Practical.Linux.Forensics：EVIDENCE FROM STORAGE DEVICES AND FILESYSTEMS

存储布局和卷管理分析

Common partition schemes include:

• DOS/MBR (original PC partition scheme)
• GPT
• BSD
• Sun (vtoc)
• APM (Apple Partition Map)
• None (the absence of a partition scheme where filesystems start at sector zero)

A DOS partition table entry allocates one byte for the partition type. 

0x83	Linux
0x85	Linux extended
0x82	Linux swap
0x8E	Linux LV
0xE8	LUKS (Linux Unified Key Setup)
0xFD	Linux RAID auto

 a community effort to maintain a list of known partition types is located at ：

Partition types: List of partition identifiers for PCs (tue.nl)https://www.win.tue.nl/~aeb/partitions/partition_types-1.htmlA GPT partition table entry allocates 16 bytes for the partition GUID.

请参阅systemd-id128（1）手册页，了解如何使用systemd-id128 show命令列出已知的guid。对于GPT分区方案，您可能会发现一些Linux GPT分区类型包括：

Linux swap	0657FD6D-A4AB-43C4-84E5-0933C84B4F4F
Linux filesystem	0FC63DAF-8483-4772-8E79-3D69D8477DE4
Linux root (x86-64)	4F68BCE3-E8CD-4DB1-96E7-FBCAF984B709
Linux RAID	A19D880F-05FC-4D3B-A006-743F0F84911E
Linux LVM	E6D6D379-F507-44C2-A23C-238F2A3DF928
Linux LUKS	CA7D7CCB-63ED-4C53-861C-1742536059CC

知识点：

The most common storage drives used with Linux are SATA, SAS, NVMe, and SD cards. These block devices are represented in the /dev/ directory of a running system as follows:

• /dev/sda, /dev/sdb, /dev/sdc, . . .
• /dev/nvme0n1, /dev/nvme1n1, . . .
• /dev/mmcblk0, mmcblk1, . . .

If a Linux system detects partitions on a particular drive, additional device files are created to represent those partitions. The naming convention usually adds an additional number to the drive or the letter p with a number; for example:

• /dev/sda1, /dev/sda2, /dev/sda3, . . .
• /dev/nvme0n1p1, /dev/nvme0n1p2, . . .
• /dev/mmcblk0p1, /dev/mmcblk0p2, . . .

常用工具：mmls、disktype