The “inode” is sometimes referred to as an index node. But what is it? Basically, it is a file structure on a file system. More easily, it is a “database” of all file information except the file contents and the file name.
In a file system, inodes consist roughly of 1% of the total disk space, whether it is a whole storage unit (hard disk,thumb drive, etc.) or a partition on a storage unit. The inode space is used to “track” the files stored on the hard disk. The inode entries store metadata about each file, directory or object, but only points to these structures rather than storing the data. Each entry is 128 bytes in size. The metadata contained about each structure can include the following:
- Inode number
- Access Control List (ACL)
- Extended attribute
- Direct/indirect disk blocks
- Number of blocks
- File access, change and modification time
- File deletion time
- File generation number
- File size
- File type
- Group
- Number of links
- Owner
- Permissions
- Status flags
NOTE: the metadata does not include the file’s name.
Rather than the name, the inode of each file uses a pointer to point to the specific file, directory or object. The pointer is a unique number which usually is referred to as the inode number. For example, to get a listing of an inode number, use the following command:
You can use the “stat” command to get more information than the inode number:
A sample output is shown for both commands:
Code:
ls –i Journal.rtf
buse@Buse-PC:/media/buse/Norton$ ls -i ./Journal.rtf
160 ./Journal.rtf
Code:
stat –i Journal.rtf
buse@Buse-PC:/media/buse/Norton$ stat ./Journal.rtf
File: ‘./Journal.rtf’
Size: 22661 Blocks: 48 IO Block: 4096 regular file
Device: 811h/2065d Inode: 160 Links: 1
Access: (0644/-rw-r--r--) Uid: ( 1000/ buse) Gid: ( 1000/ buse)
Access: 2013-05-26 00:00:00.000000000 -0400
Modify: 2013-05-26 17:58:04.000000000 -0400
Change: 2013-05-26 17:58:02.180000000 -0400
Birth: -
In these cases, you can see that the inode number for the Journal.rtf file is 160 for both commands. An inode number can only change if the file is moved.
For example, the previous output came from the file Journal.rtf. If the file is moved to a different directory, the commands are executed again, the inode numbers are different:
Code:
ls –i Journal.rtf
buse@Buse-PC:/media/buse/Norton/test$ ls -i ./Journal.rtf
372 ./Journal.rtf
Code:
stat –i Journal.rtf
buse@Buse-PC:/media/buse/Norton/test$ stat ./Journal.rtf
File: ‘./Journal.rtf’
Size: 22661 Blocks: 48 IO Block: 4096 regular file
Device: 811h/2065d Inode: 372 Links: 1
Access: (0644/-rw-r--r--) Uid: ( 1000/ buse) Gid: ( 1000/ buse)
Access: 2013-05-26 00:00:00.000000000 -0400
Modify: 2013-05-26 17:58:04.000000000 -0400
Change: 2013-05-26 17:58:02.180000000 -0400
Birth: -
Now, the inode number is 372 rather than 160.
If a file exists that has special characters in the filename that are not present on the keyboard, you can find it difficult to remove the file in question, when not using a Graphical User Interface (GUI). The command “ls –i directory” to get a listing of all the files in a directory and their inode number. To delete the file using the inode number, use the following command:
Code:
find ./ -inum number -exec rm -i {} ;
Insert the inode number in the italicized number section. The file can be deleted by the inode number and not the filename. Be sure to type a ‘y’ (without single quotes) to approve the file should be deleted.
You may be asking, how are the file name and inode numbers associated with each other? A listing of directories and the files contained in them also lists the inode number for each file name. When an application needs a file, the application exchanges the file name for the inode number from the directory listing. After that, the application uses the inode number for a reference to the file. The only times an application does not use the inode number is when the file names are displayed on the screen.
To find the inode numbers of the directories, you can use the command “tree -a -L 1 –inodes / “. The command will output something similar to the following:
Code:
buse@Buse-PC:/media/collier/Norton$ tree -a -L 1 --inodes /
/
├── [2097153] bin
├── [ 524289] boot
├── [3932161] cdrom
├── [ 1026] dev
├── [2883585] etc
├── [3801089] home
├── [ 524291] initrd.img -> boot/initrd.img-3.8.0-23-generic
├── [ 524291] initrd.img.old -> /boot/initrd.img-3.8.0-23-generic
├── [1310721] lib
├── [ 786433] lib32
├── [1966081] lib64
├── [ 11] lost+found
├── [1572865] media
├── [3014657] mnt
├── [2752513] opt
├── [ 1] proc
├── [2359297] root
├── [ 198] run
├── [3145729] sbin
├── [1048577] selinux
├── [2621441] srv
├── [ 1] sys
├── [3407873] tmp
├── [1703937] usr
├── [ 917505] var
├── [ 524547] vmlinuz -> boot/vmlinuz-3.8.0-23-generic
└── [ 524547] vmlinuz.old -> boot/vmlinuz-3.8.0-23-generic
23 directories, 4 files
You can see the inode number for the specified directory in the brackets. To see files and subdirectories within a specific directory, the ls command is modified slightly. Rather than listing the file name as was done previously, the directory name is used instead, like the following:
ls –i directory
Simply replace the italicized directory with the directory name you wish to view. The subdirectories and files will be listed with its inode number. Like removing files with an inode number, you can also delete directories with its inode number as well.
The inodes do not manage data redundancy, but when inode data is lost, the file is “moved” to the “lost+found” directory of the storage unit. The filename is moved from the present directory listing to the lost+found directory listing while the inode number is changed, if needed, and matched to the file name in the new directory.
Keep in mind that “moving” a file is done by changing the file name in the directory list and updating the inode number if needed. The inode number is only in two places, the inode structure and the directory listing.
Except for inode corruption, another concern is that the drive space can be filled, or more seriously, the inode structure can be filled. The inode structure has a limited space and can be filled before the data portion of the storage unit. For example, a storage unit can contain numerous small files. Each file takes up 128 bytes of the inode structure. If the inode structure fills up before the data storage of the disk, no more files can be copied to the disk. Once inode storage is freed in the structure, the storage unit can have files written to it again.
Inode numbers are unique, but you may have noticed that some file name and inode number listings do show some files with the same number. The duplication is caused by hard links. Hard links are made when a file is copied in multiple directories. The same file exists in various directories on the same storage unit. The directory listing shows two files with the same number which links them to the same physical on te storage unit. Hard links allow for the same file to “exist” in multiple directories, but only one physical file exists. Space is then saved on the storage unit. For example, if a one megabyte file is placed in two different directories, the space used on the storage is one megabyte, not two megabytes.
Deleting files causes the size and direct/indirect block entries are zeroed and the physical space on the storage unit is set as unused. To undelete the file, the metadata is restored from the Journal if it is used (see the Journal article). Once the metadata is restored, the file is once again accessible unless the physical data has been overwritten on the storage unit.
The direct block is the pointer of the first block, or header, of the physical file. The indirect blocks are a listing of every block that contains a portion of the file (not the header). You can imagine the list can be extensive for very large files, but this problem can be resolved with extents (see the Extents article).
Reference :
Swetha's Tech Blogs 