Understanding UNIX / Linux filesystem Inodes

The inode (index node) is a fundamental concept in the Linux and UNIX filesystem. Each object in the filesystem is represented by an inode. But what are the objects? Let us try to understand it in simple words. Each and every file under Linux (and UNIX) has following attributes:

=> File type (executable, block special etc)
=> Permissions (read, write etc)
=> Owner
=> Group
=> File Size
=> File access, change and modification time (remember UNIX or Linux never stores file creation time, this is favorite question asked in UNIX/Linux sys admin job interview)
=> File deletion time
=> Number of links (soft/hard)
=> Extended attribute such as append only or no one can delete file including root user (immutability)
=> Access Control List (ACLs)

All the above information stored in an inode. In short the inode identifies the file and its attributes (as above) . Each inode is identified by a unique inode number within the file system. Inode is also know as index number.

inode definition

An inode is a data structure on a traditional Unix-style file system such as UFS or ext3. An inode stores basic information about a regular file, directory, or other file system object.

How do I see file inode number?

You can use ls -i command to see inode number of file
$ ls -i /etc/passwd
Sample Output

32820 /etc/passwd

You can also use stat command to find out inode number and its attribute:
$ stat /etc/passwdOutput:

File: `/etc/passwd'
Size: 1988            Blocks: 8          IO Block: 4096   regular file
Device: 341h/833d       Inode: 32820       Links: 1
Access: (0644/-rw-r--r--)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2005-11-10 01:26:01.000000000 +0530
Modify: 2005-10-27 13:26:56.000000000 +0530
Change: 2005-10-27 13:26:56.000000000 +0530

Inode application

Many commands used by system administrators in UNIX / Linux operating systems often give inode numbers to designate a file. Let us see he practical application of inode number. Type the following commands:
$ cd /tmp
$ touch \"la*
$ ls -l

Now try to remove file “la*

You can’t, to remove files having created with control characters or characters which are unable to be input on a keyboard or special character such as ?, * ^ etc. You have to use inode number to remove file. This is fourth part of “Understanding UNIX/Linux file system, continue reading rest of the Understanding Linux file system series (this is part IV):

  • Part I – Understanding Linux superblock
  • Part II – Understanding Linux superblock
  • Part III – An example of Surviving a Linux Filesystem Failures
  • Part IV – Understanding filesystem Inodes
  • Part V – Understanding filesystem directories
  • Part VI – Understanding UNIX/Linux symbolic (soft) and hard links
  • Part VII – Why isn’t it possible to create hard links across file system boundaries?

🐧 Get the latest tutorials on Linux, Open Source & DevOps via RSS feed or Weekly email newsletter.

🐧 56 comments so far... add one

CategoryList of Unix and Linux commands
Disk space analyzersdf duf ncdu pydf
File Managementcat cp mkdir tree
FirewallAlpine Awall CentOS 8 OpenSUSE RHEL 8 Ubuntu 16.04 Ubuntu 18.04 Ubuntu 20.04
Modern utilitiesbat exa
Network UtilitiesNetHogs dig host ip nmap
OpenVPNCentOS 7 CentOS 8 Debian 10 Debian 8/9 Ubuntu 18.04 Ubuntu 20.04
Package Managerapk apt
Processes Managementbg chroot cron disown fg glances gtop jobs killall kill pidof pstree pwdx time vtop
Searchingag grep whereis which
User Informationgroups id lastcomm last lid/libuser-lid logname members users whoami who w
WireGuard VPNAlpine CentOS 8 Debian 10 Firewall Ubuntu 20.04
56 comments… add one
  • makash Nov 12, 2005 @ 15:01

    OT but was wondering are you from India?

    The timestamp is a give away

  • 🐧 nixcraft Nov 12, 2005 @ 19:11

    Yup I’m from India 🙂

  • Anonymous Feb 2, 2006 @ 0:00

    hm, did I something wrong? I can remove the file with $ rm “la*

  • Thomas Scott Jan 29, 2007 @ 4:08

    Future is , no one will load
    executable code , only data and
    data will be parsed by kernel and
    typed , compresed , and added to
    a structure .
    This allows the OpSys to be tiny .
    because it eliminates the extra
    work the kernel had to do ,
    explaining to humans ….
    This obsoletes SU and makes it
    much easier to “control” a machine .
    Permissions are no longer necessary .
    Scratch lists stop all unauthorized
    acesses .
    This not new , these simple fixes
    have been around for 100’s of years ,
    Only computer s/w can change in
    minutes , and “pink slip” millions .

  • aamod Aug 6, 2007 @ 6:10

    Great blog…. Has a lot of correct info and I find it very useful….

  • Riz Oct 9, 2007 @ 11:00

    just to let you know…. that file once created can be removed in another way. using rm -i *. this is an interactive mode and asks you if want to delete each file in turn. so please correct as the above information you are providing is inaccurate.

  • 🐧 nixCraft Oct 9, 2007 @ 13:58


    I’m aware of this command. A long time ago on NFS mounted system there was a file called 2001/05/11. and no UNIX / Linux command was able delete this file by name. Only method to delete such file is delete file by an inode number. Linux or UNIX never allows creating filename like 2001/05/11 but if you are using NFS from MAC OS or Windows then it is possible to create a such file.

    So above information is 100% accurate.

  • Riz Oct 9, 2007 @ 15:10


    i dont have a windows box to test this so i will take you word as gold, but it is nice to see an active posting community rather than one which is dead (which i normally find whilst search things like this)


  • Anyeos Mar 6, 2008 @ 6:14

    What strange but true I cannot create a dir or file with this commands:
    touch “10/11/2006”
    mkdir “10/11/2006”

    You can see what I’m using quotes to bypass the shell. But anyway I cannot create such file/dir.

    That is for some reason?
    I have other doubt (I don’t expect to be answered here): Why linux filesystem does not save “file creation time”? What is the reason?


  • ronald Mar 12, 2008 @ 14:24

    It’s inaccurate to say that every file under Linux has the attributes that you listed … especially the extended attributes. All these attributes are properties of the filesystem, be it ext3, xfs, jfs etc. In particular, extended attributes apply to ext2/ext3

  • prasanna kumar Apr 14, 2008 @ 9:19

    hi friends,,
    plz i want some coomands in linux
    1)question: in linux basic commands are not working that u can do.
    example : ls
    pc displays command not found.
    2)question : i have 3 files. i want serach some words like kernel.all files are have kernel word so prints word as well as numbers with single line. using single command grep (or) sde command plz send syntax and example.

    • Prabjeet Singh Apr 17, 2012 @ 15:44

      try this:

      $ sudo su –
      # ls

  • Moneo May 19, 2008 @ 11:10

    rm ‘”la*’

    deleted it fine for me

  • tarun May 20, 2008 @ 20:11

    this is to aneyous according to my knowledge if u want to create a file say 10/11/2008 try this 10112008 and for a directory also

  • tarun May 20, 2008 @ 20:28

    guys i have one question i couldnt find an answer to ..i will explain in steps what did i do
    from root user i did this:
    1. adduser tarun
    2. passwd tarun
    3. log in to a terminal with user tarun
    4. create a text file say “test1” with “cat” and
    type some text in it,and save the file.
    5. now i did chmod 000 on the file.
    6. i opened “test1” with vim editor. i try
    inserting some text in it i get a warning tht
    i might be changing a read only file,
    7. i save and exit the text inside “test1”
    forcefully using “wq!”
    8. now i do chmod 644 on “test1″and again open the file and write something in it and save it
    9. if do “cat test1” i see only the last text i inserted after doing chmod 644 and not anything before …could’nt figure it out why the system did not append the text i had just written to the text i had written earlier

    • vinod Apr 14, 2010 @ 11:12

      when you inserting the text into test1 file while the file has 000 access permissions it gives you warning but when you after chmod644 the file has only read and write permissions not execute to owner so you write in test1 and can’t execute so system bydefault takes the last text. so try by chmod744 then insert text.

    • Arunachalama Dec 12, 2010 @ 7:37

      When tried first time , permission was 000, obviously no access to write,read or execute to any one, not even root,
      and one thing you have to notice in VIM editor commands
      You have entered “:wq!” – it mens what ever the error (in your case the error is, you are trying to append data to a read only file) ignore and close the file forcefully.

      if you tried it with “:wq” then it will shows the error i.e read only file.

      but second time that is with permission 644, Vinoth is correct
      Vinoth’s reply
      “chmod644 the file has only read and write permissions not execute to owner so you write in test1 and can’t execute so system bydefault takes the last text. so try by chmod744 then insert text”

    • sayantika Oct 17, 2012 @ 10:06

      i did what u did but am getting all the lines, and not just the last one…

  • Krishna Dec 3, 2008 @ 16:54

    There are no inodes for creating files, how can i overcome this situation

  • Bbp Feb 19, 2009 @ 15:43


    The command “chmod 000” change the file rights. The code “000” is in Octal.
    The first byte is for file owner rights.
    The second byte is for group rights.
    The third byte is for rights according to other users.

    The numbers, in octal, works as following:
    0 = (—) = No right
    1 = (–x) = Execute
    2 = (-w-) = Write
    4 = (r–) = Read
    You can combine them:
    3 = 1+2 = (-wx) = Write + Execute
    5 = 1+4 = (r-x) = Read + Execute
    6 = 2+4 = (rw-) = Read + Write
    7 = 1+2+4 = (rwx) = Read + Write + Execute

    Example, “chmod 740 somefile” will give full access to the owner of “somefile” (rwx), read only for other member of the file group (r–) and protect the file from been access by other users (—). The command “ls -l somefile” display this:
    -rwxr—– 1 me filegroup 0 Feb 19 10:32 somefile

    So, the command “chmod 000” remove all rights to anyone on the file, including the owner. That’s why you can not wirte new data on it and you have to force quit from vi (q! is a forced quit).
    The command “chmod 644” give the number 6 for the owner (rw-) which give you back the read and write access.

  • Iyyappan Mar 23, 2009 @ 17:28

    innode ******** has illegal blocks. clear ?

    what issue is this one. is this a major issue . kindly reply . i need help badly. mean while i am googling to find a solution

  • Mukesh Handa Aug 23, 2009 @ 10:17

    Hi Friends I am new to this linux world…. I am struck with one thing…. I want to know how we can change our root password if i forget this….

  • spark Oct 19, 2009 @ 10:48

    welcome to the world of Linux
    its quite easy to change password of root..start ur OS in single user mode….for tht u simply edit kernal parameter
    to edit kernal simply go to kernal parameter press (e) to edit,nw simply rite 1 thr & thn press (b) to boot system to boot the system..
    thr u will get a shell kind of( sh.3#) there simply type (passwd) shell will ask u for new Unix password..type the new password,thn retype it.ur password will b changed

  • P.Karunakar reddy Feb 20, 2010 @ 18:00

    how can i recover data from inode numbers

  • vikram Feb 23, 2010 @ 18:20

    I am vikram i am new to linux world. My frnds r playing vth linux. I am soo many doubts in this
    1). If you having a string”one two three”,Which shell commamd would you use to extract the strings?
    2).What is diff bw a shell varible that is exported and the one that is not exported?
    3).How wil u list only the empty lines in a file(using grep)?
    4).How do u open a read only file in unix?
    5).How do u schedule a command to run at 4:00every morning?
    6).What are diff kinds of loops available in shell script?
    7).What is the use of “cut”command?give some example . Can we use “awk”or “sed”?
    8).What is the line in shell script do #!/bin/ksh
    9).What is diff bw writing code in shell and editor?
    10).What is diff “thread” and “process”?

  • vikram Feb 23, 2010 @ 18:28

    1).How can we know how many had logged in and logged out in last 10 min?
    2).How to delete a word from a file using shell?
    3).How to extract the second row of a text-file?
    4).How to compare 2 floating point num?

  • karunakar reddy.P Mar 1, 2010 @ 16:20

    hi, i am karan,
    what is diff between soft link and hard link

  • vinod Apr 14, 2010 @ 10:57

    Super blog, I just love it . I am so excited to study more about linux.Thank you

  • sat Jul 6, 2010 @ 5:58

    I need to view inodes details in graphical window. Is there any command.

  • akhilesh singh Aug 12, 2010 @ 9:18

    what is link of file system (ext2,ext3) and inode number.

  • gabak Oct 18, 2010 @ 2:02

    i did a file with touch
    ex: touch 111
    ls -la
    i see the list of file with the date and hours.
    why does it say in this article that linux inodo does nt say file creation time??

  • mhrivnak Jul 11, 2011 @ 5:04

    The number of soft links, or any information about soft links, is definitely not stored in the inode. Otherwise, great write-up.

  • satish inmpudi Aug 23, 2011 @ 11:36

    how to remove user with data directory also in one cmd

  • satish inmpudi Aug 23, 2011 @ 11:37

    How to create a directory root user also cnt delete it

  • Senthilkumar Dec 28, 2011 @ 9:02

    Hi to all,
    I want some details about EXT4 Inode 128 and 256.
    Actually i am using windows XP 32 bit os. And i have created ext4 256 inode to my 250GB external usb drive. after creating this ext4 256inode i pluged into windows XP machine the drive is not detecting to my system. i am using IFS 1.11a version. if any patch file please send me. any other information please share with me.

  • Arun Jan 22, 2012 @ 12:26

    Really nice website 🙂

    Thanks for the information.

  • prabhas Nov 28, 2012 @ 10:47

    Thanks for the info…… its very helpful

  • so Feb 6, 2013 @ 10:42

    so how delete file by inode number?

  • shankar Feb 8, 2013 @ 10:30

    i wonder why u u mention UNIX or Linux never create file creation time actually it displays modifying time so please check again (text created in opensuse)

  • shankar Feb 8, 2013 @ 10:39

    i mean create or store time (file created)

  • sankara Feb 15, 2013 @ 1:39

    very useful….thanks 2 all….

  • Karl Max Mar 16, 2013 @ 14:50

    Hi, i saw your post and i really like it, but, about inode or how to remove a file that has a direfent name or diferent by default of the system like ( “la* ) i can say that i can remove it using this tips ( ‘ ‘) like it :

    touch “la*
    when i type ls -il
    it list “la* right?
    but, whe i type rm -i “la* the linux prompt me like this:
    and i need put crtl+c to get out…
    but when i type rm -i ‘ “la* ‘ it work

    thanks for read….greetings

  • amit Apr 9, 2013 @ 0:28

    correction to the line in the article
    => Number of links (soft/hard)

    it is only hard links and not soft links

  • BlackList May 28, 2013 @ 5:02

    you can remove that file without Inode by using this command:
    rm “la*

  • pk Jun 19, 2013 @ 17:23

    userdel -r [username] will delete the user and its home directory as well.

  • pk Jun 19, 2013 @ 17:29


    What is diff “thread” and “process”?

    A: Thread used to handle a request in partly manner i.e each thread handle some portion of a request.
    But Process handle a single complete request at once.

  • pk Jun 19, 2013 @ 17:39

    What is diff bw writing code in shell and editor?

    A: In linux script code is a set of commands which are placed in single .sh file and can be executed once to automate a task.
    if we use these commands on shell, we cannot get the o/p of the task at once and need to enter the commands one by one in shell.

    Also, if we write linux code in a editor & save, it will become a script, else for every command manual intervention is required to get the o/p.

  • pk Jun 19, 2013 @ 17:41

    What is the line in shell script do #!/bin/ksh

    A: It will execute script on the same shell (korn shell) and no export env. variable is required.

  • pk Jun 19, 2013 @ 17:44

    What is the use of “cut”command?give some example . Can we use “awk”or “sed”?

    A: We can use sed & awk as well.

    eg: sed -e ‘s/a/b/g’ & awk ‘{print $1}’

  • pk Jun 19, 2013 @ 17:48


    4).How do u open a read only file in unix?
    5).How do u schedule a command to run at 4:00every morning?

    A: to open a read only file use ‘cat filename’ or ‘Vi filename’ or ‘nano filename’.
    A: to schedule use : 00 04 * * * sh [location of your script] 2&>/dev/null

  • Janis Oct 30, 2013 @ 9:39

    $ cd /tmp
    $ touch “la*
    $ ls -l

    Can be deleted:
    $ rm ‘”la*’

  • Ronald Monty Montemayor Dec 6, 2013 @ 17:48

    >>”Now try to remove file “la*
    >>>You can’t”””


    Everything in the filesystem that has a filename can be removed. only then if the file lost it’s inode, or the filename got lost, then it’s a problem… it it can still be taken care of by fsck and they’ll end up in lost+found folder…

    SO, how do you remove the “la* file? easy…

    # rm ”la*”

    Done!… please correct this article, you are sending the wrong message to the community.

  • nadrimajstor Jan 15, 2014 @ 20:33

    (remember UNIX or Linux never stores file creation time, this is favorite question asked in UNIX/Linux sys admin job interview)

    Don’t know about UNIX, but Linux do store file creation time.
    Reference from 2006. Re: creation time stamps for ext4
    Example: debugfs -R “stat /etc/hosts/” /dev/sdb1

    ctime: 0x5165b3df:5a65abd4 — Wed Apr 10 20:47:59 2013
    atime: 0x52d5e403:e1b13ab0 — Wed Jan 15 02:27:31 2014
    mtime: 0x5165b3df:5a65abd4 — Wed Apr 10 20:47:59 2013
    crtime: 0x5165b31e:a3d45f98 — Wed Apr 10 20:44:46 2013

    Notice aditional crtime field.

    Please consider updating the article.
    Thank you in advance.

  • Sai Jul 19, 2014 @ 5:56

    mv filename newfilename

  • Vanish Aug 4, 2014 @ 21:03

    Actually you can delete “a* using mc -> F8.
    That is if you have mc installed.

  • Ankit Oct 27, 2014 @ 13:17

    can be deleted like this –

    [root@kicktest tmp]# touch “la*
    [root@kicktest tmp]# rm *la*
    rm: remove regular empty file `”la*’? y

Leave a Reply

Your email address will not be published.

Use HTML <pre>...</pre> for code samples. Still have questions? Post it on our forum