Understanding Inodes: How Unix/Linux Stores File Metadata

What is an inode?

Files are stored on a hard disk in sectors (512 bytes each). The operating system reads data in larger units called blocks, typically 4 KB (eight sectors). Since file data resides in blocks, the system needs a separate structure to store file metadata such as owner, timestamps, and permissions. This structure is the inode (index node).

Contents of an inode

File size in bytes

Owner's User ID

Group ID

Read, write, and execute permissions

Three timestamps: ctime (inode change), mtime (content change), atime (last access)

Link count (number of filenames pointing to the inode)

Locations of the data blocks

You can view an inode's information with the stat command:

stat example.txt

Size of inodes

During formatting, the disk is divided into a data area and an inode table. Each inode typically occupies 128 bytes or 256 bytes, and the total number of inodes is set (e.g., one inode per 1 KB). On a 1 GB disk with 128‑byte inodes and one inode per 1 KB, the inode table would consume about 128 MB (12.8% of the disk).

To see inode usage per filesystem: df -i To query the inode size on an ext2/3/4 filesystem:

sudo dumpe2fs -h /dev/hda | grep "Inode size"

Inode numbers

Each inode has a unique number used by the kernel to identify files. The user sees filenames, but internally the system resolves a filename to its inode number, reads the inode, then accesses the data blocks.

Display a file's inode number with:

ls -i example.txt

Directory files

In Unix/Linux, a directory is also a file. Its contents are a list of directory entries (dirents), each pairing a filename with an inode number. Common commands:

ls /etc

ls -i /etc

ls -l /etc

Hard links

Normally one filename maps to one inode, but Unix/Linux allows multiple filenames to reference the same inode—hard links. Changes to the file affect all names, and deleting one name does not remove the data until the link count drops to zero.

Create a hard link with:

ln source_file target_file

Soft (symbolic) links

A symbolic link is a special file whose contents are the path to another file. Accessing the symlink redirects the kernel to the target file. Deleting the target breaks the link, but the link count of the target inode is unchanged.

Create a symbolic link with:

ln -s source_path target_path

Special uses of inodes

When a filename contains problematic characters, deleting the inode directly removes the file.

Renaming or moving a file changes only the directory entry; the inode number stays the same.

After a file is opened, the kernel continues to identify it by inode, allowing software updates without restarting: a new version gets a new inode while the running process still uses the old one until the next launch.

Understanding inodes clarifies many Unix/Linux behaviors, from link management to seamless software upgrades.