Inodes: The Hidden Metadata That Powers Every File

# Check your inode usage - you might be surprised!
df -i

# Output might show:
Filesystem     Inodes  IUsed  IFree IUse% Mounted on
/dev/sda1     1310720 589824 720896   46% /
# That's 589,824 files on your root partition!

struct inode {
    uint16_t i_mode;        // File type and permissions (rwxrwxrwx)
    uint16_t i_uid;         // User ID of owner
    uint32_t i_size;        // Size in bytes
    uint32_t i_atime;       // Access time (last read)
    uint32_t i_ctime;       // Change time (metadata modified)
    uint32_t i_mtime;       // Modification time (content modified)
    uint32_t i_dtime;       // Deletion time (0 if not deleted)
    uint16_t i_gid;         // Group ID of owner
    uint16_t i_links_count; // How many hard links point here
    uint32_t i_blocks;      // Number of 512-byte blocks allocated
    uint32_t i_flags;       // File flags (immutable, append-only, etc.)
    uint32_t i_block[15];   // Pointers to data blocks
};

# For a small file (≤48KB with 4KB blocks):
Direct blocks 0-11 → Point directly to data
Total: 12 × 4KB = 48KB

# For medium files (≤1MB):
Direct blocks 0-11 → 48KB
Single indirect → Points to 256 block pointers → 1MB

# For large files (≤256MB):
Direct blocks 0-11 → 48KB
Single indirect → 1MB
Double indirect → Points to 256 pointers to 256 blocks → 256MB

# For huge files (≤64GB):
Triple indirect → Points to 256×256×256 blocks → 64GB!

# Create a file and a hard link
echo "Hello World" > original.txt
ln original.txt hardlink.txt

# Check their inodes - they're identical!
ls -i original.txt hardlink.txt
# 524312 original.txt
# 524312 hardlink.txt  # Same inode number!

# The inode's link count increases
stat original.txt | grep Links
# Links: 2

# Delete original - hardlink still works!
rm original.txt
cat hardlink.txt  # Still outputs "Hello World"

# Create a symbolic link
ln -s original.txt symlink.txt

# Check inodes - they're different
ls -i original.txt symlink.txt
# 524312 original.txt
# 524445 symlink.txt  # Different inode!

# The symlink stores a path, not data
readlink symlink.txt
# original.txt

# Delete original - symlink breaks!
rm original.txt
cat symlink.txt  # Error: No such file or directory

# Find inode number
ls -i myfile.txt
# 524312 myfile.txt

# Find file by inode number
find / -inum 524312 2>/dev/null

# Delete a file with a weird name using inode
find . -inum 524312 -delete

# Disk shows space available
df -h
# /dev/sda1  20G  15G  4.0G  80% /

# But can't create files!
touch newfile
# touch: cannot touch 'newfile': No space left on device

# The culprit: out of inodes!
df -i
# /dev/sda1  1310720  1310720  0  100% /

# Find the inode hogs
for dir in /*; do 
    echo "$dir: $(find $dir 2>/dev/null | wc -l)"
done | sort -t: -k2 -n | tail -5

# Format with more inodes for many small files
mkfs.ext4 -i 4096 /dev/sdb1  # One inode per 4KB (instead of default 16KB)

# Or fewer inodes for large media files
mkfs.ext4 -i 65536 /dev/sdb1  # One inode per 64KB

# Check current inode ratio
dumpe2fs /dev/sda1 | grep "Inode size"

# Make file immutable (even root can't modify!)
sudo chattr +i important.conf
lsattr important.conf
# ----i--------e-- important.conf

# Append-only (great for logs)
sudo chattr +a logfile.log

# No dump (skip in backups)
sudo chattr +d skip-this.tmp

# Secure deletion (overwrite on delete)
sudo chattr +s sensitive.dat

# View inode cache statistics
cat /proc/slabinfo | grep inode
# inode_cache  45892  45892  608  26  4 : tunables  0  0  0

# That's ~46K inodes cached in memory!

# Clear inode cache (don't do in production!)
echo 2 > /proc/sys/vm/drop_caches

# Quick diagnosis
df -h  # Shows disk space
df -i  # Shows inode usage

# If inodes are exhausted:
# 1. Find directories with many files
du --inodes -d 2 / | sort -n | tail -20

# 2. Common culprits:
# - Mail spool directories
# - Session files in /var/lib/php/sessions
# - Package manager caches
# - Old kernels in /boot

# Force filesystem check
sudo fsck.ext4 -f /dev/sda1

# Check specific inode
debugfs /dev/sda1
debugfs: stat <inode_number>

# Clear orphaned inodes
e2fsck -f /dev/sda1

# Preserve all inode metadata
cp -a source dest

# Or with rsync
rsync -av --preserve-all source/ dest/

# Use noatime mount option (skip access time updates)
mount -o noatime /dev/sdb1 /mnt/fast

# For SSDs, also use nodiratime
mount -o noatime,nodiratime /dev/sdb1 /mnt/ssd

# Increase inode cache for metadata-heavy workloads
echo 200000 > /proc/sys/fs/inode-nr