Filesystem
View
fdisk -l
lsblk -o NAME,SIZE,FSTYPE,TYPE,MOUNTPOINT
lsblk -f
findmnt
mount | column -t
View attrubutes
blkid /dev/sda(1)
Tell the Linux kernel about the presence and numbering of on-disk partitions, update the specified partitions
partx -u /dev/sda
Inform the OS of partition table changes
partprobe
Re-scan disk
find /sys -iname 'scan'
echo 1>/sys/class/block/sda/device/rescan
- SCSI
echo "- - -" > /sys/class/scsi_host/hostX/scan
Copy Hard Drive
sfdisk -d /dev/sda | sfdisk /dev/sdb
Partition synchronization
rsync -avzr /var/log/ /mnt/
What kind of process working with partition
lsof | grep '/var/log'
Show information of dick
hdparm -I /dev/sda
Show inodes
df -i
Make emty files with size
dd if=/dev/zero of=output.dat bs=24M count=1
dd if=/dev/zero of=output.dat bs=1M count=24
truncate -s 10M file.txt
fallocate -l $((10*1024*1024)) file.txt
head -c 10MB /dev/urandom > file.txt
Show physical location of file
filefrag -b512 -v <file>
File system debugger
debugfs <device path>
Show size of directories
du --max-depth=1 -h directory_name
Show total and top
du -chx | sort -h | tail
du -ckx | sort -n | tail
du -hs * | sort -rh | head -5
du -Sh | sort -rh | head -5
Show of files
du -ah directory_name
Show directory size
du -sh directory_name
Show hidden directorys
du -hs .[^.]*
Copy partition and Hard Drive
dd if=/dev/sda1 of=/dev/sdb1
dd if=/dev/sda of=/dev/sdb
Burn the image
sudo dd oflag=direct status=progress if=image.iso of=/dev/sd* bs=1M; sync
dd with status
pv -tpreb /dev/sdb | dd of=~/sdb.img bs=1M
Make emty files with size
dd if=/dev/zero of=output.dat bs=24M count=1
dd if=/dev/zero of=output.dat bs=1M count=24
Copy cd-rom
dd if=/dev/cdrom of=/opt/cd.iso bs=1M
Create image
dd if=/dev/sdc of=flash.img bs=512
ddrescue /dev/sdc flash.img /tmp/flash.log
dcfldd if=/dev/sda1 hash=md5 of=/media/forensic_disk_image.dd bs=512 noerror
Ignore Errors
dd if=/dev/sdc of=flash.img bs=1M conv=noerror
Read file from physical location
dd if=/dev/<sd*> skip=<start offset> status=none count=8
View
smartctl -a /dev/sda
File system resize
resize2fs /dev/sda
Information
cat /proc/mdstat
Add disk
mdadm --manage /dev/md_number --add /dev/sda
Create the raid with one disk
mdadm --create --verbose /dev/md_number --level=1 --raid-devices=1 /dev/sda
Change number of disks
mdadm --grow /dev/m_number --raid-devices=2
The defragmentation check ext4 partition
e4defrag -c /dev/sda
Defragmentation ext4 partition
e4defrag /dev/sda
Check the result ⩽0.3% non-contiguous
fsck -n /dev/sda
Check the file system
fsck -CMn /dev/sda1
Force check the file system
fsck -CMnf /dev/sda1
Repair the file system
fsck -p /dev/sda1
Repair superblocks
- View backup superblocks
mkfs -t ext4 -n /dev/sda1
- Recovery
fsck -b "superblocks" /dev/sda1
Find badblocks
fsck -c /dev/sda1
Check the partition
xfs_check /dev/sdb1
Check the partition
xfs_repair -n /dev/sdb1
Repair the file system
xfs_repair /dev/sdb1
Force Log Zeroing
xfs_repair -L /dev/sdb1
Connect to disk
fdisk /dev/sdX
Delete the portition
:d
Create the partition
: n
Type primary
: p
First sector
enter
Last sector
enter
Type of partition
:t : XX
Write changes
: w
Update the specified partitions
partx -u /dev/sdX
Directory in ram /etc/fstab
tmpfs path_to_directory tmpfs noatime,nodev,nosuid,size=2G 0 0
Badblocks
badblocks -v /dev/sdXX -o ~/bad_sectors.txt
badblocks -vn /dev/sdXX -o ~/bad_sectors.txt
Ignore badblocks
e2fsck -l badblocks.txt /dev/sdXX
fsck -l badblocks.txt /dev/sdXX
SMART
smartctl -a /dev/sdXX
Create dump
dd if=/dev/sdc of=flash.img bs=512
ddrescue /dev/sdc flash.img /tmp/flash.log
Backup and restore image
ddrescue flash.img backup_part.img bs=10M count=1
ddrescue backup_part.img flash.img conv=notrunc
Recovery data
testdisk flash.img
photorec flash.img