Community Free Software Group

More on Inodes

Here are a few notes about inodes, because I think a few of you were confused about this point.

First I think it is confusing to think about how the inodes are stored on the disk because this is mostly transparent to the user. It is however interesting and perhaps important to know that inodes exist and interesting to know a little about how they work. First we saw in class that a partition has a set number of inodes, this is important and probably the most important thing you as the end user need to know.

One inode per file.
You can't have more files than inodes on a partition.

To delve one level deeper.

An inode stores administrative information about a file.
- How long the file is
- Where on the disk the contents of the file are stored.
- The permissions on the file (to which user and group it belongs)
- There are also three times in the inode.
  
  - the time the contents of the file where last modified
  
  - the time the file was last used (read or executed)
  
  - the time the inode itself was last changed (ex. to set permissions)
The system's internal name for a file is its i-number You can see a file's i-number by typing
```
ls -i
```
in a directory. The best source for more information I have found for this is: The Unix Programming Environment by Kernighan and Ritchie ch2 The file system )
A directory file contains an entry for each file in that directory. The directory entry for a particular file contains the file name and inode number. The inode number is a volume data structure used by the file system. It has an associated entry in the inode table which contains other information about the file such as the owner, file protection, modification date.

What is important to understand about inodes?

When you move (mv) a file from one directory to another in the same partition, you are just changing the information in two directory listings. The file stays in the same place on the disk so the move is very quick. If, however, you move a file to a directory on another partition, the whole file will get copied to disk space on the other partition and a new inode will be created on the other partition. On the original partition all references to the inode will be erased from the directory tree, the file becomes "unlinked" which signals to the system that that area on the disk can be written over. (The area is not actually written over until something is written over it, but don't get too excited about recovery possibilities, your file is lost)
It is possible to have two names point to the same inode. Thus to have two names for the same file.
```
ln old_file new_file 
```
accomplishes this. Both old file and new file will have the same inode. (you can check this with ls -i). This is called a hard link. You cannot create a hard-link across partitions. A soft link (ln -s) maps a file name to another file name. If you delete one of the hardlinks, the other link still points to the exact same file. If you delete the original file and a symboloc link is still pointing to that file. The symbolic link will point to nowhere. On my colorised bash shell this is made obvious by reverse video red. This link points to nowhere screams the red.
Understanding inodes, helps with understanding linking in unix.

Ok but how can this inode info help me in real life situations?

(Don't worry if you don't understand this just yet, these are just to get you thinking)

Other unix tools like find can search for information which is stored in the inode, such as the time data, to help you make very specific searches of your system. This can be very usefull in diagnostic situations.

eg.

Has somebody read this file recently ?

-check the inode atime (access time)

Has someone been poking around in my system?

find all files which have been touched recently. Of course a good cracker would coverup these traces. But programs such as TripWire use this type of information in protecting your system.
Other powertip: why is the battery on my laptop getting used up so quickly? --updating the inode on each open file generates disk activity and this eats up battery. The noatime switch when mounting a disk (listed in /etc/fstab) will fix this :)

Hopefully one day this knowledge will help you debugging some system. For the first day of linux_1 this is probably a bit much... If however you are dying to know more about the physical implementation of the inodes and the filesystem, I can suggest this link: http://web.mit.edu/tytso/www/linux/ext2intro.html