What Really Happens When You Use ln, mv, and cp on Linux?

Linux provides three commands that appear to "copy" a file— ln, mv and cp —but each works in a fundamentally different way.

File system basics

A Linux file system consists of a superblock, an inode table and data blocks. Each inode stores metadata and points to data blocks. Directories are special files that contain dirent entries mapping file names to inode numbers, forming a tree structure in memory via dentry objects.

ln command

ln

creates link files. There are two types:

Soft link (symbolic link) : a new file with its own inode; the file’s data block stores the path to the target. It can cross file‑system boundaries.

Hard link : no new inode is allocated; a new dirent entry is added to the directory, pointing to the existing inode. Because it shares the same inode, hard links cannot span different file systems.

# create a symbolic link
ln -s ./test ./test_soft_link
# create a hard link
ln ./test ./test_hard_link

Soft links are created via the symlinkat system call; hard links use linkat. The kernel updates the appropriate dirent and dentry structures.

mv command

mv

moves a file. When source and destination reside on the same file system, the operation is a simple rename system call that only updates dirent entries—no data is copied and the inode number stays unchanged.

If the source and destination are on different file systems, rename fails with EXDEV. The kernel then falls back to a two‑step process: copy the file (using the same code path as cp) and then delete the original.

# same‑filesystem move (fast)
mv source.txt dest.txt
# cross‑filesystem move (copy + delete)
mv /dev/shm/source.txt /home/qiya/testdir/dest.txt

cp command

cp

performs a true data copy, duplicating both metadata and file contents. It supports the --sparse option to control handling of sparse files:

auto (default): skips empty blocks but copies data blocks.

always : skips both empty blocks and blocks filled with zeros, minimizing space usage.

never : copies every block, including holes, which is the slowest mode.

# default copy (auto mode)
cp src.txt dest.txt
# copy preserving sparsity aggressively
cp --sparse=always src.txt dest.txt
# copy without sparseness detection
cp --sparse=never src.txt dest.txt

Key takeaways

Directories store dirent lists; the in‑memory tree is built from dentry structures.

Soft links create a new inode containing a path string; they work across file systems.

Hard links add a new dirent entry pointing to an existing inode; they cannot cross file‑system boundaries. mv on the same file system is just a metadata rename; across file systems it degrades to a copy‑plus‑delete sequence. cp is the only command that always copies file data; its --sparse modes let you optimise I/O for sparse files.