What is an inode?

What information does an inode contain?

A Unix file is “stored” in two different parts of the disk – the data blocks and the inodes.

The data blocks contain the “contents” of the file. The information about the file is stored elsewhere – in the inode.

Both the inodes and data blocks are stored in a “filesystem” which is how a disk partition is organized.

ls -i –  lists the inode of a file

Inode = index node

The inode object represents all the information needed by the kernel to manipulate a file or directory.



% ls -i
2637825 bin     983041 etc	       1572865 lib	   2981889 media  2531329 root	 106497 selinux    81921 usr
 196609 boot         2 home	       1761281 lib64	   2129921 mnt	     6416 run	2457601 srv	  425985 var

The “-i” option lists the inode number before the filename. The numbers look like large numbers, except for “home.” Now let’s get more information, and list some more files by added “-a” and “-l” options:

% ls -lai | tail -7
total 132
      2 drwxr-xr-x  24 root root   4096 Feb 26 13:31 .
      2 drwxr-xr-x  24 root root   4096 Feb 26 13:31 ..
2637825 drwxr-xr-x   2 root root   4096 Jan 14 19:02 bin
 196609 drwxr-xr-x   3 root root   4096 Feb 24 10:41 boot
      3 drwxr-xr-x  16 root root   4460 Mar  5 09:35 dev
 983041 drwxr-xr-x 206 root root  12288 Mar  5 07:45 etc
      2 drwxr-xr-x  14 root root   4096 Dec 29 09:24 home

That’s interesting – three of the files have the inode value of “2”. But as you shall see, this makes perfect sense.



The inode contains the following pieces of information

  • Mode/permission (protection)
  • Owner ID
  • Group ID
  • Size of file
  • Number of hard links to the file
  • Time last accessed
  • Time last modified
  • Time inode last modified


Where is the NAME of the file. Or the Path? It’s NOT in the inode. It’s NOT in the data blocks. It’s _in_ the directory. That’s right. A “file” is really in three (or more) places on the disk.

When you create a hard link, it just created a new name in the table, along with the inode, without moving the file.

Now let’s get more information from this directory.

$ ls -lad /tmp/junk
drwxrwxr-x 2 barnett barnett 4096 Mar  5 10:42 /tmp/junk

The second field has the value of “2” – which indicates that there are two hard links to this file. This makes sense because directories always have at least two names, as this shows.

/tmp/junk$ cd /tmp
/tmp$ ls -iad junk  # look at the file /tmp/junk
435297 junk
/tmp$ cd junk
/tmp/junk$ ls -iad . # look at the file "." in the /tmp/junk directory
435297 .

Note that you can find when the permissions of a file last changed (even if the data in the file wasnt changed) by referencing ctime Note that when the hard link count makes it to zero, the inode and its associated data are deleted.