The Hidden Connections
In the Ubuntu Linux file system, a “hard link” acts as a direct, physical pointer to the exact same data blocks on a hard drive. Unlike a standard shortcut (a symlink), if you delete the original file, the data remains perfectly intact and accessible through the hard link. This is heavily used by backup utilities (like rsync or TimeShift) to save space. However, if you are trying to permanently erase a sensitive file, simply deleting it won’t work if multiple hard links are pointing to it. You must find and destroy every single link. To do this, you must instruct the Linux search engine to filter files based on how many hard links are currently attached to them.
Using the find Command with -links
The Linux find command utilizes the highly specific -links flag to isolate files based on their hard link count.
- Open your Terminal application (Ctrl + Alt + T) or log into your server via SSH.
- To scan your entire home directory and explicitly return only files that have exactly 2 hard links pointing to them, type the following command exactly:
find /home/user/ -type f -links 2- Press Enter.
Finding Heavily Linked Files
You can use the plus (+) or minus (-) modifiers to search for ranges. For example, running find / -type f -links +5 will scan the entire server and output a list of any file that has more than five hard links attached to it. This is a critical auditing tool for discovering exactly how backup software is structuring your data, or for ensuring that a highly sensitive configuration file hasn’t been secretly hard-linked to a hidden directory by a malicious actor.