An inode stores basic information about a regular file, directory, or other file system object: permissions, ownership information, various timestamps, the size of the file, extended attributes, etc. It also contains a list of direct, indirect, and doubly and triply indirect pointers to the location of the actual file contents on disk. On some FileSystems, very small files can be stored directly in the Inode itself. You can use the stat(1) command to view all sorts of inode data about a file.

Sophisticated FileSystems create Inodes on demand, but with most, the number of Inodes on a Partition has to be decided on during FileSystem creation. It is rare to run out of Inodes unless you have an unusual usage profile such as storing a news spool or Squid cache. Exhaustion of the inodes will prohibit the creation of additional files even if otherwise sufficient storage capacity exists. To find out how many inodes are available, you can use the "df -i" command.

Relation to filenames

Filenames are not stored in inodes. Instead, filenames are stored in the contents of directories along with inode numbers. The inode number is an integer that is unique within the FileSystem on which the file is stored. You can use "ls -i" to find out the inode number for a file.

Whenever a program refers to a file by name, the path is resolved to a directory, the filename is looked up in that directory, and the associated inode number is then used to locate the corresponding inode.

Multiple filenames can link the same inode. Inodes contain a counter that is increased every time a new HardLink to them is created. Deleting a filename decrements this counter; only if the counter falls to zero will the file and its inode actually be deleted. All filenames pointing to an inode are equivalent: all filenames are HardLinks.

Standard Unix timestamps

atime

Time of last access. Updated on every access to the file unless the FileSystem was mounted readonly or noatime.

mtime

Time of last modification. Updated on every write; due to buffer flushing, usually corresponds to the time when a file was last closed after opening for writing.

ctime

Time of last inode modification. Updated for any changes to permissions, ownership, link counts, file size, etc.

The ls(1) command will show mtimes with the -l switch, which can be modified with -c and -u switches to show ctime or atime, respectively. To get ls(1) to display timestamps with full precision instead of rounding to minutes, using the --full-time switch.