LVM: reading the contents of just a part of the LVM...

s2cuts · 03-17-2010, 11:10 PM

I'm trying to figure out how easy it would be to read the contents of a physical disk that was part of a larger logical volume. The disk contains a "Linux LVM" partition that spans its entire size.

My problem is that one of my disks died, and I have to send it back for a warranty replacement. However, the disk is dead, and I can't zero it out. I'm just trying to assess how difficult it would be (or at least how likely it would be) for a tech that's checking out the disk to get at the data.

Thanks for any help.

smoker · 03-18-2010, 06:30 AM

It's unlikely that it will even get looked at. It probably will go straight into a skip. The metadata for the LVM won't be there so they will have to use forensic tools to examine it.

s2cuts · 03-18-2010, 12:17 PM

Quote:

Originally Posted by smoker

It's unlikely that it will even get looked at. It probably will go straight into a skip. The metadata for the LVM won't be there so they will have to use forensic tools to examine it.

Thanks smoker, that's music to my ears (or eyes as it were).

Does anybody else want to weigh in?

frndrfoe · 03-18-2010, 12:58 PM

It would be trivial to recover files from the disk using something like Foremost as long as the disk spins and is readable. If it is physically damaged you may have to replace the circuit board or swap the platters into a working drive. At that point you have to determine the "value of privacy" of the content on the drive and act accordingly.
Keep in mind that people in forensics often buy used hard drives just for forensic exercises.
Do you trust them to shred the drive? I wouldn't, that costs money.

smoker · 03-18-2010, 01:19 PM

@frndrfoe
If the disk spins and was readable he wouldn't be throwing it out.

And how many faulty drives do they get back every day ?
My friend worked on laptop repair for a well known company, and if they got returns, they went in the bin. They were literally walking around on top of laptop motherboards that had been discarded.
Your drive is not likely to be the one out of hundreds that they decide to take to pieces and rebuild just to see if there's something on it.