Key Files & Paths
Pseudo-fs, Config & Boot
/proc/partitionskernel partition table
/proc/filesystemsregistered FS types (nodev = virtual)
/proc/mountsactive mounts, kernel-authoritative
/proc/mdstatmdraid array status + rebuild progress
/proc/swapsactive swap areas
/sys/block/sdX/queue/scheduler, read-ahead, physical/logical sector size
/sys/block/sdX/sdX1/startpartition start in 512B sectors
/dev/disk/by-uuid/symlinks by filesystem UUID
/dev/disk/by-partuuid/symlinks by GPT partition UUID
/dev/mapper/device mapper nodes (LVM LVs, dm-crypt)
/etc/fstabstatic mount config
/etc/crypttabLUKS/dm-crypt unlock config
/etc/lvm/backup/automatic VG config backups
/etc/mdadm/mdadm.confmdraid array definitions
/boot/grub/grub.cfggenerated bootloader config (edit /etc/default/grub)
Block Device Inspection
lsblk / blkid
lsblk -f
tree view: name, fstype, label, UUID, mountpoint
lsblk -o NAME,SIZE,TYPE,FSTYPE,UUID,MOUNTPOINT,TRAN
custom columns; TRAN shows usb/sata/nvme
lsblk -t
topology: queue depth, alignment, sector sizes
blkid
probe all block devices — UUID, fstype, label, PARTUUID
blkid -p -u filesystem /dev/sdX
low-level probe, bypass udev cache
file -s /dev/sdX
read filesystem magic bytes directly from device
findmnt
tree of all mounts with source, target, fstype, options
findmnt -D
df-style: size, used, avail per mount
/proc/partitions — kernel partition table
/proc/mounts — active mounts, kernel-authoritative
/dev/disk/by-uuid/ · by-label/ · by-id/ · by-path/
/sys/block/sdX/queue/ — scheduler, read-ahead, rotational
/sys/block/sdX/sdX1/start · size — partition offsets in 512B sectors
Partition Tables
fdisk -l /dev/sdX
list partition table (MBR + GPT aware)
gdisk -l /dev/sdX
GPT-specific; GUIDs, partition type GUIDs, attributes
parted /dev/sdX print
human-readable with alignment, flags, fs type
sfdisk -d /dev/sdX > ptable.dump
dump partition table to scriptable format
sfdisk /dev/sdX < ptable.dump
restore partition table from dump
sgdisk --backup=ptable.bin /dev/sdX
backup full GPT header + partition entries to file
sgdisk --load-backup=ptable.bin /dev/sdX
restore GPT from backup file
wipefs -a /dev/sdX1
erase filesystem/RAID signatures, leave partition table
wipefs -n /dev/sdX
dry-run: show what wipefs would remove
MBR @ LBA0: 446B bootstrap + 64B partition table + 0xAA55. GPT: protective MBR @ LBA0, primary header @ LBA1, entries @ LBA2–33, backup header @ last LBA.
Mount / Umount
mount -o ro,noatime /dev/sdX1 /mnt/r
read-only, suppress access time writes
mount -o degraded,ro /dev/sdX /mnt/r
btrfs: attempt degraded mount when devices missing
mount -o loop disk.img /mnt/r
mount image file via loopback
mount -o offset=N,sizelimit=M disk.img /mnt/r
mount partition inside raw image by byte offset
losetup -P /dev/loop0 disk.img
expose all image partitions as /dev/loop0p1 etc
losetup -l
list active loop devices
mount --bind /src /dst
bind-mount a directory subtree to another path
umount -l /mnt/r
lazy umount — detach when last fd closes
/etc/fstab — persistent mounts (prefer UUID over /dev/sdX)
/etc/crypttab — LUKS/dm-crypt device mapping
Imaging & Recovery
Imaging & Cloning
dd if=/dev/sdX of=disk.img bs=4M status=progress conv=noerror,sync
raw image; noerror continues past errors, sync zero-pads bad blocks
ddrescue -d -r3 /dev/sdX disk.img disk.map
recovery imaging; reuse same mapfile to resume automatically
ddrescue -d -r3 --try-again /dev/sdX disk.img disk.map
retry previously skipped bad sectors
partclone.ext4 -c -s /dev/sdX1 -o part.img
fs-aware clone, skips unused blocks — smaller image
e2image -ra /dev/sdX1 fs-meta.img
ext metadata-only image; tiny, sufficient before e2fsck
Mapfile preserves recovery state — losing it wastes all prior work. Always ddrescue before fsck/scrub on suspect drives.
fsck / Repair
fsck -n /dev/sdX1
dry-run check, no writes
e2fsck -n /dev/sdX1
ext2/3/4 dry-run; shows what would be fixed
e2fsck -y -f /dev/sdX1
force check + auto-yes all prompts — unmounted only
e2fsck -b 32768 /dev/sdX1
use backup superblock (32768, 98304, 163840…)
btrfs check --readonly /dev/sdX
btrfs consistency check, no writes
btrfs scrub start -Bd /mnt/r
online scrub; checksums every block, surfaces unrecoverable extents
btrfs restore -i -S /dev/sdX /mnt/out
low-level file extraction, bypasses normal mount path
xfs_repair -n /dev/sdX1
XFS dry-run check, no modifications
Avoid repair ops on mounted filesystems unless explicitly supported (btrfs scrub and online xfs_repair differ from ext fsck). Never run btrfs check --repair without a ddrescue image first.
debugfs (ext2/3/4)
debugfs /dev/sdX1
open ext filesystem read-only (interactive shell)
debugfs -w /dev/sdX1
open read-write — use only when necessary
stat <inode>
inode fields: mode, uid, size, block map, timestamps
ls -d <2>
list directory by inode number (root = inode 2)
dump <inode> /tmp/recovered
extract file by inode to local path
undel <inode> /tmp/recovered
undelete by inode — works if blocks not yet reused
lsdel
list recently deleted inodes with timestamps
imap <inode>
show which block group and bitmap bit owns inode
block_dump <block#>
hex dump raw block contents
show_super_stats
full superblock dump
ext Metadata & Superblock
tune2fs
tune2fs -l /dev/sdX1
read superblock — UUID, label, mount count, last check, features
tune2fs -L NEWLABEL /dev/sdX1
relabel without reformatting
tune2fs -U random /dev/sdX1
assign new random UUID in-place
tune2fs -C 1 /dev/sdX1
set mount count to 1 — forces fsck on next mount
tune2fs -m 1 /dev/sdX1
set reserved block percentage (default 5%)
tune2fs -e remount-ro /dev/sdX1
on error: remount read-only rather than panic or continue
tune2fs -O has_journal /dev/sdX1
enable journaling on ext2 → ext3
dumpe2fs
dumpe2fs /dev/sdX1
full superblock + all block group descriptors
dumpe2fs -h /dev/sdX1
superblock only (no block group detail)
dumpe2fs /dev/sdX1 | grep "Backup superblock"
list backup superblock locations for e2fsck -b
Backup superblocks on ext4 with sparse_super2 are only at block groups 1, 3, 5, and powers of 3 and 5. Check with dumpe2fs first before guessing.
Filesystem Creation
mkfs.ext4 -L LABEL -U $(uuidgen) /dev/sdX1
ext4 with explicit label + UUID
mkfs.btrfs -L LABEL -d raid1 -m raid1 /dev/sdX /dev/sdY
btrfs RAID-1 across two devices
mkfs.xfs -L LABEL /dev/sdX1
XFS — scales well for large filesystems, parallel I/O
mkfs.exfat -L LABEL /dev/sdX1
exFAT — userspace tools from exfatprogs; kernel support built-in on modern Linux
mkfs.vfat -F 32 -n LABEL /dev/sdX1
FAT32
mkswap -L SWAP /dev/sdX2
swap partition with label
LVM
Physical & Volume Groups
pvs / vgs / lvs
summary tables: physical volumes, volume groups, logical volumes
pvdisplay -m /dev/sdX
PV detail with PE-to-LV segment mapping
vgdisplay -v
VG detail with all LV and PV members
pvscan --cache
rescan devices and update device mapper cache
vgchange -ay
activate all volume groups (make LVs accessible)
vgextend vgname /dev/sdY
add new PV to existing VG
pvmove /dev/sdX
migrate all extents off a PV (before removal/replacement)
vgreduce vgname /dev/sdX
remove PV from VG after pvmove
/etc/lvm/backup/ — automatic per-change VG config backups
/etc/lvm/archive/ — older snapshots of VG config
Logical Volumes
lvcreate -L 50G -n lvname vgname
create LV of fixed size
lvcreate -l 100%FREE -n lvname vgname
create LV using all free VG space
lvextend -L +20G -r /dev/vg/lv
grow LV by 20G and resize filesystem in one step (-r)
lvreduce -L -10G /dev/vg/lv
shrink LV — resize filesystem first or data loss guaranteed
lvcreate -s -L 5G -n snap /dev/vg/lv
create snapshot LV with 5G CoW space
lvdisplay -m
show LV segment-to-physical extent mapping
LVM Recovery
vgcfgrestore -f /etc/lvm/backup/vgname vgname
restore VG metadata from automatic backup
vgcfgrestore -l vgname
list available backup/archive configs for a VG
pvcreate --restorefile /etc/lvm/backup/vg --uuid UUID /dev/sdX
recreate PV header with original UUID on replacement disk
vgimportclone -n newvg /dev/sdX /dev/sdY
import cloned VG with new name + UUIDs to avoid collision
dmsetup ls
list all device mapper targets (LVs, dm-crypt, etc)
dmsetup info /dev/dm-0
state, open count, event number for a dm device
dmsetup table /dev/dm-0
mapping table: extents, target type, backing devices
If a VG won't activate after disk replacement: pvcreate --restorefile to recreate PV header, then vgcfgrestore, then vgchange -ay.
Device Mapper & Encryption
cryptsetup / LUKS
cryptsetup luksOpen /dev/sdX1 name
unlock LUKS volume, maps to /dev/mapper/name
cryptsetup luksClose name
remove dm-crypt mapping
cryptsetup luksDump /dev/sdX1
LUKS header: cipher, UUID, key slots, payload offset
cryptsetup luksHeaderBackup /dev/sdX1 --header-backup-file hdr.img
backup LUKS header — essential; wiped header = permanent data loss
cryptsetup luksHeaderRestore /dev/sdX1 --header-backup-file hdr.img
restore LUKS header from backup
cryptsetup luksAddKey /dev/sdX1
add new passphrase/keyfile to a free key slot
cryptsetup isLuks -v /dev/sdX1
test if device is a LUKS volume
LUKS2 default since cryptsetup 2.1. Backup the header immediately after luksFormat — the header contains the master key wrapped by your passphrase; losing it is unrecoverable.
dmsetup
dmsetup ls --tree
dependency tree of all dm devices
dmsetup info name
state, suspend status, open count, event number
dmsetup table name
target type and mapping (linear/striped/crypt/snapshot)
dmsetup status name
runtime status of each target segment
dmsetup deps name
underlying block devices this dm device depends on
dmsetup remove name
tear down a dm mapping (must not be in use)
dmsetup suspend / resume name
pause/unpause I/O — used during live table swaps
mdraid
mdadm --detail /dev/md0
array state, members, rebuild progress, UUID
mdadm --examine /dev/sdX
read superblock from member disk — UUID, level, role
mdadm --assemble --scan
auto-assemble arrays from member superblocks
mdadm --assemble /dev/md0 /dev/sdX /dev/sdY
manually assemble named array from specific members
mdadm --assemble --force /dev/md0 /dev/sdX
force assemble degraded array on single surviving member
mdadm --manage /dev/md0 --add /dev/sdY
hot-add replacement disk, triggers rebuild
cat /proc/mdstat
all arrays: state, members, rebuild progress + speed
/etc/mdadm/mdadm.conf — array definitions for boot-time assembly
SMART & Drive Health
smartctl
smartctl -i /dev/sdX
device identity, interface, SMART capability
smartctl -H /dev/sdX
overall PASSED/FAILED health assessment
smartctl -a /dev/sdX
all attributes — watch 5, 187, 188, 197, 198
smartctl -t short /dev/sdX
initiate short self-test (~2 min, runs on device)
smartctl -t long /dev/sdX
extended self-test — reads every sector
smartctl -l selftest /dev/sdX
self-test log — history of past test results
smartctl -l error /dev/sdX
error log — last 5 ATA errors with LBA
smartctl -d sat -a /dev/sdX
force SAT protocol (USB enclosures that hide SMART)
Key attributes: 5=Reallocated sectors, 187=Uncorrectable errors, 197=Current pending sectors, 198=Offline uncorrectable. Nonzero 197/198 means sectors failing to read.
NVMe & Surface
nvme list
all NVMe namespaces — model, firmware, size
nvme smart-log /dev/nvme0
media errors, wear level %, power cycles, temp
nvme error-log /dev/nvme0
per-command error log entries
nvme id-ctrl /dev/nvme0
controller identity — OACS, LBA formats, features
badblocks -v -n /dev/sdX
non-destructive read-write test (writes temp patterns; avoid on suspect failing drives)
fstrim -v /mnt/r
send TRIM/discard for all free blocks on mounted SSD
fstrim -Av
trim all mounted filesystems that support it
Btrfs
Btrfs
btrfs filesystem show
all btrfs filesystems and member devices
btrfs filesystem usage /mnt/r
per-device allocation and free space breakdown
btrfs device stats /mnt/r
per-device error counters (read/write/corrupt/flush/generation)
btrfs device add /dev/sdY /mnt/r
add device to existing filesystem
btrfs device remove /dev/sdX /mnt/r
remove device (data redistributed first)
btrfs subvolume list /mnt/r
list subvolumes and snapshots with IDs and paths
btrfs subvolume snapshot -r /mnt/r/@ /mnt/r/snap
create read-only snapshot
btrfs subvolume delete /mnt/r/snap
delete snapshot or subvolume
btrfs send /mnt/r/snap | btrfs receive /mnt/dst
stream snapshot to another filesystem (incremental backup)
btrfs property set /mnt/r/snap ro false
make read-only snapshot writable
btrfs balance start -mconvert=single /mnt/r
rebalance metadata after device removal
btrfs balance start -dusage=50 /mnt/r
balance only chunks <50% full (reduces fragmentation)
btrfs scrub start -Bd /mnt/r
verify checksums on every block; surface unrecoverable extents
btrfs check --readonly /dev/sdX
offline consistency check — unmounted only
btrfs restore -i -S /dev/sdX /mnt/out
extract files bypassing normal mount — last resort recovery
RAID-1 degraded recovery: mount -o degraded,ro, copy data off, add replacement device, run balance to rebuild. Never run btrfs check --repair without a full image first — it has a history of making corruption worse.
Commands beyond the core rescue workflow — useful for deeper inspection, performance tuning, and forensic work.
Raw Block I/O & Hex
hexdump -C -n 512 /dev/sdX
hex + ASCII dump of first sector (MBR)
xxd /dev/sdX | head -32
alternative hex view, pipe-friendly
dd if=/dev/sdX bs=512 count=1 | xxd
pipe single sector into xxd
od -A x -t x1z /dev/sdX | head
octal dump in hex with printable chars
cmp -l /dev/sdX /dev/sdY | head
byte-by-byte comparison of two block devices
dc3dd if=/dev/sdX of=disk.img hash=sha256 log=hash.log
forensic imaging with hash log (dc3dd / dcfldd)
testdisk / photorec
testdisk /dev/sdX
interactive partition table analysis and recovery
testdisk disk.img
run against image file — safer than live device
photorec /dev/sdX
file carving by signature — ignores filesystem structure
testdisk: Analyse → Quick Search → Deep Search if Quick misses. Write partition table only after confirming structure looks correct. photorec recovers by type not filename — output is sequentially numbered files in recovered dirs.
Performance & I/O Stats
iostat -xz 1
extended per-device I/O stats: util%, await, r/w throughput
iotop -o
per-process I/O — only show active processes
hdparm -tT /dev/sdX
buffered and cached read throughput benchmark
hdparm -I /dev/sdX
ATA identity: model, firmware, features, AAM, APM
blockdev --getbsz /dev/sdX
get block size
blockdev --getsize64 /dev/sdX
get device size in bytes
cat /sys/block/sdX/queue/rotational
0 = SSD/NVMe, 1 = spinning rust
cat /sys/block/sdX/queue/physical_block_size
physical sector size (4096 for AF drives)
inotify & Filesystem Events
inotifywait -rm /path
recursive monitor: report all fs events on path
inotifywait -e modify,create,delete -m /path
filter to specific event types
fatrace
system-wide file access trace via fanotify (needs root)
lsof +D /mnt/r
all open file descriptors under a mount point
fuser -m /mnt/r
PIDs with files open on the filesystem — useful before umount
Encryption & Secure Erase
shred -vz -n 3 /dev/sdX
3-pass overwrite + final zero pass (slow; use on HDDs)
nvme format --ses=1 /dev/nvme0
NVMe cryptographic erase (instant, controller-side)
hdparm --security-erase NULL /dev/sdX
ATA Secure Erase — drive-level, resets all user data
cryptsetup luksFormat --type luks2 /dev/sdX1
initialise LUKS2 container on partition
cryptsetup resize name
resize dm-crypt device to fill underlying block device
For SSDs, shred is ineffective due to wear-levelling. Use nvme format --ses or hdparm ATA Secure Erase instead. Back up the LUKS header before any erase operation on an encrypted volume.
Misc Low-Level
udevadm info -a /dev/sdX
full udev attribute chain for device and parents
udevadm monitor --udev
live udev event stream — watch device plug/unplug
udevadm trigger
re-run udev rules on all devices (rescan)
partprobe /dev/sdX
inform kernel of partition table change without reboot
blockdev --rereadpt /dev/sdX
kernel re-read partition table (alternative to partprobe)
resize2fs /dev/sdX1
grow ext2/3/4 to fill partition (after lvextend or resize)
xfs_growfs /mnt/r
grow XFS online — operates on mountpoint, not device
dmesg | grep -E "sd[a-z]|nvme|ata|EXT4|BTRFS|XFS"
kernel ring buffer filtered to storage subsystem messages