what is a file?

Basically in Linux everything is a file, or simulated by files. So it's important to know how it works, how to deal with it.

Linux implements a file with 3 main parts:

1. Inode (pronounced i-node)
2. Dentry (pronounced d-entry)
3. Data blocks

1. Inode

inode is the part that contains some meta-data of a file. like owner, permissions and pointers to the blocks of actual data in the storage.

Some facts about inode:

1. inode has a unique number across the whole file system.
2. File system has a limited number of inodes. Which means a limited number of file creations.

   One can make the disk full while not having any actual data on it. Can you think how to do that? answer is at the end of the article.

However you will notice that the file name and its path aren't included within the inode so where are they stored?

2. Dentry

denrtry is another structure related to each file but contains file name, children, file parent and the inode number.

note: a directory is some sort of a file. So when we say that file has a child, it means this is a directory.

3. Data blocks

Data blocks represent the content of file stored physically in the disk.

Some system operations

Now Let's see some system operations to understand why a file takes that structure.

• Renaming a file: is done only by changing the file name in dentry part typically you rename by using mv command mv file1 file2

• Moving a file (within the same file system): all we need is to change the file path which means only changing the dentry.

• Moving a file to different file system: kernel moves all 3 parts to another place.

• Linking: Linking is used When you want to make another location to the same file.

There are 2 types of linking:

1. Hard link: here we make a new dentry points to the same inode but it has some limitations like:
   1. It's applicable only for files, causes looping when used with directories.
   2. It doesn't work across more than one file system(because inodes are unique across one filesystem).
2. Symbolic link: here we make a new file with it's three parts, but the data block is pointing to the dentry of the original file.

• Deleting a file: Kernel deletes only the hard links of a file. Once all are removed, it frees the inode and data blocks(we can't tell which is the original dentry and which is hardlink). What if file has symbolic links? We can remove the symbolic link itself then remove the file but if we removed the file now links are broken which means it points to nothing.

Related commands:

• To list files and show their inodes.

ls -i

• To show disk status with inode usage

df -i

• To make hard link(notice that it's rarely used because of its disadvantages)

ln <original_file_absolute_path> <link_path_and_name>

• To make symbolic link

ln -s <original_file_absolute_path> <link_path_and_name>

The answer to question: How disk could be full but doesn't contain any data(full but empty)? We can create number of empty files equals the number of the system inodes. In this case we can't create more files because inodes are consumed.