers January 16, 2012 at 6:21 am

a simple
rm ‘ab*’
will remove the file ab* also

5 brad January 16, 2012 at 10:20 am

Is there an easy way to recover or undelete a deleted inode? The answer is no, but i don’t really understand why. It seems like a simple thing to keep deleted inodes in a salvage location until purged or until the file is overwritten.

6 vinay jhedu January 16, 2012 at 11:46 am

This is really great article , well explained . I am reading your articles regularly now .

7 Tracy Hearst January 16, 2012 at 2:33 pm

Does the inode information also get backed up?

When backing up from a ext4 to FAT file systems, information like permissions get lost. Is this the reason?

How does one preserve how files are hard linked when transferring files to another file systems?

8 jalal hajigholamali January 16, 2012 at 8:18 pm

Thanks

9 linshibo January 17, 2012 at 8:20 pm

about the example:you can remove it by this :rm \”ab*

10 Gareth Williams January 18, 2012 at 11:11 am

Just a word of warning if you have multiple partitions! I know the above find command to delete an inode works and prompts for user confirmation and is safe to use if used correctly, it is generally better to use an absoulte path such as “/home” as apposed to current working directory “.” The reason being that inode numbers are unique but partition specific. So if you filesystem is split into multiple partitions e.g. /boot /home /root /var /usr /tmp… etc, each could all have a file with an inode number which is the same e.g. inode 12345. So if the file you want to delete is “/home/test/test.txt” and it has inode number 12345 and you are currently in directory “/var” and you run “find . -inum 12345 -exec rm -i {} \;” it will attempt to delete a file with inode number 12345 on the /var parition than if your current working directory was /home. Ultimately this depends on whether you have multiple partitions but always best to be safe :)

11 Srinivas January 19, 2012 at 12:05 am

Hi

Can somebody explain to me why we cannot create a hard link on folder? as well as why cannot create a hard link that span across file systems? I did lot of search on Google but didn’t find any meaningful explanation

Srinivas

12 Gareth Williams January 19, 2012 at 4:46 am

Srinivas, for the reasons mentioned in my previous comment you cannot create a hard link across multiple filesystems. The reason being a hard link points to a specific inode and different filesystems have different inode tables therefore if it was possible it would point to the wrong file. For example if you have two seperate filesystems e.g. /boot and /tmp and you try to hard link file /boot/initrd.img-2.6.32-5-686 which has inode 123456 to /tmp/hardlink. As /tmp is on a different filesystem its inode 123456 will point to something completely different or nothing at all hence it will not work. This is why we have soft links which can span multiple filesystems and act like shortcuts as apposed to inode pointers!

13 Srinivas January 19, 2012 at 11:48 pm

Thanks Gareth for your good explanation. I was sensed the same however would like to confirm. However am still getting answer to primary question of why can’t we create against a folder which resides on same file system?

Thanks you very much for replying to my question

Srinivas

14 Srinivas January 19, 2012 at 11:50 pm

Please read as “However am still not getting answer to my primary question” due to typo mistake

Srinivas

15 cc January 25, 2012 at 1:53 am

Gareth, great coverage of an under-appreciated topic. thanks

Srinivas, pls read Gareth’s comments for the answers to your questions

16 Srinivas January 25, 2012 at 9:05 am

Right, however am still looking answer to my 2nd question.

“Why we cannot create hard link for folder on same file system?”

appreciated if any body answer to above question …

Srinivas

17 Gareth Williams January 25, 2012 at 9:46 am

Srinivas, my understanding with regards to not being able to hard link to directories is not because it is impossible to implement, infact it is possible and was allowed in some distributions in the past but I believe because of potential security implications the kernel no longer allows them. Probably coupled by the fact that symbolic links can handle this across multiple filesystems why bother?

If you look at the man page for the “ln”, it should mention the “-d -F” arguments which are/were used for linking directories, although as mentioned “note: will probably fail due to system restrictions, even for the superuser”.

If this functionality were allowed it is open to abuse were people could create infinite loops either accidently or maliciously. Imagine if you created a couple of hard links to folders in such a way that they formed a circular reference. Then if you was to run a command against one of those directories it would run around in circles forever. Remember hard linking a file is like creating another file in a directory without using twice the space, no big deal. Hard linking a directory on the other hand for commands like “find, updatedb” or anything that recurses through a directory structure could end up all over the place! They are not as simple to work with as files.

Remember symbolic links (soft links) are distinguishable from the files/folders in which the refer too as they have a seperate inode and an application can easily identify them and choose not to follow them. You can see all your symbolic links using the following command “find /etc -type l -exec ls -li {} \;”

Hard links on the other hand are much less distinguishable apart from sharing an inode with something else. If you were writing an application how would you determine which hard links to follow and which not too? You can see all files which have a hard link using the following command “find / -links +2 -type f -exec ls -li {} \;”

I am sure the above is not the only reason why this functionality is not used these days but hope this has highlighted the potential flaws and likely why this is no longer used. I would imagine trying to resolve any potential implications of using hard links for directories is negated by the actual lack of demand given that symbolic links handle this task. I am curious are you asking this question for your understanding or do you have a problem that you are trying to overcome?

Hope this helps

18 Srinivas January 25, 2012 at 11:21 am

Thanks Gareth for your excellent explanation. I asked this question out of my curiosity as I never got a satisfactory answer for this question in the past. I did lot of googleing, but didn’t got much.

I knew hard links are very limited use these days and we can achieve similar or more functionality with symlinks.

I agree with you that, hard links are difficult to spot and manage as they point to same inode and share a single entry in the file system.

Although hard links has some advantages over soft links, particular space saving, am not sure how much they really useful in this modern computing.

one advantage even today is having different names for same executable. we are still using hard links in some way without even we knowing

$ find /bin -links +2 -exec ls -li {} \;
423498 -rwxr-xr-x 3 root root 62872 Jan 14 2010 /bin/gunzip
423498 -rwxr-xr-x 3 root root 62872 Jan 14 2010 /bin/gzip
423498 -rwxr-xr-x 3 root root 62872 Jan 14 2010 /bin/zcat

in above example zcat,gzip,gunzip pointing same executable with different names.

Srinivas

19 Musab March 6, 2012 at 10:36 am

bravo himanshu gr8 wrk my friend
thank you very explainable

20 Shilpi September 11, 2012 at 4:17 am

Its really good tutorial

21 harkamal November 7, 2012 at 10:29 am

when we name a file in unix , where is it’s file name stored ?

22 nithin shetty August 12, 2013 at 11:05 pm

You can remove the file ab* like this

rm -f ab\* #by escaping the *

23 Erhan S. October 3, 2013 at 10:08 am

Neat info. thanks!

24 Anonymous October 5, 2013 at 4:56 am

Thanks a lot for the simple and clear explanation!

25 Florian November 8, 2013 at 2:13 pm

Hi Himanshu and thank you for this article.

I was wondering:
How to know the inodes+filenames size of a ramfs?
e.g. I can create 10 million empty files in /ramfs-dir/ and if I type du -b /ramfs-dir/ it will return 0 while in fact, some serious space is used in the ram for these files.

THANKS!

26 Naresh January 7, 2014 at 11:19 am

I observe that the inodes are full; now I am not able to create any file; how can I recover by cleaning this up?

27 Shubham April 7, 2014 at 5:17 am

Very clean , precise and easy to understand. Thumbs up!!

Leave a Comment

Previous post:

Next post: