5.3.2. Storage Diagnostic Tools and Techniques
💡 First Principle: Storage diagnosis proceeds from logical to physical: check the file system and mount status first (quickest), then the RAID array status, then the physical drive, then the controller and cabling. Going straight to physical replacement when a logical issue is the cause wastes expensive drives and time.
Storage Diagnostic Tools
| Tool | Platform | Purpose |
|---|---|---|
| Disk Management (diskmgmt.msc) | Windows | View partition layout, status, drive letter assignments |
| diskpart | Windows | Command-line partitioning and volume management |
| chkdsk | Windows | Check and repair filesystem errors, scan for bad sectors |
| Event Viewer | Windows | Disk, storage controller, and filesystem error events |
| fdisk / gdisk / parted | Linux | Partition management |
| fsck | Linux | Filesystem check and repair (unmounted volumes) |
| lsblk / blkid | Linux | List block devices, show filesystem types and mount points |
| df / du | Linux | Show disk usage and capacity |
| RAID management CLI/GUI | Vendor-specific | Array status, drive health, rebuild progress |
| System logs | Linux | /var/log/syslog, /var/log/messages, dmesg for storage errors |
| badblocks | Linux | Scan for bad sectors on a drive |
| SMART tools | Cross-platform | smartctl (Linux), vendor tools (Windows) |
Mount-Related Commands
When a drive or network share is inaccessible:
net use(Windows): Connect or disconnect network drive mappings; shows current mapped drivesmount(Linux): Attach a filesystem to the directory tree;mount -aremounts all filesystems in/etc/fstabumount(Linux): Safely unmount a filesystem before removal
Physical Diagnostic Techniques
- Visual inspection: Check drive bay LEDs (fault LED lit = drive problem)
- Auditory inspection: Clicking or grinding from HDD = mechanical failure; replace immediately
- Cable inspection: Check SAS/SATA data cables and power cables for damage; try known-good cable
- Re-seat drives: Remove and reinsert in bay to clear oxidation on connector
- Test with known-good drive: Swap suspected bad drive with confirmed-good drive to verify the bay and backplane are functional
⚠️ Exam Trap: Never run fsck on a mounted filesystem — it will cause additional corruption. fsck must be run on unmounted volumes only (or on the next boot before the volume is mounted). The exam tests this constraint directly.
Reflection Question: A Linux server reports filesystem errors on /var/log. The server is currently running and /var/log is mounted. What must you do before running fsck, and why?
