This page looks best with JavaScript enabled

Inode, the great unknown

 ·  🎃 kr0m

File systems are composed of blocks, each block is a small piece of the hard drive, these pieces can be used for various purposes, metadata and superblocks.

  • Metadata: Useful user information
  • Superblocks: Information such as file system type, size, state, structure information.

As this information is essential, it is replicated in several locations of the file system.

It can be located according to the block size:
1k –> Block 8193
2k –> Block 16384
4k –> Block 32768

Or by unmounting the file system and running:

mke2fs -n /dev/sdaX
dumpe2fs /dev/sdaX|grep -i superblock

Inodes are used to locate in which physical blocks the files/directories are within the file system, they also store certain information:

  • File type: executable, special block…
  • Permissions
  • Owner
  • Group
  • Size
  • Last access
  • Deletion time
  • Number of links (hard/soft)
  • Extended attributes such as append-only, non-deletable
  • ACLs

NOTE: The name – Inode relationship is in a table, this table has a maximum size.

Each partition has its own inode table, which means that hard links (two files with the same inode) cannot be made between partitions, an example will make it easier to see:

Red represents the sectors occupied by file1 while green represents those occupied by file2.
Inode table:

File Name Inode
File1 Inode1
File2 Inode2

Inode data table:

Inode Sectors/Owner/…
Inode1 1-2
Inode2 3-5

If we want to generate a hard-link in this partition, we would not have any problems since we only need to create an entry in the inode table:
Inode table:

Filename Inode
File1 Inode1
File2 Inode2
File3 Inode2

This way, File2 and 3 are the same file since they occupy the same sectors on the hard disk. The problem arises when there are several partitions and we want to create hard-links between them, as each inode table in each partition is independent, it is impossible.

It is possible to check the inode of a file:

ls -i /etc/passwd
stat /etc/passwd

It is possible that we run out of inodes before running out of space on the HD. This is possible if many small files are created, the inode table will end up full despite having useful space.

If we anticipate that we will generate many files during the OS installation, we can generate the file system with larger tables than usual.
mkfs.ext4
-N number-of-inodes –> Overwrite the number of inodes calculated when the file system is created.
-n –> Perform a simulation of the file system generation, in this way we are able to determine the location of the superblocks in the file system.


TROUBLESHOOTING:

There are no inodes left.
We can choose from several options:

  • If we have other partitions: move files to this one and ln from the original location.
  • Add a hard disk, copy the files and mount the directory on the new partition.
  • Create a loop file system and mount it elsewhere:

Generate the file with the space that our new fictitious partition will have

dd if=/dev/zero of=my_fs bs=1024 count=3072000
losetup /dev/loop0 my_fs
mkfs -t ext4 -m 1 -v /dev/loop0
mount /dev/loop0 /mnt/aux/

The space is loaded into the partition where the my_fs file is located and the inodes to /mnt/aux/, in the partition where my_fs is located, only one inode has been consumed, that of the file itself ;)

  • Delete as many files as we can –> the size is irrelevant, what really counts is the number of files.
  • Make a backup on an external HD.

Formatting with the -N option of mkfs.ext4
We find out how many inodes mkfsext4 will generate: mkfs.ext4 -n /dev/sdXX
We multiply that number by X and indicate how many inodes to generate: mkfs.ext4 -N AA /dev/sdXX

Dumping data

Problems with the file system.

First, we unmount the file system:

umount /DIR

We make a backup just in case:

dd if=/dev/sdaX of=/diskX/backup-sdaX.img

Then we check the file system:

e2fsck -f /dev/sdaX

If the superblock is damaged, e2fsck will not be able to perform the check. As this information is redundant, we can tell it to use the backup superblock, which is located in a different location depending on the block size:
1k –> Block 8193
2k –> Block 16384
4k –> Block 32768

It can also be obtained with:

mke2fs -n /dev/sdaX
dumpe2fs /dev/sdaX|grep -i superblock
e2fsck -f -b {alternative-superblock} /dev/sdaX

Delete files by inode:

There are times when the file has a name with special characters and it is necessary to delete it using inodes (it could also be done by escaping the characters):

We get the inodes:

stat {file-name}
ls -il {file-name}

We delete:

find . -inum [inode-number] -exec rm -i {} ;

If you liked the article, you can treat me to a RedBull here