Linux 🎯 Understanding what Inode is in Unix/Linux

[dEEpEst]

Understanding what Inode is in Unix/Linux

If you work with Linux or administer servers, understanding inodes is a must. Without it, you won’t understand how the file system works.

File = data + metadata
Metadata (information about the file) is stored in the inode. What it contains:

- Inode number
- UID (owner)
- GID (group)
- Size
- Atime — last access time
- 🛠 Mtime — last data modification time
- Ctime — metadata modification time
- Block size
- Permissions and type (mode)
- Number of hard links
- ACL (access control lists)

File names are not stored in inodes!

They are written in the directory structure. In normal cases — linearly, so searching can be slow.

Ext4 and XFS use B-trees for fast (O(1)) name searching.

Dentry (Directory Entry)
This is a structure that links a file name to an inode inside a directory.

How does an inode point to file data?

- Direct block — the inode contains the block number with the actual data

- Indirect block — the inode contains the block number that contains the numbers of other blocks with data

🛠 Ext vs XFS: how are inodes created?

- Ext — a fixed number of inodes when formatting. Run out? Just reformat.

- XFS — inodes are created as needed. Much more flexible.

🗑 Deleting a file
Calling <code>unlink()</code> simply removes the entry from the directory and marks the inode as free.

The data itself remains on the disk until it is overwritten.

Hard and symbolic links

- Hard link increases the reference counter in the inode
- Symbolic link does not affect the counter

What is a superblock?

This is the metadata of the file system itself. There are usually several of them (in case of corruption). What is stored there:

- Total FS size
- Block size
- Number of free/occupied blocks
- Where is the inode table
- Disk block map

You can view the superblock like this:

dumpe2fs /dev/mount | grep -i superblock