What is the meaning of the output? Where are the listed files physically stored?

Exploring Filesystems in Linux
Step 1. Access the command line.
Launch the CyberOps Workstation VM and open a terminal window.
Step 2. Display the filesystems currently mounted.
a. Use the lsblk command to display all block devices:



[analyst@secOps ~]$ lsblk

NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT

sda 8:0 0 5.9G 0 disk

??sda1 8:1 0 5.9G 0 part /

sdb 8:16 0 1G 0 disk

??sdb1 8:17 0 1023M 0 part

sr0 11:0 1 1024M 0 rom

The output above shows that the CyberOps Workstation VM has three block devices installed: sr0, sda and sdb. The tree-like output also shows partitions under sda and sdb. Conventionally, /dev/sdX is used by Linux to represent hard drives, with the trailing number representing the partition number inside that device. Computers with multiple hard drives would likely display more /dev/sdX devices. If Linux was running on a computer with four hard drives for example, it would show them as /dev/sda, /dev/sdb, /dev/
sdc and /dev/sdd, by default. The output implies that sda and sdb are hard drives, each one containing a single partition. The output also shows that sda is a 5.9GB disk while sdb has 1GB.
b. Use the mount command to display more detailed information on the currently mounted filesystems in the CyberOps Workstation VM.



[analyst@secOps ~]$ mount

proc on /proc type proc (rw,nosuid,nodev,noexec,relatime)

sys on /sys type sysfs (rw,nosuid,nodev,noexec,relatime)

dev on /dev type devtmpfs (rw,nosuid,relatime,size=1030408k,nr_

inodes=218258,mode=755)

run on /run type tmpfs (rw,nosuid,nodev,relatime,mode=755)

/dev/sda1 on / type ext4 (rw,relatime,data=ordered)

securityfs on /sys/kernel/security type securityfs (rw,nosuid,nodev,noexec,rela

time)

tmpfs on /dev/shm type tmpfs (rw,nosuid,nodev)

devpts on /dev/pts type devpts (rw,nosuid,noexec,relatime,gid=5,mode=620,ptmxmo

de=000)

tmpfs on /sys/fs/cgroup type tmpfs (ro,nosuid,nodev,noexec,mode=755)

Many of the filesystems above are out of scope of this course and irrelevant to the lab. Let’s focus on the root filesystem, the filesystem stored in /dev/sda1. The root filesystem is where the Linux operating system itself is stored; all the programs, tools, configuration files are stored in root filesystem by default.
c. Run the mount command again, but this time, use the pipe | to send the output of mount to grep to filter the output and display only the root filesystem:



[analyst@secOps ~]$ mount | grep sda1

/dev/sda1 on / type ext4 (rw,relatime,data=ordered)

In the filtered output above, mount shows us that the root filesystem is located in the first partition of the sda block device (/dev/sda1). We know this is the root filesystem because of the mounting point used: “/” (the slash symbol). The output also tells us the type of formatting used in the partition, ext4 in this case. The information in between parentheses relates to the partition mounting options.
d. Issue the following two commands below on the CyberOps Workstation VM:



[analyst@secOps ~]$ cd /

[analyst@secOps /]$ ls -l

The first command changes the directory to the root directory. The root directory is the highest level of the filesystems. Because /dev/sda1 is mounted on the root directory (“/”), by listing the files in the root directory, the user is actually listing files physically stored in the root of the /dev/sda1 filesystem.