Inodes

What Is an Inode?

An inode is a filesystem record that holds information about a file or directory. On Linux and Unix-like systems, software uses this record to find the file's type, ownership, permissions, size, timestamps, link count, and the location of its stored data.

The inode does not normally store the filename. A directory keeps the relationship between a name and an inode number. This separation explains hard links, safe renaming, and why an open file can remain usable briefly after its name is deleted.

How a Filename Reaches File Data

For a path such as /home/alex/report.txt, the filesystem resolves one directory component at a time. Each directory supplies the inode number for the next component until the final file is reached.

What an Inode Typically Contains

Metadata	What it describes
Inode number	An identifier that is unique within one filesystem while the inode exists.
File type	Regular file, directory, symbolic link, device, socket, named pipe, and other supported types.
Mode and permissions	Read, write, and execute bits plus special mode bits.
User and group IDs	The file's owner and group owner.
File size	The logical size, usually expressed in bytes.
Allocated blocks	The storage blocks reserved for the file, which may differ from logical size.
Link count	The number of hard-link directory entries that refer to the inode.
Timestamps	Access, content modification, metadata change, and sometimes creation time.
Data mapping	Filesystem-specific information used to locate the file's content.

Inode numbers are only meaningful together with their filesystem. Two different filesystems can use the same inode number.

Inspect Inodes with Commands

Show an Inode Number

$ ls -i report.txt
128849 report.txt

The first value is the inode number. Use ls -li to include the long listing, which also shows permissions, link count, owner, group, size, and modification time.

Show Detailed Metadata

$ stat report.txt
  File: report.txt
  Size: 208        Blocks: 8          IO Block: 4096 regular file
Device: 8,5        Inode: 128849      Links: 1
Access: (0644/-rw-r--r--)  Uid: (1000/alex)  Gid: (1000/alex)
Access: 2026-08-31 09:20:18
Modify: 2026-08-31 09:19:44
Change: 2026-08-31 09:19:44

Exact output differs by operating system and filesystem. stat is the most direct everyday command for connecting an inode number with the metadata it represents.

Understand the Timestamps

Time	Changes when	Important note
atime	File content is accessed.	Mount options and performance settings may reduce or suppress updates.
mtime	File content is modified.	Changing only permissions does not normally change mtime.
ctime	Inode status changes, such as permissions, ownership, links, or content updates.	On Unix, ctime means change time—not creation time.
btime or birth time	The file is created.	Availability depends on the operating system, filesystem, and inspection tool.

Hard Links Share an Inode

A hard link creates another directory entry for the same inode. Both names are equally valid routes to the same file data.

ln report.txt summary.txt
ls -li report.txt summary.txt

Editing through either name changes the same underlying file. Removing one name decreases the link count but does not remove the data while another hard link remains.

Hard Links and Symbolic Links

Hard link	Symbolic link
Points to the same inode as the original name.	Has its own inode and stores a path to another name.
Usually cannot cross filesystem boundaries.	Can point across filesystems.
Normally restricted for directories to protect the directory tree.	Can point to a directory.
Still works when another name for the inode is removed.	Can become broken when its target path disappears.

ln original.txt hard-link.txt
ln -s original.txt symbolic-link.txt

What Happens During Rename and Delete?

Renaming a file within the same filesystem normally changes a directory entry, not the inode or file data. Deleting a name performs an unlink: the directory entry is removed and the inode's hard-link count decreases.

The filesystem can reclaim the inode and data blocks after the link count reaches zero and no process still has the file open. This is why a service may continue writing to a deleted log file until it closes that file. On Linux, lsof +L1 can help identify open files whose link count has reached zero.

How Inodes Locate Data

The exact structure is filesystem-specific. Traditional Unix-style block-mapped filesystems, including ext2 and ext3, used direct block pointers plus single, double, and triple indirect pointers to reach progressively larger files. Modern ext4 files commonly use extents: compact records that describe ranges of contiguous blocks instead of listing every block separately.

The important concept is stable across implementations: the inode contains or references the information needed to locate a file's data. Do not assume every filesystem uses the classic set of 15 pointers; inspect the filesystem's own documentation when internal layout matters.

Inode Limits and “No Space Left”

Inode capacity is filesystem-specific. An ext4 filesystem normally begins with a finite inode count chosen when the filesystem is created, although resizing or specialised features can affect the capacity later. A workload that creates enormous numbers of tiny files can therefore exhaust available inodes even when free storage remains.

df -h    # Check storage capacity
df -i    # Check inode usage

df -h answers “how full is the storage?” while df -i answers “how many inodes are in use?” A filesystem can, for example, show 62% storage use in df -h but 100% inode use in df -i; new files can then fail even though bytes remain available. Clear only files that are known to be disposable—usually after identifying a source of excessive small files. Inode exhaustion is a symptom to investigate, not permission to delete broad directories blindly.

Useful Commands

Command	Purpose
ls -i FILE	Show a file's inode number.
ls -li FILE	Show inode number with long-listing metadata.
stat FILE	Display detailed file and inode-related metadata.
find PATH -xdev -inum NUMBER	Find directory entries with a particular inode number without crossing into another filesystem.
df -i	Show inode usage for mounted filesystems.
ln SOURCE NAME	Create another hard link to the same inode.
ln -s TARGET NAME	Create a symbolic link that stores a target path.

Common Misunderstandings

• A filename and an inode are not the same thing; the directory connects them.
• The inode number alone is not globally unique—it is scoped to a filesystem.
• ctime is normally metadata change time, not creation time.
• File size and allocated disk blocks can differ because of sparse files, compression, or filesystem details.
• Deleting a visible name may not immediately free space if another hard link or open process still references the file.
• The classic direct-and-indirect pointer layout is not universal across modern filesystems.

Quick Recap

• A directory maps a filename to an inode number.
• The inode stores metadata and information used to locate file data.
• Hard links are multiple names for one inode; symbolic links store a path.
• Unlinking removes a name, while reclamation waits until no links or open handles remain.
• ls -i, stat, and df -i reveal the most useful inode information.