How do hard links and symbolic links differ?

A strong answer

A strong candidate frames How do hard links and symbolic links differ? around the exact memory layout, compiler semantics, and hardware execution model covered in Directory Streams, Hard Links, and Symlinks. Explain hard links as additional directory entries to the same inode versus symlinks as separate files containing a path string.

To users, files appear to live inside folders: /var/log/syslog looks like a file placed physically inside a directory container.

1. The Phantom Disk Exhaustion: A server disk alert triggers: /var is at 100% capacity due to a runaway 100 GB app.log file. An operator runs rm /var/log/app.log. The command succeeds, and ls confirms the file is gone. Yet df -h still reports that /var is 100% full. The 100 GB was never reclaimed. Why? Because the logging process is still running with the file open.
2. The Symlink Target Deletion: A developer creates a symbolic link config.json -> live.json. Later, they run rm live.json. The symlink config.json remains visible in the directory, but attempting to open it produces ENOENT (No such file or directory). Meanwhile, a hard link to live.json created beforehand continues to read the original contents without error.

In a production interview, always connect the specification rule to its concrete runtime consequence: state what lives on the stack versus the heap or static storage segment, how the compiler or operating system validates alignments, lifetimes, and error codes, and what happens under adversarial or boundary inputs (such as zero-length buffers, integer overflow, concurrent mutation, or partial I/O). Backing your explanation with a small trace of register/memory state transitions immediately separates senior systems engineers from candidates who only memorized syntax.

What the interviewer is listening for

• Mastery of core invariant: Traverse directory streams sequentially using opendir, readdir, and closedir.
• Mastery of core invariant: Differentiate hard links sharing an inode from symbolic links storing target path strings.
• Mastery of core invariant: Explain deferred file deallocation when unlinking files held open by running processes.
• Hardware and ABI awareness: Explaining how sizes, alignments, calling conventions, or kernel boundaries behave on real 64-bit targets rather than relying on implementation-defined assumptions.
• Defensive engineering: Naming the exact compiler flags (-Wall -Wextra -Werror), static analyzers, or runtime sanitizers (-fsanitize=address,undefined,thread) that verify correctness in CI.

Common mistakes

• Explaining only surface syntax without tracing the underlying memory addresses, ownership lifetime, or kernel/user-space state transitions.
• Assuming undefined behavior (such as signed overflow, uninitialized reads, strict-aliasing violations, or dangling pointers) will "just work" because it passed an unoptimized -O0 debug build.
• Ignoring return codes, partial reads/writes, alignment padding, or cleanup paths when an allocation or syscall fails midway through a function.