The Cloning Problem
In Ubuntu Linux, a “hard link” occurs when two completely different file names in two completely different directories point to the exact same physical block of data on the hard drive. Unlike a symlink (shortcut), a hard link is a direct, equal clone. If you edit the data using the first file name, the second file name instantly reflects the changes because they share the same underlying inode. If you discover a suspicious or massive file on your server and you want to completely delete it, you must ensure no other hard links exist. If a secondary hard link survives, the physical data is never actually erased from the disk. You must find all identical physical clones.
Using the find Command with -samefile
The Linux find command utilizes the highly specific -samefile flag to locate every single file on the system that points to the exact same physical inode as your target file.
- Open your Terminal application (Ctrl + Alt + T) or log into your server via SSH.
- To scan the entire server to see if
/home/user/target.txthas any hidden clones, type the following command exactly: sudo find / -samefile /home/user/target.txt- Press Enter and provide your administrator password.
Absolute Eradication
The command will output the absolute path of every hard link. By definition, the original target file will always appear in the list (because it is identical to itself). If the command outputs two, three, or four different file paths, it means you have multiple hard links. To truly destroy the physical data on the hard drive, you must run the rm command on every single file path listed in the output.