Disks, Partitions, Block Devices, and lsblk

1. Storage is a stack of independently inspectable layers

A disk shown by a cloud provider, hypervisor, RAID controller, USB enclosure, or physical bus becomes a block device when the Linux kernel exposes it through the block subsystem. A block device accepts reads and writes in addressable blocks. It may be consumed directly, divided into partitions, combined with other devices, encrypted, enrolled in LVM, formatted with a filesystem, and finally attached to the directory tree at a mount point.

These layers are not interchangeable. A partition is a range of sectors described by a partition table. A filesystem is an on-disk data structure placed on a block device or logical volume. A mount connects a filesystem instance to a directory. An operational investigation should identify every layer instead of assuming that a path such as /var/lib maps directly to a physical disk.

flowchart TB
  A["Physical, virtual, or cloud disk"] --> B["Kernel block device"]
  B --> C["Partition table: GPT or MBR"]
  C --> D["Partition or whole-device consumer"]
  D --> E["Optional RAID, encryption, or LVM"]
  E --> F["Filesystem"]
  F --> G["Mount point in the directory tree"]
  H["Application path"] --> G

2. Read device names as kernel identifiers—not permanent identity

Enumeration order can change across boots or hardware events. Persistent configuration should normally identify filesystems by UUID=, LABEL=, or a stable path under /dev/disk/by-*, not by assuming that a particular disk will always be /dev/sdb.

3. Build the topology with lsblk

lsblk reads kernel and udev information and presents parent-child relationships. Select columns explicitly so reports remain understandable across distributions.

# A readable topology with identity, capacity, and mount information
lsblk -e 7 -o NAME,KNAME,PATH,TYPE,SIZE,RO,RM,FSTYPE,FSVER,LABEL,UUID,MOUNTPOINTS

# Show transport and hardware-oriented details where available
lsblk -d -o NAME,MODEL,SERIAL,TRAN,ROTA,DISC-GRAN,DISC-MAX,SIZE

# Machine-readable output for automation
lsblk --json -o NAME,PATH,TYPE,SIZE,FSTYPE,UUID,MOUNTPOINTS

Key fields answer different questions: TYPE distinguishes disks, partitions, logical volumes, RAID devices, and loop devices; FSTYPE reports detected content; MOUNTPOINTS may contain several paths; RO and RM reveal read-only or removable devices. A blank FSTYPE does not prove that a device is empty—it may contain LVM, encryption, RAID metadata, an unsupported signature, or data without a recognized filesystem.

4. Correlate signatures, mounts, udev, and sysfs

# Filesystem and other recognizable signatures
sudo blkid

# Mount-source relationships, including options
findmnt --real --output TARGET,SOURCE,FSTYPE,OPTIONS
findmnt --target /var

# Udev properties for one confirmed device
udevadm info --query=property --name=/dev/sda 2>/dev/null | sort

# Kernel block devices and queue characteristics
for d in /sys/class/block/*; do
  printf '%-18s ' "$(basename "$d")"
  cat "$d/size" 2>/dev/null || true
done

blkid probes signatures and identifiers. findmnt starts from the mounted filesystem view and is often the fastest way to map an application path downward. Udev provides attributes and stable links, while /sys/class/block exposes the kernel's live model. During an incident, use several sources because each answers a different layer of the question.

5. Partition tables describe ranges; they do not store files

Modern systems normally use GPT. GPT supports large devices, many partitions, checksummed metadata, and globally unique identifiers. MBR uses a smaller legacy structure with primary and extended partition constraints. Linux can inspect both with tools such as fdisk, parted, and sfdisk.

# Read-only partition inspection
sudo fdisk -l
sudo parted -l

# Save a machine-readable partition layout for review or recovery planning
sudo sfdisk --dump /dev/sda > sda-partition-table.txt

# Verify the captured report; this does not write to the disk
sed -n '1,120p' sda-partition-table.txt

Partitions should begin on boundaries compatible with device erase blocks and storage stripes. Current partitioning tools generally align automatically, but imported or very old layouts may not. Sector size is also contextual: a device may report 512-byte logical sectors while using 4096-byte physical sectors internally.

6. Hands-on lab: create a read-only storage evidence bundle

This lab collects topology, signatures, mounts, capacity, and kernel messages without modifying storage. Some commands produce more detail with sudo; omit it where unavailable.

lab="$HOME/devops-academy/linux/chapter10/lesson01"
mkdir -p "$lab"
cd "$lab"

lsblk -e 7 -o NAME,KNAME,PATH,TYPE,SIZE,RO,RM,FSTYPE,FSVER,LABEL,UUID,MOUNTPOINTS \
  > lsblk.txt
lsblk --json -o NAME,PATH,TYPE,SIZE,FSTYPE,UUID,MOUNTPOINTS \
  > lsblk.json
findmnt --real --output TARGET,SOURCE,FSTYPE,OPTIONS > findmnt.txt
cat /proc/partitions > proc-partitions.txt

if command -v blkid >/dev/null 2>&1; then
  sudo blkid > blkid.txt 2>&1 || blkid > blkid.txt 2>&1 || true
fi

# Recent storage-related kernel evidence; access may be restricted.
dmesg --ctime 2>/dev/null | grep -Ei 'block|nvme|scsi|ata|virtio|I/O error' \
  | tail -n 100 > kernel-storage-events.txt || true

sha256sum ./*.txt ./*.json 2>/dev/null > evidence.sha256
printf 'Evidence directory: %s\n' "$PWD"
wc -l ./*

7. Common storage-identification mistakes

8. Knowledge check

9. Summary

Linux storage is a layered topology. Hardware or virtual capacity appears as block devices; partition tables describe ranges; optional RAID, encryption, and LVM layers transform devices; filesystems organize data; mounts attach filesystems to paths. Reliable operators identify each layer with multiple read-only tools before changing anything.

10. Further reading

• lsblk(8), blkid(8), findmnt(8), and udevadm(8) manual pages.
• Linux kernel block-layer and sysfs documentation.
• GPT/MBR and partitioning documentation for fdisk, sfdisk, and GNU Parted.