Forensicslvmlogical-volume-managerdisk-managementvolume-groupsphysical-volumesstorage

LVM2

LVM2 is the Linux Logical Volume Manager that provides enterprise-level volume management by grouping disks into volume groups and allocating space to logical volumes accessed as regular block devices.

Description

LVM2 is a rewrite of the Linux Logical Volume Manager, enabling advanced storage management. It groups arbitrary disks into volume groups (VGs), from which logical volumes (LVs) can be created and accessed like standard block devices. This supports flexible resizing, snapshots, striping, mirroring, thin provisioning, caching, and RAID configurations.

The suite includes comprehensive tools for managing physical volumes (PVs), volume groups, and logical volumes, plus device-mapper utilities for low-level operations. Key use cases include dynamic storage allocation, data redundancy through mirroring/RAID, efficient space utilization via thin provisioning, and performance optimization with caching. It's essential for server environments requiring scalable, resilient storage.

LVM2 integrates with the Linux Kernel Device Mapper, keeping device layout knowledge in user-space while handling volume management in kernel-space. This architecture supports not only LVM but also software RAID and other virtual block device drivers.

How It Works

LVM2 uses the Linux Kernel Device Mapper (dm) as its foundation—a minimalistic kernel-space driver for volume management. Device layout and metadata are managed in user-space, providing flexibility. Disks are initialized as Physical Volumes (PVs) with LVM labels and metadata. PVs are grouped into Volume Groups (VGs), which serve as a pool of storage. Logical Volumes (LVs) are carved from VGs and presented as block devices (/dev/mapper/VG-LV).

Advanced features like thin provisioning use thin-pools for overprovisioning, caching attaches fast devices to slow ones via cache-pools, and RAID/mirroring distribute data across PVs for redundancy/performance. The dmeventd daemon monitors device-mapper events, while lvmlockd handles shared storage locking. Tools interact via libdevmapper and liblvm2 libraries, using ioctl calls to manipulate kernel mappings.

Installation

bash
sudo apt install lvm2

Flags

-hShow help information for LVM commands
-vVerbose mode
-fForce operation
-aActivate/deactivate logical volumes
-LSpecify size for logical volume operations
--typeSpecify LV type (linear, striped, mirror, raid, thin, etc.)
-lSpecify extents for LV operations

Examples

Initialize two disks as LVM physical volumes
pvcreate /dev/sdb /dev/sdc
Create a volume group named datavg spanning both disks
vgcreate datavg /dev/sdb /dev/sdc
Create a 50GB logical volume named evidence in datavg
lvcreate -L 50G -n evidence datavg
Create a logical volume using all remaining free space in the volume group
lvcreate -l 100%FREE -n data datavg
Show detailed info about a specific logical volume (path, size, status)
lvdisplay /dev/datavg/evidence
Display all volume groups with full details including physical volumes and LVs
vgdisplay -v
Extend an LV by 20GB then resize the ext4 filesystem online
lvextend -L +20G /dev/datavg/evidence && resize2fs /dev/datavg/evidence
Show device mapper tree — reveals LVM and LUKS layers for forensic mapping
dmsetup ls --tree
Updated 2026-04-16kali.org ↗