# Hard link

> Source: Courseiva IT Certification Glossary — https://courseiva.com/glossary/hard-link

## Quick definition

A hard link is like giving the same file a second name without copying the data. Both names point to the exact same file contents, so changes through one name immediately show up through the other. Hard links only work within the same filesystem and cannot link to directories (except in special cases). Deleting one hard link does not delete the file until all hard links to that file are removed.

## Simple meaning

Think of a file on your computer as a house located at a specific address. The address is like the inode (the data structure that stores the file's metadata and points to its data blocks). The name you give the file, like "homework.docx", is like a signpost pointing to that address. A hard link is like putting up another signpost pointing to the exact same house. It's not a copy of the house, just another way to reach it. If you change the paint on the house (edit the file), you see the change whether you walk up the first signpost or the second signpost. Deleting one signpost does not demolish the house because the house still has a signpost pointing to it. Only when the last signpost is removed does the house get demolished (the file's data blocks are freed). 

 In technical terms, every file on a Unix-like system has exactly one inode number that uniquely identifies it. A hard link creates a new directory entry (a new name) that points to that same inode number. This means the file's data, permissions, ownership, timestamps, and all other metadata are shared. Hard links are extremely efficient because they do not duplicate any file data, and they allow you to organize the same file in different directories without wasting storage space. However, hard links have restrictions: they can only be created on the same filesystem (they cannot cross partition boundaries), and they cannot point to directories (to avoid circular references and infinite loops in the filesystem tree). In modern systems, the ln command is used to create hard links, and the link count shown in ls -l indicates how many hard links point to that inode. 

 The beauty of hard links is that they provide a robust form of file access. Even if one of the hard-linked names is accidentally deleted, the file remains accessible through the other name. This is different from shortcuts or symbolic links, which would break if the original target is removed. Hard links are a fundamental concept in filesystem design and are tested in exams like CompTIA A+, Linux+, and RHCSA because they reveal a deep understanding of how data is organized on disk.

## Technical definition

A hard link is a filesystem object that associates a filename with an inode (the metadata structure that stores information about a file, including its location on disk, permissions, timestamps, and ownership). When a file is created, the filesystem allocates an inode and creates a directory entry that maps a user-visible name to that inode. A hard link is simply an additional directory entry that maps a different name to the same inode. Because the inode is shared, all hard links to a given file share the exact same data blocks on the storage device. 

 Inode structures are filesystem-specific but generally store the following: file type (regular file, directory, socket, etc.), permissions (read, write, execute for user, group, others), user and group IDs, timestamps (access, modification, change), size (in bytes), and most importantly, pointers to the data blocks on disk (or extents in more modern filesystems like ext4). The inode also contains a link count field that records how many directory entries (hard links) point to that inode. When a new hard link is created using the ln command (e.g., ln original_file hard_link_name), the operating system increments the link count in the inode by one. When a hard link is deleted using unlink() or rm, the link count is decremented. If the link count reaches zero and no process has the file open, the filesystem deallocates the inode and all its data blocks, freeing that space for reuse. 

 Hard links are limited to the same filesystem because the inode number is only unique within a single filesystem mount point. A directory entry on one filesystem cannot point to an inode on a different filesystem because filesystems are independent volumes with separate inode tables. POSIX standards prohibit hard links to directories (except for the . and .. entries automatically created by the filesystem). This restriction prevents the creation of circular references that would complicate directory traversal algorithms and make garbage collection of unused inodes difficult. 

 In real IT implementations, hard links are used extensively in backup systems (e.g., rsnapshots, Apple Time Machine) to create multiple snapshots of a directory tree without duplicating unchanged data. They are also used by package managers (like rpm's hardlinks) and version control systems (like git) to store multiple versions of files efficiently. The ln command with no -s flag creates hard links; using 'ln -s' creates a symbolic (soft) link, which is a completely different mechanism. On Windows, the 'mklink /H' command creates a hard link in NTFS. Exam objectives for CompTIA Linux+ (XK0-005) specifically include understanding hard links versus symbolic links, and system administration tasks involving hard links appear in RHCSA (Red Hat Certified System Administrator) and LPIC-1 certifications.

## Real-life example

Imagine you own a large library with thousands of books. You have a main catalog card for each book that includes the book's location (which shelf and aisle). This main catalog card is like the inode, it contains all the metadata about the book. The book's title listed on the card is like the original filename. 

 Now, suppose the library decides to create a special "Summer Reading" section. Instead of moving the physical book from its original shelf to the summer section (which would be inconvenient for someone looking for it in the original location), the librarian creates a second catalog card for the exact same book. The second card points to the same shelf and aisle as the original card. So, tracking down the book using either the "original" card or the "Summer Reading" card leads you to the same physical copy. This is exactly what a hard link does, it creates another directory entry pointing to the same inode. 

 If a patron borrows and returns the book, any changes (like a bookmark or a note) are reflected for anyone accessing the book via either card. That's because there is only one physical book. Deleting the "Summer Reading" card does not discard the book; it only removes that secondary pointer. The book remains available through the original card. If later the original card is also removed, and there are no other cards pointing to that book, then the book is removed from the library's collection. 

 This analogy maps directly to the IT concept: the books are data blocks, the shelf location is the inode number, the physical catalog cards are directory entries (hard links), and removing all cards deletes the file. Hard links allow you to have multiple names for the same file without wasting storage space, just as multiple catalog cards don't require multiple copies of the same book.

## Why it matters

Hard links matter in IT because they enable efficient data management, backup strategies, and robust file organization without consuming additional disk space. In system administration, hard links allow you to place the same file in multiple directories so that each user or service has access to it in their own logical location, while the underlying data remains a single instance. This is critical in environments where storage is costly or limited. 

 For example, consider a configuration file like /etc/passwd that must be accessible from different contexts. Hard links allow the system to maintain a single authoritative version. Hard links also form the backbone of incremental backup systems like rsync with the --link-dest option, which creates hard links to unchanged files from previous backups. Each backup appears as a full snapshot, but unchanged files are not duplicated, they are hard links to the same inodes. This dramatically reduces storage usage while preserving the illusion of independent backups. 

 Hard links also improve data reliability. If a user accidentally deletes a file that has a hard link elsewhere, the data is safe because the other hard link keeps the inode alive. This is a common technique to protect critical files from accidental deletion. Understanding hard links is essential for comprehending how Unix permissions work, because all hard links share the same permissions and ownership. Changing permissions on one hard link changes them for all. 

 In the context of IT certifications, hard links test your understanding of filesystem internals. They are often used to distinguish between a hard link and a symbolic link, and to evaluate your knowledge of inodes and directory entries. Misunderstanding hard links can lead to data loss in production environments, making this concept both practically important and exam relevant.

## Why it matters in exams

Hard links are a core topic in several IT certification exams. In CompTIA Linux+ (XK0-005), the exam objectives explicitly require understanding the difference between hard and symbolic links, creating and removing links, and explaining how link counts work. Exam questions may present a scenario where a file's link count is shown, and you need to determine how many names point to the same inode, or predict what happens when you delete one of the names. 

 For the Red Hat Certified System Administrator (RHCSA) exam (EX200), you are expected to be able to create hard links using the ln command, list file with link counts using ls -l, and understand the implications of hard links for backup and recovery. The exam may also test your understanding of the i_nlink field from the stat command output. In the CompTIA A+ (Core 2) exam, hard links appear in a lighter context, usually as part of filesystem fundamentals, where you need to distinguish between different types of links (shortcuts in Windows, aliases in macOS, hard and soft links in Linux). 

 In Linux Professional Institute (LPIC-1) exams (101-500), hard links are covered under topic 104.5: manage file permissions and ownership. You must know how to use ln without options, how link counts change, and how to identify hard links using ls -i to show inode numbers. For the CompTIA Server+ (SK0-005) exam, hard links are relevant in storage management and backup scenarios, where they can be discussed in the context of snapshot technologies. 

 The most common exam question patterns include: given an ls -l output, identify which file is a hard link (look at identical inode numbers and link count), differentiate between removing a hard link and removing the original file, and explain why hard links cannot span filesystems. Some questions might ask you to calculate the link count after creating or deleting a hard link. A common trap is that learners confuse hard links with shortcuts or copies. Examiners deliberately include scenarios where two filenames have the same size and content but different inode numbers (which are separate copies), versus same inode numbers (which are hard links). Understanding the inode number is the key to answering correctly.

## How it appears in exam questions

Hard link questions typically fall into three patterns: conceptual, command-based, and troubleshooting. In conceptual questions, you might be asked: "Which of the following statements about hard links is true?" with options like "They can span filesystems," "They create a copy of the data," or "They share the same inode." The correct answer is that they share the same inode. 

 Command-based questions often present an ls -li output showing inode numbers and ask you to identify which files are hard links to each other. For example, you see: 
 123456 -rw-r--r-- 2 root root 100 file1 
 123456 -rw-r--r-- 2 root root 100 file2 
 789012 -rw-r--r-- 1 root root 100 file3 
 The question might ask: "Which files are hard linked?" The answer is file1 and file2 because they have identical inode numbers (123456). The link count of 2 also confirms that two names point to that inode. Another variation asks: "If you delete file1, what happens to the data?" The answer is that the data remains accessible through file2 because the link count goes from 2 to 1, not zero. 

 Troubleshooting scenarios might involve a user who complains that modifying a configuration file changes another file unexpectedly. You need to recognize that both files are hard links to the same inode. Or a disk usage report shows more space used than expected, but the admin overlooked that hard links share data, so the actual consumption is less than the sum of file sizes. A typical exam trap: "You create a hard link to a file and then delete the original. The link becomes broken." This is false because hard links are independent, deleting the original name only decrements the link count; the other name still points to the same data. 

 The 'ln' command syntax is also tested: ln target link_name (hard link) vs. ln -s target link_name (symbolic link). You might be asked to choose the correct command to create a hard link, or to interpret the output of 'stat' and identify the link count. In Linux+ exams, you may be given a scenario where you need to recover a file that has been accidentally deleted but still has other hard links, the solution is simply to rename a remaining hard link or copy it back.

## Example scenario

You are a junior system administrator for a company that runs a Linux web server. The server houses the company's website files in /var/www/html. One day, your senior admin tells you that they want to keep a backup of the main configuration file, /etc/nginx/nginx.conf, in a different directory, /root/backup_configs/, for easy recovery. However, they don't want to maintain two separate copies because changes often need to be applied to the live configuration. 

 You remember the concept of hard links. Instead of copying the file, you run: ln /etc/nginx/nginx.conf /root/backup_configs/nginx.conf. Now, both /etc/nginx/nginx.conf and /root/backup_configs/nginx.conf point to the same inode (same data blocks). When you edit either file, the changes are instantly reflected in the other because they are the same file. The link count for that inode becomes 2. 

 Later, your senior admin accidentally runs rm /etc/nginx/nginx.conf. Panic sets in for a moment, but you realize the file is still accessible through /root/backup_configs/nginx.conf because the link count drops to 1 but not zero. You copy that file back to the original location using cp /root/backup_configs/nginx.conf /etc/nginx/nginx.conf. However, this creates a new file (new inode), that's fine for recovery. If you wanted to restore the hard link precisely, you would simply create another hard link. But the copy works because the content is identical. 

 This scenario shows how hard links provide redundancy and convenience. It also reveals a nuance: copying a hard link creates a new, separate file with a different inode. If you wanted to restore the exact original setup (hard links), you would need to create another hard link, not a copy. Understanding this distinction is critical in exams and in production environments.

## Common mistakes

- **Mistake:** Thinking that deleting the 'original' file will break the hard link.
  - Why it is wrong: Hard links all point to the same inode; there is no 'original' distinction. The data remains accessible through any remaining hard link. Only when all hard links are removed does the data get freed.
  - Fix: Understand that every hard link is just a name for the same data. Deleting one name merely reduces the link count. The data persists if there is at least one name left.
- **Mistake:** Confusing hard links with copies of the file.
  - Why it is wrong: A copy creates a new inode and new data blocks, consuming additional disk space. A hard link does not duplicate data, it just adds another directory entry pointing to the same inode.
  - Fix: Check the inode numbers with ls -i. If two files have the same inode number, they are hard links; if different, they are separate copies. Also, a copy takes up double the disk space.
- **Mistake:** Believing hard links can be created across different filesystems or partitions.
  - Why it is wrong: Inode numbers are specific to a filesystem. A directory entry on one filesystem cannot reference an inode on another filesystem. Hard links are restricted to the same filesystem.
  - Fix: Always use the same partition or mount point when creating a hard link. If you need to link across filesystems, use a symbolic link (ln -s) or copy the file.
- **Mistake:** Assuming hard links can be created to directories (except for . and ..).
  - Why it is wrong: Filesystem standards (POSIX) prohibit hard links to directories to prevent loops and infinite recursion. The only exceptions are the dot (.) and dot-dot (..) entries automatically created inside each directory.
  - Fix: You cannot use ln to create a hard link to a directory. If you need a directory alias, use a symbolic link or bind mount.
- **Mistake:** Thinking that changing permissions or ownership on one hard link does not affect the others.
  - Why it is wrong: Since all hard links share the same inode, attributes like permissions, ownership, and timestamps are shared. Changing them through one link changes them for all.
  - Fix: Treat any modification to a file (permissions, content) as affecting all hard links to that inode. To have independent attributes, use separate copies instead.

## Exam trap

{"trap":"The exam shows two files with identical sizes and content but different inode numbers. The question asks if they are hard links. A common trick is that the files look the same, but they are actually separate copies.","why_learners_choose_it":"Learners often assume that if two files have the same size and content, they must be hard linked. They focus on superficial similarities rather than the core identifier, the inode number.","how_to_avoid_it":"Always look at the inode number from ls -i output. Two files are hard links ONLY if they share the same inode number. Same content does not imply hard link, because two separate files can have identical data. Also, check the link count: a file with link count > 1 has other hard links, but you still need to compare inode numbers."}

## Commonly confused with

- **Hard link vs Symbolic link (soft link):** A symbolic link is a special file that contains a path to the target file. It is independent of the target's inode. If the target is moved or deleted, the symbolic link becomes broken. In contrast, a hard link shares the same inode, so deleting the original name does not affect the hard link. (Example: ln -s /original/file symlink -> symlink points to /original/file; if /original/file is deleted, symlink returns 'No such file or directory'. Hard link (ln /original/file hardlink) remains valid because it points to the same inode.)
- **Hard link vs Shortcut (Windows):** A Windows shortcut is a small file (with .lnk extension) that stores a path to the target. It is similar to a symbolic link but is interpreted by the shell. It does not share the same inode or data. A hard link in NTFS (created with mklink /H) actually shares the same file record (MFT entry), so changes are reflected across all hard links. (Example: In Windows, right-click 'Create shortcut' creates a .lnk file, which is just a link to a path. Deleting the original file leaves the shortcut broken. A hard link (mklink /H) creates a name that points to the same data record, so the data persists as long as any hard link exists.)
- **Hard link vs File copy:** A file copy duplicates the data to a new inode, consuming additional storage space. Each file has its own metadata and data blocks. Hard links do not duplicate data; they simply add another name to the existing inode. (Example: cp file1 file2 creates two separate files with different inode numbers. Editing file2 does not affect file1. But creating a hard link (ln file1 file2) means both names share the same inode, editing one changes the other.)

## Step-by-step breakdown

1. **File creation** — When you create a new file using touch, echo, or a text editor, the operating system allocates a new inode from the filesystem's inode table. This inode is assigned a unique number and contains metadata like permissions, timestamps, and pointers to data blocks. A directory entry is created linking the filename to this inode.
2. **Checking inode and link count** — Using the ls -li command, you can see the inode number (first column) and the link count (third column). Initially, a regular file has a link count of 1 because one directory entry points to it. The link count tells you how many names are associated with that inode. ls -l shows the link count without the inode number.
3. **Creating a hard link** — The command ln target link_name creates a new directory entry that points to the same inode as target. The filesystem increments the link count in the inode by 1. Now the inode has two directory entries. Both names can be used to access the same data, and altering the file through either name changes the content for both.
4. **Observing the change after creating a hard link** — Run ls -li again. You will see two lines with the same inode number. The link count for that inode will be 2 (or higher if more links exist). The file size, permissions, and all metadata remain identical because they belong to the shared inode.
5. **Deleting one hard link** — When you use rm or unlink() on one of the names, the operating system removes the directory entry and decrements the link count. If the link count is still greater than 0, the inode and its data blocks remain intact. The data is still accessible through any other remaining hard links.
6. **Final deletion when link count reaches zero** — When the last hard link (directory entry) is removed, the link count becomes zero. The operating system then marks the inode as free and deallocates all data blocks belonging to that file. This space can later be reused for new files. No file recovery is possible without specialized tools.

## Practical mini-lesson

Hard links are a fundamental filesystem feature that every IT professional should understand deeply. When you work on Linux systems, you will frequently encounter hard links in log management, backup scripts, and system configuration. The most common tool for creating and managing hard links is the ln command. Without any options, ln creates a hard link. For example, 'ln fileA fileB' makes fileB a hard link to fileA. You can also create hard links in different directories: 'ln /path/to/file /another/path/linkname'. 

 It is critical to know that hard links are indistinguishable from the original filename. There is no 'master' or 'original', the inode and its link count are the only indicators. To identify hard links, use 'ls -i' to see inode numbers, or 'stat' to examine a file's metadata in detail. The 'stat' command output includes the 'Links' field that shows the number of hard links. For example, 'stat myfile.txt' might show 'Links: 2', meaning there are two directory entries for that inode. 

 One practical application is using hard links for backup rotation. Many systems, including rsync with the --link-dest option, create hard links to files that have not changed between backups. Each backup directory appears as a full copy, but unchanged files are hard links to the previous backup's inodes, saving massive disk space. As a sysadmin, you can manually create a backup with hard links: 'cp -al /source /backup' creates a directory structure where all files are hard links to the source. 

 A common gotcha: you cannot hard link across filesystems. If you try to create a hard link between two different mount points, you will get an 'Invalid cross-device link' error. Use symbolic links or copy the file instead. Also, remember that hard links to directories are forbidden, the only exceptions are the hidden . and .. entries created by the filesystem. 

 Permissions and ownership are shared across all hard links. If you change the permissions of one hard link, all others reflect that change. This can be dangerous if you unintentionally expose sensitive data via a hard link in a world-readable directory. Always check the permissions of the inode using 'stat' before creating hard links in production. 

 Troubleshooting: if a user complains that modifying a file in one location changes the same file elsewhere, it is likely a hard link. Use 'ls -i' to confirm. If you need to separate the files (make them independent), you must copy the file to a new location and then delete the original link. A simple 'cp' followed by 'rm' of the original name will achieve this, but be aware that you are now using extra disk space.

## Memory tip

Hard link = same inode number. If two names share the same inode number, they're hard linked. "Same number, same data, no copy."

## FAQ

**Can I create a hard link to a directory?**

Standard Unix/Linux filesystems do not allow creating hard links to directories (except for the special . and .. entries inside each directory). This restriction is in place to prevent circular references and loops in the directory tree.

**What happens to a hard link if the original file is deleted?**

The hard link remains valid because all hard links are equal, there is no 'original' file. Deleting one name just decreases the link count. The file data stays accessible through any remaining hard link.

**How can I see all hard links to a file?**

Use the 'find' command with the -samefile option, e.g., 'find / -samefile myfile.txt'. This searches the entire filesystem for directory entries that point to the same inode. Alternatively, use 'ls -li' and note the inode number, then search for that inode.

**Do hard links consume extra disk space?**

Hard links consume almost no additional disk space because they are just directory entries (a few bytes). The data blocks are shared, so no extra space is used for the file content. The only overhead is the directory entry itself.

**Can I create a hard link across two different partitions?**

No. Hard links are restricted to the same filesystem (partition) because inode numbers are unique only within a single filesystem. To link across partitions, use symbolic links (ln -s) or copy the file.

**Does changing permissions on one hard link affect the other hard links?**

Yes. Since all hard links share the same inode, permissions, ownership, and timestamps are shared. Changing permissions through any hard link changes them for all hard links to that inode.

## Summary

A hard link is a directory entry that associates a filename with an existing inode, allowing multiple names to refer to the same file data without duplication. Unlike a copy, a hard link does not consume additional storage for the file's content because it shares the inode and data blocks. Hard links are limited to the same filesystem and cannot be created for directories (except system entries). Understanding hard links is essential for system administration tasks such as backup management, file organization, and troubleshooting. 

 In certification exams, particularly CompTIA Linux+, RHCSA, and LPIC-1, hard links are tested through conceptual questions about inode sharing, command-line usage (ln, ls -i, stat), and interpreting link counts. Common exam traps include confusing hard links with symbolic links or copies, and assuming that deleting the 'original' name breaks the hard link. The key to mastering hard links is to remember that they are all equal, they all point to the same inode, and the data persists as long as at least one hard link remains. 

 Practically, hard links enable efficient storage utilization and robust data protection. In production environments, they are widely used in backup strategies and snapshot systems. Therefore, a solid grasp of hard links not only helps you pass certification exams but also makes you a more effective IT professional. Always check the inode number and link count to diagnose link relationships, and remember that hard links cannot cross filesystem boundaries.

---

Practice questions and the full interactive page: https://courseiva.com/glossary/hard-link