Identifying Block Devices and Partitions

1. What Are Block Devices?

In Linux, the "everything is a file" philosophy extends to hardware. Your hard drives, SSDs, and USB sticks are represented as special files located in the /dev directory. These are called block devices because the system reads from and writes to them in fixed-size blocks of data.

Common examples include:

• /dev/sda: Often the first SATA, SCSI, or USB drive.
• /dev/sdb: The second such drive.
• /dev/nvme0n1: The first NVMe SSD.

We don't typically interact with these device files directly. Instead, we use specialized tools to manage them, and today we'll learn the two most important ones for listing what's available.

2. The Modern View: lsblk

The lsblk (list block devices) command is the go-to tool for a quick and readable overview of your storage devices. Its output is clean and organized in a tree structure, making it easy to see which partitions belong to which disks.

Let's start by watching a video that introduces lsblk and explains its output.

As the video explained, the base name like sdb refers to the entire physical disk, while the numbered name like sdb1 refers to a specific partition on that disk.

Now, let's examine a typical lsblk output more closely.

Hands-On Practice with lsblk

Open your terminal and try these commands:

1. Basic Listing: Run lsblk by itself.

   lsblk
   

   Identify your main system drive. If you're in a VM, it might be named vda or sda. If you're on a machine with an NVMe SSD, you'll see something like nvme0n1.

2. Add Filesystem Info: The -f flag adds information about the filesystem, including its type (FSTYPE), unique identifier (UUID), and label. This is extremely useful for seeing what's on each partition.

   lsblk -f
   

   Notice how this connects what we see here (the block device) with what we saw in the last lesson with df -T (the filesystem type). You can now see which device holds your ext4 or btrfs root filesystem.

3. The Classic View: fdisk -l

While lsblk is great for a quick look, the fdisk command is a classic, powerful tool for partition management. We will focus only on its ability to list partitions using the -l flag. fdisk often provides more low-level detail than lsblk, and because it can modify the disk, it requires root privileges.

The output of fdisk -l is more verbose. To understand it better, let's look at an example and break it down.

Key information you get from fdisk -l that isn't immediately obvious in lsblk includes:

• Disklabel type: This tells you the partition scheme, which is typically gpt (GUID Partition Table, modern) or dos (also known as MBR, Master Boot Record, older). This is crucial information in some advanced scenarios.
• Sector information: Shows the start and end sectors for each partition.

Hands-On Practice with fdisk

Time to try it yourself.

1. List all partitions:

   sudo fdisk -l
   

   Compare the output to what you saw with lsblk. You're seeing the same devices, just presented differently.

2. Query a specific disk: You can also run it on a single device to reduce the output.

   
   
   
   # Replace /dev/sda with the name of a disk on your system
   sudo fdisk -l /dev/sda
   

4. Practical Application: Enumeration

Now, let's put this into the context of your goal. You've just gained a foothold on a target system. What do you do? You enumerate. Running lsblk -f and sudo fdisk -l are among the first commands you should execute. They help you answer key questions:

• How many disks are attached? Are there any that look non-standard?
• Are there any unmounted partitions (lsblk output with an empty MOUNTPOINTS column)? These are prime targets for investigation as they might contain hidden data or backups.
• What filesystem types are in use? This informs what tools you might need to interact with them.
• What partition scheme is used (gpt or dos)? This gives you clues about the age and configuration of the system.

Here's a final practical tip that is invaluable for both system administration and penetration testing.

This "before and after" technique is simple, effective, and eliminates guesswork when you need to operate on a specific removable disk.

Conclusion

You have now learned how to map out the foundational storage layer of a Linux system. While lsblk and fdisk -l show similar information, they present it differently and serve slightly different purposes.

Key Takeaways:

• Storage devices are represented as block devices in the /dev directory.
• lsblk is the modern tool for a quick, tree-view overview of disks and partitions. The -f flag adds valuable filesystem context.
• sudo fdisk -l is the classic tool that provides a detailed, verbose list, including low-level information like the partition table type (GPT/MBR).
• Device Naming: Get familiar with sdX for SATA/USB drives and nvmeXnY for NVMe drives. A number at the end (e.g., sda1) indicates a partition.
• These commands are essential for initial system enumeration in a security context to understand the system's layout and find potential areas of interest.

Next Lesson Preview:
We've seen how to list existing partitions. But what exactly is a partition, and why do we need them? In the next lesson, we will dive into basic disk partitioning concepts to understand how a raw disk is divided up to become usable.