Files and disks: inodes, mounts and disk space
You learn from the ground up how a file sits on disk, what partitions, file systems and mount points are, and how to keep track of disk space.
Level 101 · 16 lessons · 18 practice labs
Lessons
How a file is stored
- Blocks and inodes: a file's name and contents live apart
- A file's identity with stat
- Links seen through inodes
- Sparse files: apparent size and real size
- Short task: prove that two names point at the same contents
Disks and partitions
- Disks, partitions and file systems: the library analogy
- Getting to know disks with lsblk and blkid
- File system types: ext4, XFS, Btrfs, vfat
- Mount points: many disks in one tree
- Mount options: ro, noexec, nosuid
- Short task: draw the server's disk map
Managing space
- The difference between df and du, and when they mislead
- Finding large and old files
- tmpfs, /tmp and /var/tmp: where temporary files live
- An introduction to disk quotas
- Capstone: find why the disk filled up and stop it happening again
Practice labs
- Prove two names point at the same contents: Use stat to find the hard links sharing an inode among the files in a directory and write the pairs to the answer file.
- Explain a sparse file's misleading size: Find the real disk use of a file that looks huge in ls and copy it while keeping it sparse.
- Find a deleted file's other name: Starting from the link count, use the inode number to find the surviving name of a confidential report thought deleted.
- Find when a file really changed: Read a file's content, attribute and access times with stat and submit when its permissions were changed.
- Restore timestamps lost in a copy: Carry the modification times over from the originals with touch -r for report files copied without preserving timestamps, and show with stat that they match.
- Reconstruct a file's story from its timestamps: Catch a config file whose modification time was set back by hand from the mismatch between its modification and status-change times; write the order of events, noting how the mount option affects the access time.
- Find who uses how much space on a share: Measure the size of the user directories on the shared partition with du and submit the name of the user taking the most space.
- Set a disk quota for a user on a share: Enable quotas on the shared partition, set soft and hard limits for one user and confirm the limit cannot be exceeded.
- Explain a df and du gap with three causes: On one server, measure the differences caused by a deleted open file, reserved blocks and a hidden mount, and write them up.
- Draw the server's disk map: From lsblk and blkid output, tabulate each partition's size, file system type and mount point.
- Mount the upload directory noexec and nosuid: Remount the upload partition with execution and SUID disabled and show a script can no longer run from it.
- Find data hidden under a mount point: Explain the gap between df and du by uncovering old files buried beneath a mounted partition, and clean them up.
- Mount a disk image read-only: Mount the given disk image read-only through a loop device and submit the name of the document inside.
- Pick the right file system for a USB stick: Format an image that must be readable on Linux and other systems with a suitable file system and note the limit on files over four gigabytes.
- Mount a partition inside a whole-disk image: Mount the second partition of a multi-partition disk image read-only through a loop device and submit the name of the report file inside.
- Find large, old files: Find the five largest files on the data partition untouched for six months and list their paths with sizes.
- Show a full tmpfs eating memory: Work out from tmpfs use under /dev/shm and /tmp why memory is low, and remove the file taking the space.
- Find why the disk filled and stop it recurring: Find the log filling the disk and the process growing it, free space and add rotation or a quota to stop a repeat.
About this course
You learn from the ground up how a file sits on disk, what partitions, file systems and mount points are, and how to keep track of disk space.
What you will learn
- How a file is stored
- Disks and partitions
- Managing space
Prerequisites
No prior knowledge is needed; the course starts from zero.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at beginner level; every term is explained where it first appears.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.