What information does an inode contain?
A Unix file is “stored” in two different parts of the disk – the data blocks and the inodes.
The data blocks contain the “contents” of the file. The information about the file is stored elsewhere – in the inode.
Both the inodes and data blocks are stored in a “filesystem” which is how a disk partition is organized.
ls -i – lists the inode of a file
Inode = index node
The inode object represents all the information needed by the kernel to manipulate a file or directory.
% ls -i 2637825 bin 983041 etc 1572865 lib 2981889 media 2531329 root 106497 selinux 81921 usr 196609 boot 2 home 1761281 lib64 2129921 mnt 6416 run 2457601 srv 425985 var
The “-i” option lists the inode number before the filename. The numbers look like large numbers, except for “home.” Now let’s get more information, and list some more files by added “-a” and “-l” options:
% ls -lai | tail -7 total 132 2 drwxr-xr-x 24 root root 4096 Feb 26 13:31 . 2 drwxr-xr-x 24 root root 4096 Feb 26 13:31 .. 2637825 drwxr-xr-x 2 root root 4096 Jan 14 19:02 bin 196609 drwxr-xr-x 3 root root 4096 Feb 24 10:41 boot 3 drwxr-xr-x 16 root root 4460 Mar 5 09:35 dev 983041 drwxr-xr-x 206 root root 12288 Mar 5 07:45 etc 2 drwxr-xr-x 14 root root 4096 Dec 29 09:24 home
That’s interesting – three of the files have the inode value of “2”. But as you shall see, this makes perfect sense.
The inode contains the following pieces of information
- Mode/permission (protection)
- Owner ID
- Group ID
- Size of file
- Number of hard links to the file
- Time last accessed
- Time last modified
- Time inode last modified
Where is the NAME of the file. Or the Path? It’s NOT in the inode. It’s NOT in the data blocks. It’s _in_ the directory. That’s right. A “file” is really in three (or more) places on the disk.
When you create a hard link, it just created a new name in the table, along with the inode, without moving the file.
Now let’s get more information from this directory.
$ ls -lad /tmp/junk drwxrwxr-x 2 barnett barnett 4096 Mar 5 10:42 /tmp/junk
The second field has the value of “2” – which indicates that there are two hard links to this file. This makes sense because directories always have at least two names, as this shows.
/tmp/junk$ cd /tmp /tmp$ ls -iad junk # look at the file /tmp/junk 435297 junk /tmp$ cd junk /tmp/junk$ ls -iad . # look at the file "." in the /tmp/junk directory 435297 .
Note that you can find when the permissions of a file last changed (even if the data in the file wasnt changed) by referencing ctime Note that when the hard link count makes it to zero, the inode and its associated data are deleted.