Avoiding Partition Probes
 

Firstly, I'm feeling honored being here.


When a usb Hard Drive is attached I guess that (basically) kernel detects drive features (size, model, etc.), then it starts partitions table detection. After that udev creates correspondent block devices in /dev/ directory. Am I right?

How to prevent any kind of partition probes when a HDD is detected by a booted up system, in a way that it only detects basic drive features as model, sector size and capacity, consequently creating just one block device as /dev/sda?

It's about a data recovery experience with a damaged HDD that sectors corresponding to partition table should not being read.


Sorry about my poor english.


Thanks in advance.

William.

Depends on OS you're using, but most will NOT mount the drive automatically. When you attach the disk, it will create the /dev/sdX and nothing else.

If your OS does mount the drive automatically, you can always get into init 3 (no GUI) and work there. Typically all the auto-mount features are only present in init 5.

I'm not talking about auto-mount, it's already disabled. The sectors linked to partitions table shouldn't even be read. They're on a scratched area. When heads pass over there, drive crashes. I need to disable partitons detection. Look...

Dmesg Output

Oct 13 16:21:42 wks-01 kernel: [ 904.788084] ...ready
Oct 13 16:21:42 wks-01 kernel: [ 906.796660] sd 8:0:0:0: [sdb] 1953525167 512-byte logical blocks: (1.00 TB/931 GiB)
Oct 13 16:21:42 wks-01 kernel: [ 906.796670] sd 8:0:0:0: [sdb] 2048-byte physical blocks
Oct 13 16:21:42 wks-01 kernel: [ 906.862030] sd 8:0:0:0: [sdb] Write Protect is off
Oct 13 16:21:42 wks-01 kernel: [ 906.862036] sd 8:0:0:0: [sdb] Mode Sense: 4f 00 00 00
Oct 13 16:21:42 wks-01 kernel: [ 906.862752] sd 8:0:0:0: [sdb] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA
Oct 13 16:21:42 wks-01 kernel: [ 906.915646] sdb: sdb1


Udev Output

KERNEL[906.915935] add /devices/pci0000:00/0000:00:1d.7/usb8/8-3/8-3:1.0/host8/target8:0:0/8:0:0:0/block/sdb (block)
KERNEL[906.915999] add /devices/pci0000:00/0000:00:1d.7/usb8/8-3/8-3:1.0/host8/target8:0:0/8:0:0:0/block/sdb/sdb1 (block)
UDEV [907.060915] add /devices/pci0000:00/0000:00:1d.7/usb8/8-3/8-3:1.0/host8/target8:0:0/8:0:0:0/block/sdb (block)
UDEV [907.392087] add /devices/pci0000:00/0000:00:1d.7/usb8/8-3/8-3:1.0/host8/target8:0:0/8:0:0:0/block/sdb/sdb1 (block)


Thanks for replying.

I think you are out of luck.
The driver for that device will be issuing the ioctls to create the base device nodes - including for partition(s). Without the driver you can't talk to the device at all. udev merely reacts to the kernel uevents.

Then again, reading the partition table does not necessarily mean the rest of the disk is read. At least in case of MBR.

True, at least for primary partitions, but the nodes in /dev/disk/by-{id,label,uuid} require probing the content of the partition to get the needed parameters. I can see where udev rules use the parameters, but I don't see what establishes the values.

Trashing udev and switching to static /dev would help. There is even a tutorial how to do it in Gentoo.

I guess kernel recognizes partitions as soon as a drive is plugged in, so after that udev creates /dev/* files... I mean partition table is read by kernel and HDD heads runs over the damaged area. I don't think udev can stop that kernel routine.

What do you think?

Thanks.

You can build partition table support as module, then kernel can't load it at boot time and won't scan the drives. You have to figure out from what media to boot it that does not require MBR/GPT support in kernel. CD/DVD would work, I guess. My 2¢.

nfsroot could also work. Even if you don't go with a full PXE diskless boot setup, you can set up a custom grub2 entry to boot up to an nfs root.

http://www.linuxquestions.org/questi...-jessie-37127/

While grub2 will load up with sufficient support to detect and load the initrd etc from a local hard drive partition, it's not necessary for the loaded kernel to have any support for partitions at all. It only needs the nfs client.

Note that you don't need to mess around with your DHCP server or settings to do this. You just need to set up any computer on the same LAN with an nfs share.

Or you could even leave out the support for HDD controller(s) and boot the kernel from USB. Just thinking, I haven't tested such a setup. You still need SCSI layer enabled, even USB block device access goes thru it nowadays.