# Investigating storage, disks and volumes

### Disk <a href="#investigatingstorage-disksandvolumes-disk" id="investigatingstorage-disksandvolumes-disk"></a>

The term disk refers to the physical storage device of a computer. However, there are instances where it can represent a logical disk, which spans across one or more physical disks. For example, with a redundant array of independent disks (RAID) configuration, you combine multiple physical disks to form a single logical disk, providing increased performance, redundancy or both.

**Windows**

In the **Disk Management** application, the system calls physical drives **disks** and labels them as `Disk 0`, `Disk 1`, ... Under **This PC**, the system assigns these storage devices drive letters (`C:`, `D:`, ...).

These devices can vary in type, including local disks, USB drives or virtual disks.

<figure><img src="/files/r8Z2u7ZZUWjjEWspBZer" alt="" width="544"><figcaption></figcaption></figure>

<figure><img src="/files/6vPFoDG4ENyWb0RaU16B" alt="" width="340"><figcaption></figcaption></figure>

**macOS**

In the **Disk Utility** application, the system calls physical drives **media** and they appear as top-level entries. The system classifies them as internal or external and labels them as `disk0`, `disk1`, ...

<figure><img src="/files/Fx4EzJ6tzqfbmGBy0vZK" alt="" width="544"><figcaption></figcaption></figure>

Using the `diskutil list` command, you can display all devices as `/dev/disk0`, `/dev/disk1`, ...

<figure><img src="/files/xZKuSI6uZ58LAgA7a9qZ" alt=""><figcaption></figcaption></figure>

### Volume <a href="#investigatingstorage-disksandvolumes-volume" id="investigatingstorage-disksandvolumes-volume"></a>

Volume refers to a storage unit within a disk that organizes and manages data. It functions as a logical partition and can be formatted with a file system, allowing users to store and access files. Although a single disk can contain multiple volumes, each volume operates independently, providing additional flexibility and organization to the storage system.

**Windows**

On Windows, in the **Disk Management** application, the system lists volumes under **Volume.**

<figure><img src="/files/xiuIsgSo9bPwMtK2od79" alt=""><figcaption></figcaption></figure>

**macOS**

In the **Disk Utility** application, the system displays volumes under the media they belong to.

<figure><img src="/files/5SPRCwspUnSo1Onntcjg" alt="" width="544"><figcaption></figcaption></figure>

Using the `diskutil list` command in macOS shows volumes beneath their respective disk drives, with identifiers like `/dev/disk0s1`, `/dev/disk0s2`, ...

<figure><img src="/files/xZKuSI6uZ58LAgA7a9qZ" alt=""><figcaption></figcaption></figure>

### NQL examples <a href="#investigatingstorage-disksandvolumes-nqlexamples" id="investigatingstorage-disksandvolumes-nqlexamples"></a>

<details>

<summary>List the system drive (volume/partition) free space on devices.</summary>

```
devices during past 7d
| include volumes 
| where system == true 
| compute system_drive_free_space = capacity.sum() * (1 - usage.sum()) 
| list device.name, system_drive_free_space
```

</details>

<details>

<summary>List the system drive usage on devices.</summary>

```
devices during past 7d 
| include device_performance.events during past 7d 
| compute system_drive_used = event.system_drive_usage.avg() 
| list device.name, system_drive_used 
| sort system_drive_used desc
```

</details>

<details>

<summary>List devices with less than 5GB available on the system drive.</summary>

```
devices during past 7d
| include volumes 
| where system == true 
| compute system_drive_free_space = capacity.sum() * (1 - usage.sum()) 
| where system_drive_free_space < 5GB 
| list device.name, system_drive_free_space
```

</details>

<details>

<summary>List a summary of the disks and volume of devices.</summary>

```
devices during past 7d 
| list device.name, disks, volumes 
```

</details>

<details>

<summary>List all disks from all devices with their size, bootable status and type (SSD or HDD).</summary>

```
disks during past 7d
| list device.name, name, is_bootable, capacity , type 
```

</details>

**Working with custom fields**

If you use a specific NQL query often, consider creating a custom field.

<figure><img src="/files/uXpEgsUlEUssPSJ3h4fA" alt="" width="544"><figcaption></figcaption></figure>

Find more information about custom fields on the [Custom fields management](/platform/~/changes/Sh4xqs4GDClkDKT9Hvux/user-guide/administration/content-management/custom-fields-management.md) page.

<details>

<summary>Using a custom field in an NQL query to list devices with less than 5GB available on the system drive.</summary>

```
devices 
| where #system_drive_free_space < 5GB 
| list device.name, #system_drive_free_space
```

</details>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.nexthink.com/platform/~/changes/Sh4xqs4GDClkDKT9Hvux/references/investigating-storage-disks-and-volumes.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
