Everything Important You Need to Know About Hard Link in Linux

Before you see hard links, I advise you to learn about inodes in Linux. A Linux filesystem has two main components: a pool of data blocks where data is stored and a database system to manage this data pool. The inode is like index to this database system.

What is hard link in Linux?

A hard link to a file points to the inode of the file instead of pointing to the file itself. This way the hard link gets all the attributes of the original file and points to the same data block as the original file.

If you remember the symbolic link or the soft link, you know that it points to the file. A hard link is a manually created entry in a directory that points to an already existing inode.

I am going to explain it to you with proper diagrams. Let’s take this directory structure for example:

So basically, root directory contains dir_1 and dir_2 directories. The dir_1 directory has file_1 and file_2 files whereas dir_2 contains file_3 and a hard link to the file 2.

Let’s see how things look like in the filesystem. Everything is representational. In reality, the root directory will have thousands of files. Here, we assume it to have only two directories.

Remember the Linux directory structure? You start with the root (/). The root directory always has inode 2.

If you have to access the file 3, the absolute path would be /dir_2/file_3. In here, you can read it like this: you start at inode 2 (root always inode 2) and follow the arrow to its data block. This data block has the information about the inode of the dir_2 (inode 27 in our example).

Now you look into inode 27. Its type is directory. You follow to its data block that has information about the inode of file_3 (inode 88). You look into the inode 88. Its type is file and if you follow to its data block, you access the content of the file.

Did you notice that the directory itself doesn’t content its file’s data? Directories are essentially a file that contain the information about the inodes of their files and subdirectories.

You must be wondering about the link count thing in the above image. That’s super important specially when you are dealing with hard link. The link count is the number of directory entries that point to an inode. Take inode 27 for dir_2 for example. The inode 27 is once in the data block of the root directory and once in its own data block (the special directory .). And hence it has link count of 2.

Notice that all the files have link count 1 except file_2? If a file has link count more than 1, it means there are hard links ‘to this file’. Since hard links point to the same inode (inode 17 in our example) as the target file, you get 2 directory listings for inode 17 (in data block of dir_1 and dir_2).

How to create hard links in Linux

You can use the ln command in order to create a hard link:

ln target_file link_name

This will create a hard link named link_name to the target_file. You’ll see that link_name looks like a regular file and its attributes are the same as the target file.

If you use the ls -li command (the -i option shows the inode number), you’ll see that its link count is 2. The link count is after the file permission field.

134195 -rw-r--r-- 2 abhishek abhishek        0 Jul 17 19:49  target_file
134195 -rw-r--r-- 2 abhishek abhishek        0 Jul 17 19:49  link_target_file

Both have the same inode number 134195, obviously.

Things to keep in mind about hard links

Now that you have a good idea about hard links in Linux let’s take things a bit further.

Deleting the target file won’t delete its data anymore if it has hard link

If you delete the target file, you can still access its content through the hard link. It’s because both target file and hard link has the same inode and thus they point to the same data block.

Deleting files in Linux is basically unlinking. Suppose you delete the file_1 using rm command. The Linux kernel will find that file_1 corresponds to inode 16. It will remove file_1 entry from dir_1’s listing and reduce the inode 16’s link count by 1. Now that inode 16’s link count is 0, the kernel knows that there are no one linking to this inode so it is safe to remove the inode and delete the data block associated with it.

Now say you delete file_2. Kernel will remove the file_2 from dir_1’s listing and will go to inode 17. It will reduce the link count of inode 17 bringing it down to 1. Since the link count is not zero, the kernel will not delete the inode or the data associated with it. And hence, if you access the hard link, you can still access the data even though the original file has been deleted.

You should not create a hard link to a directory

You can create a soft link to a directory but when you try to create a hard link to a directory, you’ll see an error like this:

ln: newdir/test_dir: hard link not allowed for directory

Why are hard links not allowed for directory? It’s because using hard links for directory may break the filesystem. Theoretically, you can create hard link to directories using -d or -F option. But most Linux distributions won’t allow that even if you are root user.

It’s nearly impossible to distinguish between the hard links and the original file

Let’s have another look at the hard link I created earlier:

134195 -rw-r--r-- 2 abhishek abhishek        0 Jul 17 19:49  target_file
134195 -rw-r--r-- 2 abhishek abhishek        0 Jul 17 19:49  link_target_file

They have identical attributes but you can guess which is the link based on the name in the above example but what if the name wasn’t obvious? How would you know if their names were target_1 and target_2?

If the file and link(s) are in a different directory, you may try checking the mtime and other parameters to know when the content of the directory was changed but even that is not a certainty. If the file and hard link is in the same directory and the history has been wiped out, I am not sure how can you figure out which is the original file and which is the hard link.

Bonus Tip: How to find all hard links to a given file

If you see that a file has more than one link count, you may get curious about the other hard links associated with it.

One way to find that is using the inode number of the file. You can use the ls -i command or the stat command to get the inode number.

Once you have the inode number, you can see all the links associated with it using the find command.

find . -inum inode_number

Was it hard to understand the hard links?

I hope it wasn’t too ‘hard’ and you have a better understanding of the concept of hard link in Linux. If you have doubts or suggestions on this topic, please leave a comment below.