Manual Filesystem Mounting and Unmounting

1. The Core Concept: What is Mounting?

In the last lesson, we established that a partition is a self-contained section of a disk with its own filesystem (like ext4, NTFS, etc.). However, after you partition and format a drive, the Linux operating system doesn't automatically know how to access the files on it.

Mounting is the process of attaching the filesystem on a storage device (like a partition) to a specific directory in your main Linux filesystem tree. This directory is called a mount point.

Think of it this way:

• The Device: A USB drive you've just plugged in. It has its own files and folders stored on it.
• The Mount Point: An empty folder on your desktop, for example, /home/user/Desktop/my_usb.
• The mount command: The action of telling the OS, "Make the contents of this USB drive appear inside the my_usb folder."

Once mounted, anything you do inside /home/user/Desktop/my_usb—like reading, writing, or deleting files—is actually happening on the USB drive itself.

To get a clear overview of this concept, let's start with a short video.

Where to Mount?

You can technically mount a filesystem on any existing directory. However, convention dictates:

• /mnt: This directory is the traditional place for temporarily, manually mounting filesystems. It's good practice to create subdirectories here, like /mnt/data or /mnt/backup.
• /media: This is where modern desktop environments typically auto-mount removable media like USB drives and SD cards, often in a user-specific folder like /media/your_user/USB_STICK.

For our manual exercises, we will follow best practice and use the /mnt directory.

2. The Mounting Workflow: A Step-by-Step Guide

The process of manually mounting a filesystem involves three main steps: identifying the device, creating a mount point, and executing the mount command.

Let's walk through it.

Step 1: Identify the Device to Mount

First, you need to know the name of the partition you want to mount. As we covered before, the lsblk command is perfect for this.

lsblk

This will list your block devices. Look for the target disk (e.g., sdb, sdc) and the specific partition on it you want to access (e.g., sdb1). This will be your device.

Step 2: Create a Mount Point

Next, you need an empty directory to serve as the mount point. Let's create one inside /mnt. Since /mnt is owned by root, you'll need sudo.

sudo mkdir /mnt/my_device

This is your mount point.

Step 3: Mount the Filesystem

Now, use the mount command with sudo privileges. The basic syntax is mount [DEVICE] [MOUNT_POINT].

sudo mount /dev/sdb1 /mnt/my_device

Step 4: Verify the Mount

How do you know it worked?

1. List the contents of the mount point. You should see the files from your device.

   ls /mnt/my_device
   

2. Use the findmnt command (or mount with no arguments) to see a list of all currently mounted filesystems. Your new mount should appear at the end of the list.

   findmnt
   
   
   
   # Or to check a specific mount point:
   findmnt /mnt/my_device
   

Let's watch a full demonstration of this workflow.

3. Unmounting and Troubleshooting

When you're finished with a device, you must unmount it before physically disconnecting it. This ensures all pending data writes are completed, preventing data corruption.

The command is umount (note the missing "n"). You can specify either the device or the mount point. Both of the following commands achieve the same result:

sudo umount /dev/sdb1

or

sudo umount /mnt/my_device

After unmounting, the /mnt/my_device directory will be empty again, and it is safe to remove the physical device.

Troubleshooting: "Target is busy"

The most common error you'll encounter is umount: /mnt/my_device: target is busy. This means some process is still "using" the mounted filesystem. The two most frequent causes are:

1. Your shell's current working directory is inside the mount point (e.g., you ran cd /mnt/my_device).
2. A program has a file open on that filesystem.

The fix for the first case is simple: cd out of the directory.

cd ~ # Go to your home directory
sudo umount /mnt/my_device

For the second case, you need to find and stop the process holding the filesystem open. The lsof (List Open Files) command is the tool for this job.

lsof /mnt/my_device

This will show you which commands and processes have files open on that mount. You can then close the program or, if necessary, terminate the process using its PID.

This troubleshooting scenario is so common that seeing it handled in a real situation is incredibly valuable.

4. Mounting with Options: Enhancing Security

The mount command can be given options using the -o flag to change its behavior. From a security perspective, a few are particularly important.

• -o ro: Mounts the filesystem as read-only. This is essential when analyzing a potentially compromised or malicious disk image to prevent any accidental changes to the evidence.
• -o noexec: Prevents the execution of any binary files from the mounted filesystem. This is another critical security measure to stop you from accidentally running malware present on the device you're analyzing.

You can combine options with a comma:

sudo mount -o ro,noexec /dev/sdb1 /mnt/analysis_drive

This command mounts /dev/sdb1 in a safe, "look but don't touch (or run)" mode, perfect for forensic and security analysis. The BlueMonkey 4n6 video demonstrates this well from 07:55 to 08:54 in the segment on mounting the third partition.

Hands-On Practice

Let's put this all together. Open your terminal. You don't need an actual USB drive for this; just write out the commands you would use to perform the following security analysis task.

Scenario: You have been given a USB drive from a suspicious source. Your system identifies it as /dev/sdc1. You need to inspect its contents safely.

Write down the sequence of commands to:

1. Create a directory named evidence inside /mnt.
2. Mount the device /dev/sdc1 to /mnt/evidence in read-only mode, and also prevent any programs on it from being executed.
3. Verify that the device is mounted at the correct location with the correct options.
4. Unmount the device using its mount point.
5. Remove the evidence directory you created.

Take a few minutes to write down your answers before moving on. This will solidify the workflow in your mind.

Conclusion

You now have the practical skills to manually control how storage devices are integrated into your Linux system. This is a fundamental building block for both advanced system administration and security work.

Key Takeaways:

• Mounting is the act of attaching a device's filesystem to a directory (the mount point).
• The standard workflow is: lsblk to identify, mkdir to create a mount point, and mount to attach.
• umount is used to safely detach a filesystem before removing the physical device.
• The "target is busy" error is usually caused by an open file or an active shell in the mount directory and can be diagnosed with lsof.
• Security-focused mounting uses options like -o ro (read-only) and -o noexec (no execution) to safely analyze potentially untrusted filesystems.

Next Lesson Preview:
Manually mounting is great for temporary access, but what about disks that should always be available when the system boots, like a separate /home or a data drive? In our next lesson, we will explore this by learning to explain the role of /etc/fstab and interpret its entries for automatic mounting at boot.