Inodes: The Hidden Metadata That Powers Every File

What is an Inode?

Imagine you're in a massive library with millions of books. Each book has a unique catalog card that tells you everything about it—its size, location, when it was added, who can read it—everything except the book's title and its actual content. That catalog card is what an inode is to your files!

An inode (short for "index node") is the unsung hero of Unix filesystems. It's a tiny data structure that stores all the metadata about a file—permissions, ownership, timestamps, and most crucially, where to find the actual data on disk. Surprisingly, it doesn't store the filename itself. That's kept separately in directories, which are just special files that map names to inode numbers.

The Inode Paradox: Running Out With Space Left

Here's something that blows people's minds: You can run out of space for new files even when your disk has gigabytes free! How? Because you've run out of inodes.

Most filesystems pre-allocate a fixed number of inodes when formatted. Use them all up (usually with millions of tiny files), and you can't create new files regardless of free space.

# Check your inode usage - you might be surprised!
df -i

# Output might show:
Filesystem     Inodes  IUsed  IFree IUse% Mounted on
/dev/sda1     1310720 589824 720896   46% /
# That's 589,824 files on your root partition!

The Three-Part File Structure

Before diving into inodes specifically, it's crucial to understand that Unix files have three separate components. This separation is what enables powerful features like hard links.

What's Inside an Inode?

An inode is typically 128 or 256 bytes packed with information. Let's explore its structure:

The Inode Structure in Code

struct inode {
    uint16_t i_mode;        // File type and permissions (rwxrwxrwx)
    uint16_t i_uid;         // User ID of owner
    uint32_t i_size;        // Size in bytes
    uint32_t i_atime;       // Access time (last read)
    uint32_t i_ctime;       // Change time (metadata modified)
    uint32_t i_mtime;       // Modification time (content modified)
    uint32_t i_dtime;       // Deletion time (0 if not deleted)
    uint16_t i_gid;         // Group ID of owner
    uint16_t i_links_count; // How many hard links point here
    uint32_t i_blocks;      // Number of 512-byte blocks allocated
    uint32_t i_flags;       // File flags (immutable, append-only, etc.)
    uint32_t i_block[15];   // Pointers to data blocks (the magic!)
};

The 15-Pointer Trick: How Inodes Handle Any File Size

The most clever part of an inode is its 15 block pointers in i_block[15]. This design lets a tiny 256-byte structure address files from 1 byte to multiple terabytes:

• Pointers 0-11 (Direct): Point directly to data blocks
• Pointer 12 (Single Indirect): Points to a block of pointers
• Pointer 13 (Double Indirect): Points to pointers to pointers
• Pointer 14 (Triple Indirect): Three levels deep

This elegant hierarchy means:

• Small files are blazing fast — most files are under 48KB and need only direct block access
• Large files work — without redesigning the structure
• No wasted space — small files don't allocate unused indirect blocks

Hard Links vs Soft Links: The Inode Connection

Understanding inodes reveals why hard and soft links behave so differently. The difference comes down to what they store: an inode number vs a path string.

Hard Links: Multiple Names, Same Inode

A hard link creates another directory entry pointing to the same inode:

# Create a file and a hard link
echo "Hello World" > original.txt
ln original.txt hardlink.txt

# Check their inodes - they're identical!
ls -i original.txt hardlink.txt
# 524312 original.txt
# 524312 hardlink.txt  # Same inode number!

# The inode's link count increases
stat original.txt | grep Links
# Links: 2

# Delete original - hardlink still works!
rm original.txt
cat hardlink.txt  # Still outputs "Hello World"

Why Can't You Hard Link Directories?

Allowing hard links to directories would create cycles in the filesystem tree. If /a could hard-link to /a/b/c, then cd /a/b/c/a/b/c/a/b/c... would loop forever. The kernel prevents this—only . and .. are special-cased directory hard links.

Soft Links: A File That Points to a Name

A symbolic link is a special file with its own inode that contains a path:

# Create a symbolic link
ln -s original.txt symlink.txt

# Check inodes - they're different
ls -i original.txt symlink.txt
# 524312 original.txt
# 524445 symlink.txt  # Different inode!

# The symlink stores a path, not data
readlink symlink.txt
# original.txt

# Delete original - symlink breaks!
rm original.txt
cat symlink.txt  # Error: No such file or directory

When Files Actually Get Deleted: The Link Count

Files aren't deleted when you rm them—they're deleted when the link count reaches zero. Experiment with this interactive demo:

Visualizing Hard Links in Action

See how multiple directory entries can point to the same inode, sharing the same data:

Path Resolution: Walking the Inode Chain

When you access a file like /home/alice/report.txt, the kernel performs a step-by-step path resolution, looking up inodes at each directory level:

Where Inodes Live on Disk

Understanding the physical layout of a filesystem helps explain inode limitations:

$ df -i
Filesystem      Inodes   IUsed   IFree  IUse%
/dev/sda1      1000000  200000  800000    20%
# If you hit 100% inodes, you can't create new files even with free space!

mkfs.ext4 -i 4096 /dev/sdb1

mkfs.ext4 -i 65536 /dev/sdb1

Practical Inode Commands

Finding Files by Inode

# Find inode number
ls -i myfile.txt
# 524312 myfile.txt

# Find file by inode number
find / -inum 524312 2>/dev/null

# Delete a file with a weird name using inode
find . -inum 524312 -delete

Diagnosing the "No Space Left" Mystery

# Disk shows space available
df -h
# /dev/sda1  20G  15G  4.0G  80% /

# But can't create files!
touch newfile
# touch: cannot touch 'newfile': No space left on device

# The culprit: out of inodes!
df -i
# /dev/sda1  1310720  1310720  0  100% /

# Find the inode hogs
for dir in /*; do
    echo "$dir: $(find $dir 2>/dev/null | wc -l)"
done | sort -t: -k2 -n | tail -5

Inode Optimization at Format Time

# Format with more inodes for many small files
mkfs.ext4 -i 4096 /dev/sdb1  # One inode per 4KB

# Or fewer inodes for large media files
mkfs.ext4 -i 65536 /dev/sdb1  # One inode per 64KB

# Check current inode ratio
dumpe2fs /dev/sda1 | grep "Inode size"

File Attributes Beyond Basic Permissions

Inodes store special attributes that provide powerful features:

# Make file immutable (even root can't modify!)
sudo chattr +i important.conf
lsattr important.conf
# ----i--------e-- important.conf

# Append-only (great for logs)
sudo chattr +a logfile.log

# Remove the attribute
sudo chattr -i important.conf

The Inode Cache: Speed Magic

Linux caches recently accessed inodes in RAM for blazing-fast repeated access:

# View inode cache statistics
cat /proc/slabinfo | grep inode
# inode_cache  45892  45892  608  26  4 : tunables  0  0  0

# That's ~46K inodes cached in memory!

Filesystem-Specific Inode Features

Different filesystems handle inodes differently:

Key Takeaways

Inodes are the invisible foundation of Unix filesystems—every file operation ultimately comes down to reading, writing, or modifying these tiny metadata structures. Understanding inodes transforms mysterious filesystem behaviors into logical consequences of elegant design.

Related Concepts

Further Reading

• Understanding Unix/Linux Filesystem Inodes - Linux Kernel Documentation
• The Linux Programming Interface - Chapter 14: File Systems
• Advanced Programming in the UNIX Environment - File I/O deep dive