Determining the structure of the disk

There are two simple tools available for determining the structure of a disk attached to your system. The first,fdisk, we discussed eariler using the-loption. Replace the “x” with the letter of the drive that corresponds to the subject drive.

fdisk –l /dev/hdx

Disk /dev/hda: 255 heads, 63 sectors, 1582 cylinders Units = cylinders of 16065 * 512 bytes

Device Boot Start End Blocks Id System

/dev/hda1 1 255 2048256 b Win95 FAT32

/dev/hda2* 256 638 3076447+ 83 Linux

/dev/hda3 639 649 88357+ 82 Linux swap

/dev/hda4 650 1582 7494322+ f Win95 Ext'd (LBA)

/dev/hda5 650 1453 6458098+ b Win95 FAT32

/dev/hda6 1454 1582 1036161 b Win95 FAT

We can redirect the output of this command to a file for later use by issuing the command as:

fdisk –l /dev/hdx > fdisk.disk1

A couple of things to note here: The name of the output file

(fdisk.disk1) is completely arbitrary. There are no rules for extensions.

Name the file anything you want. I would suggest you stick to a conventionand make it descriptive. Also note that since we did not define an explicit path for the file name,fdisk.disk1_will be created in our current directory (for instance,/root/evidence/_).

Also note that you can expect to see strange output if you usefdi**skon a floppy disk. Be aware of that if you attemptfdiskon the practice floppy. Try it on your harddrive instead to see sample output. Don’t usefdisk**on the practice floppy. The output won’t make sense.