Inode

Understanding UNIX / Linux filesystem Inodes

The inode (index node) is a fundamental concept in the Linux and UNIX filesystem. Each object in the filesystem is represented by an inode. But what are the objects? Let us try to understand it in simple words. Each and every file under Linux (and UNIX) has following attributes:

=> File type (executable, block special etc)

=> Permissions (read, write etc)

=> Owner

=> Group

=> File Size

=> File access, change and modification time (remember UNIX or Linux never stores file creation time, this is favorite question asked in UNIX/Linux sys admin job interview)

=> File deletion time

=> Number of links (soft/hard)

=> Extended attribute such as append only or no one can delete file including root user (immutability)

=> Access Control List (ACLs)

All the above information stored in an inode. In short the inode identifies the file and its attributes (as above) . Each inode is identified by a unique inode number within the file system. Inode is also know as index number.

inode definition

An inode is a data structure on a traditional Unix-style file system such as UFS or ext3. An inode stores basic information about a regular file, directory, or other file system object.

How do I see file inode number?

You can use ls -i command to see inode number of file

$ ls -i /etc/passwd

Sample Output

32820 /etc/passwd

You can also use stat command to find out inode number and its attribute:

$ stat /etc/passwdOutput:

File: `/etc/passwd' Size: 1988 Blocks: 8 IO Block: 4096 regular file Device: 341h/833d Inode: 32820 Links: 1 Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2005-11-10 01:26:01.000000000 +0530 Modify: 2005-10-27 13:26:56.000000000 +0530 Change: 2005-10-27 13:26:56.000000000 +0530

Inode application

Many commands used by system administrators in UNIX / Linux operating systems often give inode numbers to designate a file. Let us see he practical application of inode number. Type the following commands:

$ cd /tmp

$ touch \"la*

$ ls -l

Now try to remove file "la*

You can't, to remove files having created with control characters or characters which are unable to be input on a keyboard or special character such as ?, * ^ etc. You have to use inode number to remove file. This is fourth part of "Understanding UNIX/Linux file system, continue reading rest of the Understanding Linux file system series (this is part IV):

How to: Linux / UNIX Delete or Remove Files With Inode Number

by nixCraft on January 27, 2006 · 43 comments· Last updated December 14, 2007

An inode identifies the file and its attributes such as file size, owner, and so on. A unique inode number within the file system identifies each inode. But, why to delete file by an inode number? Sure, you can use rm command to delete file. Sometime accidentally you creates filename with control characters or characters which are unable to be input on a keyboard or special character such as ?, * ^ etc. Removing such special character filenames can be problem. Use following method to delete a file with strange characters in its name:

Please note that the procedure outlined below works with Solaris, FreeBSD, Linux, or any other Unixish oses out there:

Find out file inode

First find out file inode number with any one of the following command:

stat {file-name}

ls -il {file-name}

Use find command to remove file:

Use find command as follows to find and remove a file:

find . -inum [inode-number] -exec rm -i {} \;

When prompted for confirmation, press Y to confirm removal of the file.

Delete or remove files with inode number

Let us try to delete file using inode number.

(a) Create a hard to delete file name:

$ cd /tmp

$ touch "\+Xy \+\8"

$ ls

(b) Try to remove this file with rm command:

$ rm \+Xy \+\8

$ ls -ilOutput:

781956 drwx------ 3 viv viv 4096 2006-01-27 15:05 gconfd-viv 781964 drwx------ 2 viv viv 4096 2006-01-27 15:05 keyring-pKracm 782049 srwxr-xr-x 1 viv viv 0 2006-01-27 15:05 mapping-viv 781939 drwx------ 2 viv viv 4096 2006-01-27 15:31 orbit-viv 781922 drwx------ 2 viv viv 4096 2006-01-27 15:05 ssh-cnaOtj4013 781882 drwx------ 2 viv viv 4096 2006-01-27 15:05 ssh-SsCkUW4013 782263 -rw-r--r-- 1 viv viv 0 2006-01-27 15:49 \+Xy \+\8

Note: 782263 is inode number.

(d) Use find command to delete file by inode:

Find and remove file using find command, type the command as follows:

$ find . -inum 782263 -exec rm -i {} \;

Note you can also use add \ character before special character in filename to remove it directly so the command would be:

$ rm "\+Xy \+\8"

If you have file like name like name "2005/12/31" then no UNIX or Linux command can delete this file by name. Only method to delete such file is delete file by an inode number. Linux or UNIX never allows creating filename like 2005/12/31 but if you are using NFS from MAC OS or Windows then it is possible to create a such file.