Hack Like a Pro: Linux Basics for the Aspiring Hacker, Part 20 (Devices Files) « Null Byte :: WonderHowTo

Welcome back, my aspiring hackers!In recent tutorials, I have made reference to the name and location of theLinuxdevices in the file system, such assda(first SATA or SCSI drive). Specifically, I have mentioned the way that Linux designates hard drives when making animage of a hard drive for forensic purposes.Fundamental to understanding how to use and administer hard drives and other devices in Linux is an understanding of how Linux specifies these devices in its file system.Very often, if we are using are hard drive in a hack or inforensics, we will need to specifically address its device file name. These device file names allow the device (e.g. hard drive) to interact with system software and kernel through system calls. These files are NOT device drivers, but rather rendezvous points that are used to communicate to the drivers. Linux maintains a device file foreverydevice in the system in the/devdirectory.In this tutorial, we will examine how Linux names and interacts with the file system through the/devdirectory and its files.The /Dev DirectoryThe/devdirectory contains all the files that represent physical peripheral devices present on the system such as disk drives, terminals, and printers. The/devdirectory is directly below the/directory. If we navigate there, we will see an entry for all of our devices.kali > cd /devkali > ls -lBlock v. Character DevicesLinux makes a distinction between block and character devices. Character devices are those that stream data into and out of the machine unbuffered and directly. These would include your keyboard, mouse, tape, and monitor. Because the data is unbuffered, it tends to be a slow process.On the other hand, block devices are those that stream data into and out of the machine in buffered blocks. These include such devices as hard drives, CDs, DVDs, floppies, flash drives, etc. This data transfer tends to be much faster.Notice in the long listing of the/devdirectory that some files begin with a "c" and some with a "b". Character devices begin a with "c " and block devices begin with a "b".You will notice in the third line of the/devdirectory listing that there is directory named "block". Let's navigate there and do a long list.kali > cd /blockkali > ls -lHere we see a listing of all the block devices. In the first line we seesr0; that would be the first CD-ROM (Linux tends to begin counting at 0, not 1). Near the bottom, we seesda, sda1, sda2, sda5(yours may be different), where sda1 represents the first primary partition on the SATA drive, and sda2 represents the second primary partition on the SAME drive.Naming Conventions of Devices in LinuxOriginally, hard drives were two types, IDE or SCSI. IDE (or later, E-IDE) was designed as a low cost alternative for low cost PCs. They were relatively slow and only allowed four devices per machine. In addition, they had to be configured in a master and slave configuration. Each master and slave combination had one cable and controller.A faster, but more expensive alternative was the SCSI (Small Computer System Interface) drive. SCSI drives were (are) faster and pricier. Besides their speed advantage, they did not need a master/slave configuration, but rather were configured with a controller and a series of devices up to 15.Linux would designate IDE hard drives with anhdand SCSI hard drives with ansd. In recent years, with the development and proliferation of SATA drives, we see that Linux designates these drives withsd, just like SCSI drives.The first IDE drive was designated with anhda, the secondhdb, the thirdhdc, and so on. The same happens with SCSI and now SATA drives; the first is designated withsda, the secondsdb, the thirdsdc, and so on.Some other devices files include:/dev/usb- USB devices/dev/lp- parallel port printer/dev/tty- local terminal/dev/fd- floppy drive (does anyone still use floppies?)Logical vs. Physical Partitions of Hard DrivesLinux is able to recognize four (4) primary hard drive partitions per operating system. This doesn't limit us to four hard drives or four partitions as we can also use logical or extended partitions. We can have up to 15 logical or extended partitions per disk and each of these partitions acts as its own hard drive and operates just as fast as a primary partition.The first primary partition in Linux with a SATA drive would besda1, the secondsda2, the thirdsda3, and the fourthsda4. Beyond these primary partitions, we can still partition the drive, but they are now logical partitions. The first logical partition would besda5with a SATA drive. This can then be followed by 14 more logical drives, if needed, with the last logical drive on the first SATA drive beingsda19(4 primary and 15 logical partitions).In Linux, we generally have a separate partition for swap space. Swap space is that area of the hard drive that is used as virtual memory. This means that when we run out of memory (RAM) for a particular process or application, the operating system will then use this hard drive space as if it were RAM, but obviously, much slower (about 1,000x slower).Special DevicesLinux has a number of special device files. This is a list of a few of the most important special device files./dev/nullThis device is a data sink or "bit bucket". It makes data disappear. If you redirect output to this device it will disappear. If you read from/dev/null, you will get a null string. If I wanted to wipe a drive clean, deleting all the data, I could use:dd if=/dev/null of=/dev/sda/dev/zeroThis device can be used as an input file to provide as many null bytes (0x00) as necessary. It is often used to initialize a file or hard drive./dev/ fullThis device is a special file that always returns the "device full" error. Usually, it is used to test how a program reacts to a "disk full" error. It is also able to provide an infinite number of null byte characters to any process for testing./dev/randomThis device can be used as an input to fill a file or partition with random, or more precisely, pseudo-random data. I might use this to overwrite a file or partition to make it much harder to recover deleted files by a forensic investigator.It's almost impossible to remove evidence of a file from recovery by a skilled forensic investigator with unlimited time and money. Since few forensic investigators have the skill or the time or the money, this technique will inhibit most forensic investigations.To do this, we can use theddcommand. For instance:dd if=/dev/random of=evidencefile bs=1 count=1024I hope this sheds some light on this relatively foreign concept—native to Linux—that Windows users often struggle with. For more guides on Linux, check out all of my pastLinux Basicsguides, and keep a lookout for more to come.Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseRelatedNews:How to Study for the White Hat Hacker Associate Certification (CWA)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 11 (Apache Web Servers)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 1 (Getting Started)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 13 (Mounting Drives & Devices)How To:The Essential Skills to Becoming a Master HackerHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 6 (Networking Basics)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 12 (Loadable Kernel Modules)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 21 (GRUB Bootloader)How To:Linux Basics for the Aspiring Hacker: Managing Hard DrivesHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 2 (Creating Directories & Files)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 5 (Installing New Software)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 22 (Samba)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 17 (Client DNS)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 4 (Finding Files)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 25 (Inetd, the Super Daemon)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 10 (Manipulating Text)How to Hack Like a Pro:Getting Started with MetasploitHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 9 (Managing Environmental Variables)Hack Like a Pro:Windows CMD Remote Commands for the Aspiring Hacker, Part 1Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 24 (The Linux Philosophy)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 16 (Stdin, Stdout, & Stderror)Goodnight Byte:HackThisSite Walkthrough, Part 6 - Legal Hacker TrainingGoodnight Byte:HackThisSite Walkthrough, Part 8 - Legal Hacker TrainingGoodnight Byte:HackThisSite Walkthrough, Part 10 - Legal Hacker TrainingCommunity Byte:HackThisSite Walkthrough, Part 6 - Legal Hacker TrainingGoodnight Byte:HackThisSite Walkthrough, Part 7 - Legal HackerHack Like a Pro:Hacking Samba on Ubuntu and Installing the MeterpreterGoodnight Byte:HackThisSite, Realistic 3 - Real Hacking SimulationsCommunity Byte:HackThisSite Walkthrough, Part 1 - Legal Hacker TrainingCommunity Byte:HackThisSite Walkthrough, Part 2 - Legal Hacker TrainingHow To:Use Cygwin to Run Linux Apps on WindowsGoodnight Byte:HackThisSite, Realistic 4 - Real Hacking SimulationsHow To:How Hackers Take Your Encrypted Passwords & Crack ThemCommunity Byte:HackThisSite Walkthrough, Part 10 - Legal Hacker TrainingGoodnight Byte:HackThisSite Walkthrough, Part 9 - Legal Hacker TrainingGoodnight Byte:HackThisSite Walkthrough, Part 4 - Legal Hacker Training