Updated: 2003-09-23 14:44

Unix File System Nodes (inodes)

Unix directories and files don't really have names.  They are numbered, using node numbers and are called inodes, vnodes, or even gnodes (depending on the version of Unix).

You won't find the name of a particular file or directory in or near the file or directory itself.  All the name-to-number mappings of files and directories are stored in the parent directories.  For each file or directory, a link count in the node keeps track of how many parent directories contain a name-number mapping for that node.  When a link count goes to zero in a node, no directory points to the node and Unix is free to reclaim the disk space.

Unix permits all files to have many name-to-number mappings.  So, a file may appear to have several different "names" (Unix calls them "links"); that is, several names that all map to the same node number (and thus to the same file).   Or, the file may have the same "name"; but, that name may appear in different directories (each name with a link to the same node number). 

Anyone can create a link to any file to which they have access. They don't need to be able to read or write the file itself to make the link; they only need to be able to access the node of the file, and they need write permission on the directory in which the name-to-number map (the name, or "link") is being created.  (Also, unrelated to permissions, the node of the thing to which the link is being made must be on the same file system as the directory that will contain the link.  See "File Systems", below.)

Directories are not allowed to have many name-to-number mappings.  Each directory name-to-number map is allowed to appear in exactly one parent directory and no more.   This restriction means that every directory has only one "name".  It prevents loops and cycles in the file system tree.  (Many things are simpler if the tree has no cycles.)

Since a parent directory may have many sub-directories, and since the name ".." (dot dot) in every one of those sub-directories is a link to the node number of the parent directory, the link count of the parent directory is increased by one for every sub-directory the parent contains.  Every directory also contains the name "." (dot), a map to the directory itself, so the smallest link count of any Unix directory is 2: one for the map in the parent directory that gives the directory its "name", and one for the dot map in the directory itself.

Example - Files, Directories, and Inodes

Suppose the root directory has node number #2.  Here is a small part of a Unix file system tree, showing hypothetical node numbers:

Example - Many Names, Same Node

Here are two shell programs that are each linked into different directories under different names.  The only way you can tell which names point to the same program files is by looking at the inode numbers using the "-i" option to ls:

The inode numbers show which names are links to the same content.  The ncheck command is usable only by the Super User. It walks the entire disk partition, looks at all the directories and finds all the names that link to a particular inode.  (It's both slow and expensive.)

Damage - Orphans and Lost+Found

When a Unix file system suffers damage, one or more nodes may become unreadable.  If the damaged nodes are file nodes, the file data blocks pointed to by those nodes will be missing or incomplete.  If any of the nodes are directory nodes, containing the names of files and sub-directories, the files and sub-directories that were once pointed to by those nodes will lose their names and become "orphans" - nodes with nothing pointing to them.

At boot time, the Unix file-system checking program, fsck, notices the existence of files and sub-directories that no longer have names.  (It finds file nodes with a positive link count but can't find any directories that link to the nodes.)  fsck gives the orphans false names (most Unix systems create new names that are just the node numbers) and links them into a special directory  named "lost+found" when the system reboots itself.  The system admin must go into the directory and figure out what the files are, what their names are, and where they belong.

Note that only the names are lost when a directory is damaged.  The owner, permissions, and access times are all stored with the data, and are not lost.

Many File Systems

A Unix file system is equivalent to a single disk partition. Each Unix file system has its own set of node numbers. Since the overall hierarchical tree on a Unix system may transparently include pieces from several file systems (from several partitions), some items in the hierarchical tree will appear to have the same node numbers, but will actually be different files residing on different file systems.

A directory's name-to-number mapping applies only within a single Unix file system. It isn't possible for a directory to map to a node number in a different file system (i.e. in a different disk partition). A special "mount" command is used to splice together different file systems into one hierarchical tree.

The "-i" option to the "ls" command shows which node number is associated with a file or directory; the "df" command can show on which disk partition (file system) the file or directory resides:

Web Author: Ian! D. Allen idallen@idallen.ca      Updated: 2003-09-23 14:44

Support free and non-commercial Internet.

This site works best in Any Browser, a campaign for non-specific WWW.

This work is licensed under a Creative Commons License.