Several countries provides a unique identification number (for example, social security number in the USA) to the people who live in that country. This makes it easier to identify an individual uniquely. This makes it easier to handle all the paper work necessary for an individual by various government agencies and financial institutions.
Similar to the social security number, there is a concept of Inode numbers which uniquely exist for all the files on Linux or *nix systems.
Inode Basics
An Inode number points to an Inode. An Inode is a data structure that stores the following information about a file :
- Size of file
- Device ID
- User ID of the file
- Group ID of the file
- The file mode information and access privileges for owner, group and others
- File protection flags
- The timestamps for file creation, modification etc
- link counter to determine the number of hard links
- Pointers to the blocks storing file’s contents
Please note that the above list is not exhaustive. Also, the name of the file is not stored in Inodes (We will come to it later).
When a file is created inside a directory then the file-name and Inode number are assigned to file. These two entries are associated with every file in a directory. The user might think that the directory contains the complete file and all the extra information related to it but this might not be the case always. So we see that a directory associates a file name with its Inode number.
When a user tries to access the file or any information related to the file then he/she uses the file name to do so but internally the file-name is first mapped with its Inode number stored in a table. Then through that Inode number the corresponding Inode is accessed. There is a table (Inode table) where this mapping of Inode numbers with the respective Inodes is provided.
Why no file-name in Inode information?
As pointed out earlier, there is no entry for file name in the Inode, rather the file name is kept as a separate entry parallel to Inode number. The reason for separating out file name from the other information related to same file is for maintaining hard-links to files. This means that once all the other information is separated out from the file name then we can have various file names which point to same Inode.
For example :
$ touch a $ ln a a1 $ ls -al drwxr-xr-x 48 himanshu himanshu 4096 2012-01-14 16:30 . drwxr-xr-x 3 root root 4096 2011-03-12 06:24 .. -rw-r--r-- 2 himanshu family 0 2012-01-14 16:29 a -rw-r--r-- 2 himanshu family 0 2012-01-14 16:29 a1
In the above output, we created a file ‘a’ and then created a hard link a1. Now when the command ‘ls -al’ is run, we can see the details of both ‘a’ and ‘a1’. We see that both the files are indistinguishable. Look at the second entry in the output. This entry specifies number of hard links to the file. In this case the entry has value ‘2’ for both the files.
Note that Hard links cannot be created on different file systems and also they cannot be created for directories.
When are Inodes created?
As we all now know that Inode is a data structure that contains information of a file. Since data structures occupy storage then an obvious question arises about when the Inodes are created in a system? Well, space for Inodes is allocated when the operating system or a new file system is installed and when it does its initial structuring. So this way we can see that in a file system, maximum number of Inodes and hence maximum number of files are set.
Now, the above concept brings up another interesting fact. A file system can run out of space in two ways :
- No space for adding new data is left
- All the Inodes are consumed.
Well, the first way is pretty obvious but we need to look at the second way. Yes, its possible that a case arises where we have free storage space but still we cannot add any new data in file system because all the Inodes are consumed. This may happen in a case where file system contains very large number of very small sized files. This will consume all the Inodes and though there would be free space from a Hard-disk-drive point of view but from file system point of view no Inode available to store any new file.
The above use-case is possible but less encountered because on a typical system the average file size is more than 2KB which makes it more prone to running out of hard disk space first. But, nevertheless there exists an algorithm which is used to create number of Inodes in a file system. This algorithm takes into consideration the size of the file system and average file size. The user can tweak the number of Inodes while creating the file system.
Commands to access Inode numbers
Following are some commands to access the Inode numbers for files :
1) Ls -i Command
As we explained earlier in our Unix LS Command: 15 Practical Examples article, the flag -i is used to print the Inode number for each file.
$ ls -i 1448240 a 1441807 Desktop 1447344 mydata 1441813 Pictures 1442737 testfile 1448145 worm 1448240 a1 1441811 Documents 1442707 my_ls 1442445 practice 1442739 test.py 1447139 alpha 1441808 Downloads 1447278 my_ls_alpha.c 1441810 Public 1447099 Unsaved Document 1 1447478 article_function_pointer.txt 1575132 google 1447274 my_ls.c 1441809 Templates 1441814 Videos 1442390 chmodOctal.txt 1441812 Music 1442363 output.log 1448800 testdisk.log 1575133 vlc
See that the Inode number for ‘a’ and ‘a1’ are same as we created ‘a1’ as hard link.
2) Df -i Command
df -i command displays the inode information of the file system.
$ df -i Filesystem Inodes IUsed IFree IUse% Mounted on /dev/sda1 1875968 293264 1582704 16% / none 210613 764 209849 1% /dev none 213415 9 213406 1% /dev/shm none 213415 63 213352 1% /var/run none 213415 1 213414 1% /var/lock /dev/sda2 7643136 156663 7486473 3% /home
The flag -i is used for displaying Inode information.
3) Stat Command
Stat command is used to display file statistics that also displays inode number of a file
$ stat a File: `a' Size: 0 Blocks: 0 IO Block: 4096 regular empty file Device: 805h/2053d Inode: 1448240 Links: 2 Access: (0644/-rw-r--r--) Uid: ( 1000/himanshu) Gid: ( 1001/ family) Access: 2012-01-14 16:30:04.871719357 +0530 Modify: 2012-01-14 16:29:50.918267873 +0530 Change: 2012-01-14 16:30:03.858251514 +0530
Example Usage Scenario of an Inode number
- Suppose there exist a file name with some special character in it. For example: “ab*
- Try to remove it normally using rm command, you will not be able to remove it.
- However using the inode number of this file you can remove it.
Lets see these steps in this example :
1) Check if the file exists:
$ ls -i 1448240 a 1447274 my_ls.c 1448240 a1 1442363 output.log 1448239 "ab* 1441813 Pictures 1447139 alpha
So we have a file with name “ab* in this directory
2) Try to remove it normally:
$ rm "ab* > ^C $ rm "ab* > ^C $
See that I tried couple of times to remove the file but could not.
3) Remove the file using Inode number:
As we discussed earlier in our find command examples article, you can search for a file using inode number and delete it.
$ find . -inum 1448239 -exec rm -i {} \;
rm: remove regular empty file `./"ab*'? y
$ ls -i 1448240 a 1447274 my_ls.c 1448240 a1 1442363 output.log 1447139 alpha 1441813 Pictures
So we used the find command specifying the Inode number of the file we need to delete. The file got deleted. Though we could have deleted the file otherwise also by using the command rm \”ab* instead of using the complicated find command example above but still I used it to demonstrate one of the use of Inode numbers for users.
My name is Ramesh Natarajan. I will be posting instruction guides, how-to, troubleshooting tips and tricks on Linux, database, hardware, security and web. My focus is to write articles that will either teach you or help you resolve a problem. Read more about
Comments on this entry are closed.
Excellent guide, boys! Thanks!!!
Thanks, Now I have a clearer understanding of Inodes.
Hi,
Nice info. i amazed the way you comparing the things, and you make the understanding more faster without compromising anything
a simple
rm ‘ab*’
will remove the file ab* also
Is there an easy way to recover or undelete a deleted inode? The answer is no, but i don’t really understand why. It seems like a simple thing to keep deleted inodes in a salvage location until purged or until the file is overwritten.
This is really great article , well explained . I am reading your articles regularly now .
Does the inode information also get backed up?
When backing up from a ext4 to FAT file systems, information like permissions get lost. Is this the reason?
How does one preserve how files are hard linked when transferring files to another file systems?
Thanks
about the example：you can remove it by this ：rm \”ab*
Just a word of warning if you have multiple partitions! I know the above find command to delete an inode works and prompts for user confirmation and is safe to use if used correctly, it is generally better to use an absoulte path such as “/home” as apposed to current working directory “.” The reason being that inode numbers are unique but partition specific. So if you filesystem is split into multiple partitions e.g. /boot /home /root /var /usr /tmp… etc, each could all have a file with an inode number which is the same e.g. inode 12345. So if the file you want to delete is “/home/test/test.txt” and it has inode number 12345 and you are currently in directory “/var” and you run “find . -inum 12345 -exec rm -i {} \;” it will attempt to delete a file with inode number 12345 on the /var parition than if your current working directory was /home. Ultimately this depends on whether you have multiple partitions but always best to be safe 🙂
Hi
Can somebody explain to me why we cannot create a hard link on folder? as well as why cannot create a hard link that span across file systems? I did lot of search on Google but didn’t find any meaningful explanation
Srinivas
Srinivas, for the reasons mentioned in my previous comment you cannot create a hard link across multiple filesystems. The reason being a hard link points to a specific inode and different filesystems have different inode tables therefore if it was possible it would point to the wrong file. For example if you have two seperate filesystems e.g. /boot and /tmp and you try to hard link file /boot/initrd.img-2.6.32-5-686 which has inode 123456 to /tmp/hardlink. As /tmp is on a different filesystem its inode 123456 will point to something completely different or nothing at all hence it will not work. This is why we have soft links which can span multiple filesystems and act like shortcuts as apposed to inode pointers!
Thanks Gareth for your good explanation. I was sensed the same however would like to confirm. However am still getting answer to primary question of why can’t we create against a folder which resides on same file system?
Thanks you very much for replying to my question
Srinivas
Please read as “However am still not getting answer to my primary question” due to typo mistake
Srinivas
Gareth, great coverage of an under-appreciated topic. thanks
Srinivas, pls read Gareth’s comments for the answers to your questions
Right, however am still looking answer to my 2nd question.
“Why we cannot create hard link for folder on same file system?”
appreciated if any body answer to above question …
Srinivas
Srinivas, my understanding with regards to not being able to hard link to directories is not because it is impossible to implement, infact it is possible and was allowed in some distributions in the past but I believe because of potential security implications the kernel no longer allows them. Probably coupled by the fact that symbolic links can handle this across multiple filesystems why bother?
If you look at the man page for the “ln”, it should mention the “-d -F” arguments which are/were used for linking directories, although as mentioned “note: will probably fail due to system restrictions, even for the superuser”.
If this functionality were allowed it is open to abuse were people could create infinite loops either accidently or maliciously. Imagine if you created a couple of hard links to folders in such a way that they formed a circular reference. Then if you was to run a command against one of those directories it would run around in circles forever. Remember hard linking a file is like creating another file in a directory without using twice the space, no big deal. Hard linking a directory on the other hand for commands like “find, updatedb” or anything that recurses through a directory structure could end up all over the place! They are not as simple to work with as files.
Remember symbolic links (soft links) are distinguishable from the files/folders in which the refer too as they have a seperate inode and an application can easily identify them and choose not to follow them. You can see all your symbolic links using the following command “find /etc -type l -exec ls -li {} \;”
Hard links on the other hand are much less distinguishable apart from sharing an inode with something else. If you were writing an application how would you determine which hard links to follow and which not too? You can see all files which have a hard link using the following command “find / -links +2 -type f -exec ls -li {} \;”
I am sure the above is not the only reason why this functionality is not used these days but hope this has highlighted the potential flaws and likely why this is no longer used. I would imagine trying to resolve any potential implications of using hard links for directories is negated by the actual lack of demand given that symbolic links handle this task. I am curious are you asking this question for your understanding or do you have a problem that you are trying to overcome?
Hope this helps
Thanks Gareth for your excellent explanation. I asked this question out of my curiosity as I never got a satisfactory answer for this question in the past. I did lot of googleing, but didn’t got much.
I knew hard links are very limited use these days and we can achieve similar or more functionality with symlinks.
I agree with you that, hard links are difficult to spot and manage as they point to same inode and share a single entry in the file system.
Although hard links has some advantages over soft links, particular space saving, am not sure how much they really useful in this modern computing.
one advantage even today is having different names for same executable. we are still using hard links in some way without even we knowing
$ find /bin -links +2 -exec ls -li {} \;
423498 -rwxr-xr-x 3 root root 62872 Jan 14 2010 /bin/gunzip
423498 -rwxr-xr-x 3 root root 62872 Jan 14 2010 /bin/gzip
423498 -rwxr-xr-x 3 root root 62872 Jan 14 2010 /bin/zcat
in above example zcat,gzip,gunzip pointing same executable with different names.
Srinivas
bravo himanshu gr8 wrk my friend
thank you very explainable
Its really good tutorial
when we name a file in unix , where is it’s file name stored ?
You can remove the file ab* like this
rm -f ab\* #by escaping the *
Neat info. thanks!
Thanks a lot for the simple and clear explanation!
Hi Himanshu and thank you for this article.
I was wondering:
How to know the inodes+filenames size of a ramfs?
e.g. I can create 10 million empty files in /ramfs-dir/ and if I type du -b /ramfs-dir/ it will return 0 while in fact, some serious space is used in the ram for these files.
THANKS!
I observe that the inodes are full; now I am not able to create any file; how can I recover by cleaning this up?
Very clean , precise and easy to understand. Thumbs up!!
Pls explain how inodes are allocated with
example
It’s really simple and easy to understand the concept of inode… Similarly if there are more articles to understand the concept of Perl and Unix then please help…..
Hi Srinivas,
having said the use of Hard links through the example of gzip. can you explain me why, despite all the files pointing to the same file, why can’t they be used interchangeably?
ex) gzip file
results in file.gz
but why can’t we use same gzip command to unzip, but instead have to use gunzip, though they are the same.
is the gzip binary written in such a way that, the usage , as in , the command itself is considered as an argument and then the result depends on what command we run ?
Great explanations and I love the hints you give every time you can, very helpful! Thanks 🙂
realy helpful thnkyu
Under Inode Basics,
You have mentioned “The timestamps for file creation”.
I read somewhere that Linux does not store file creation time.
It is a pleasure to go through your website. I am new to this and you made it very easy for me..Thanks so much..
One quick question, when we do ls -al , it shows the files with Inode Info.
what is the first “.” signifies.
It was really nice explaination. It helped me .
Nice. well expalined.
How to clear the Inode usage. For example when I type the command df -h it shows inode usage is 100%. How to clear the inode space after deleting some files.