LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 03-16-2013, 04:50 PM   #1
Automatic
Member
 
Registered: Mar 2013
Posts: 42

Rep: Reputation: Disabled
Writing /dev/zero to a drive with DD still leaves data?


I'm new to everything linux & everything HDD related, and, I've been messing around with a few commands. I wiped a disk with dd because I wanted to try it using:-

Code:
dd if=/dev/zero of=/dev/sdc
where SDC is a drive I didn't really care about, after awhile it gave me "Drive out of space", which, sounds like a good thing (Copied zeros until disk was full), however, around an hour later I was messing around with hdparm and the --read-sector command, I noticed that at the top of every sector it had the exact same start:-

Code:
/dev/sdc:
reading sector 123312: succeeded
2e2e 642f 7665 6369 7365 702f 6963 3030
3030 303a 2f30 3030 3030 303a 3a30 6331
332e 302f 3030 3a30 3430 303a 2e30 2f30
7375 3362 332f 312d 332f 312d 313a 302e
682f 736f 3674 742f 7261 6567 3674 303a
303a 362f 303a 303a 303a 622f 6f6c 6b63
732f 6364 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
automatic@automatic-G74Sx:~$ sudo hdparm --read-sector 123311 /dev/sdc

/dev/sdc:
reading sector 123311: succeeded
2e2e 642f 7665 6369 7365 702f 6963 3030
3030 303a 2f30 3030 3030 303a 3a30 6331
332e 302f 3030 3a30 3430 303a 2e30 2f30
7375 3362 332f 312d 332f 312d 313a 302e
682f 736f 3674 742f 7261 6567 3674 303a
303a 362f 303a 303a 303a 622f 6f6c 6b63
732f 6364 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
automatic@automatic-G74Sx:~$ sudo hdparm --read-sector 123310 /dev/sdc

/dev/sdc:
reading sector 123310: succeeded
2e2e 642f 7665 6369 7365 702f 6963 3030
3030 303a 2f30 3030 3030 303a 3a30 6331
332e 302f 3030 3a30 3430 303a 2e30 2f30
7375 3362 332f 312d 332f 312d 313a 302e
682f 736f 3674 742f 7261 6567 3674 303a
303a 362f 303a 303a 303a 622f 6f6c 6b63
732f 6364 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
The drive shouldn't of had anything written to it since the wipe (Not really touched it, unless my distro (Left side of my post, apparently my user-agent gave it away)/some software did it automatically), so, can I ask what the sector data means?

I presume it does mean something, anyway.

Thanks, Automatic.

Last edited by Automatic; 03-16-2013 at 04:55 PM.
 
Old 03-16-2013, 06:05 PM   #2
John VV
LQ Muse
 
Registered: Aug 2005
Location: A2 area Mi.
Posts: 16,818

Rep: Reputation: 2408Reputation: 2408Reputation: 2408Reputation: 2408Reputation: 2408Reputation: 2408Reputation: 2408Reputation: 2408Reputation: 2408Reputation: 2408Reputation: 2408
you zeroed out the data
not the partition table or the sector headers

also it normally is a good idea to also add the block size
bs=512k is default and dose not need stating

but larger drives can use bs=1024 or bs=2048

see the manual page for dd
Code:
man dd
or the online
http://www.gnu.org/software/coreutil...nvocation.html
 
Old 03-16-2013, 06:07 PM   #3
Automatic
Member
 
Registered: Mar 2013
Posts: 42

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by John VV View Post
you zeroed out the data
not the partition table or the sector headers

also it normally is a good idea to also add the block size
bs=512k is default and dose not need stating

but larger drives can use bs=1024 or bs=2048

see the manual page for dd
Code:
man dd
or the online
http://www.gnu.org/software/coreutil...nvocation.html

Say I did want to go about erasing the partition table & sector headers, how would I go about doing that? Would anything ill come of it?
 
Old 03-16-2013, 06:13 PM   #4
syg00
LQ Veteran
 
Registered: Aug 2003
Location: Australia
Distribution: Lots ...
Posts: 14,838

Rep: Reputation: 1822Reputation: 1822Reputation: 1822Reputation: 1822Reputation: 1822Reputation: 1822Reputation: 1822Reputation: 1822Reputation: 1822Reputation: 1822Reputation: 1822
Contrary to the above, you actually did wipe out the MBR/partition table. Some of the tools might object as they can't find the disk signature - try a few and see.
The actual requirements for the hardware/microcode I have no knowledge of - but as stated above you wiped all the user accessible data.
 
Old 03-16-2013, 06:15 PM   #5
Automatic
Member
 
Registered: Mar 2013
Posts: 42

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by syg00 View Post
Contrary to the above, you actually did wipe out the MBR/partition table. Some of the tools might object as they can't find the disk signature - try a few and see.
The actual requirements for the hardware/microcode I have no knowledge of - but as stated above you wiped all the user accessible data.
I was wondering that due to the last line of fdisk:-

Code:
Disk /dev/sdc doesn't contain a valid partition table
And, in fact, I assume that the sector headers (After reading wikipedia) are impossible to write to and are generated by the disk's controller? Also contain no personal information? Just parity (Which will result in 0x0) & sector information (Like location).

Last edited by Automatic; 03-16-2013 at 06:16 PM.
 
Old 03-16-2013, 06:46 PM   #6
hal8000b
Member
 
Registered: Mar 2001
Location: UK
Distribution: Mint, Arch, Debian7
Posts: 184

Rep: Reputation: 22
Quote:
Originally Posted by Automatic View Post
I was wondering that due to the last line of fdisk:-

Code:
Disk /dev/sdc doesn't contain a valid partition table
And, in fact, I assume that the sector headers (After reading wikipedia) are impossible to write to and are generated by the disk's controller? Also contain no personal information? Just parity (Which will result in 0x0) & sector information (Like location).

I'm not sure which page on Wikipedia you've been reading.
Your disk drive will contain an Intel partition table. The partition table is created and wrote to the hard disk, with a partition program like linux fdisk, cfdisk or sfdisk.

http://en.wikipedia.org/wiki/Master_boot_record


If you use a MAC or a moderm computer with UEFI BIOS then it will contain a GPT partition table. Gparted in linux can create GPT tables

http://en.wikipedia.org/wiki/GUID_Partition_Table
 
Old 03-16-2013, 07:20 PM   #7
rknichols
Senior Member
 
Registered: Aug 2009
Distribution: CentOS
Posts: 2,959

Rep: Reputation: 1268Reputation: 1268Reputation: 1268Reputation: 1268Reputation: 1268Reputation: 1268Reputation: 1268Reputation: 1268Reputation: 1268
Something is very wrong. The sector headers are entirely internal to the drive. You can neither write nor read them. The output from "hdparm --read-sector" (I see that it does show exactly 512 bytes) should have been all-zeros.

Is this drive connected via USB? It might be that the USB<>SATA interface chip does not properly handle the low-level read commands from hdparm. What do you see when you run "dd if=/dev/sdc count=10 | hexdump" ?

I've seen weird things happen on a system where /dev/null got replaced by an ordinary file. Does "ls -l /dev/zero" show a character-special device with major and minor device numbers "1, 5"?
Code:
# ls -l /dev/zero
crw-rw-rw-. 1 root root 1, 5 2013-03-14 15:48 /dev/zero
What do you see when you run "dd if=/dev/zero count=1 | hexdump" ?

Last edited by rknichols; 03-16-2013 at 07:27 PM.
 
1 members found this post helpful.
Old 03-16-2013, 07:35 PM   #8
linosaurusroot
Member
 
Registered: Oct 2012
Distribution: OpenSuSE,RHEL,Fedora,OpenBSD
Posts: 979
Blog Entries: 2

Rep: Reputation: 235Reputation: 235Reputation: 235
Quote:
Originally Posted by John VV View Post
normally is a good idea to also add the block size bs=512k is default
512 BYTES is the default and is so small you normally want to set something larger.

Last edited by linosaurusroot; 03-16-2013 at 07:37 PM.
 
Old 03-16-2013, 07:39 PM   #9
Automatic
Member
 
Registered: Mar 2013
Posts: 42

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by rknichols View Post
Something is very wrong. The sector headers are entirely internal to the drive. You can neither write nor read them. The output from "hdparm --read-sector" (I see that it does show exactly 512 bytes) should have been all-zeros.

Is this drive connected via USB? It might be that the USB<>SATA interface chip does not properly handle the low-level read commands from hdparm. What do you see when you run "dd if=/dev/sdc count=10 | hexdump" ?

I've seen weird things happen on a system where /dev/null got replaced by an ordinary file. Does "ls -l /dev/zero" show a character-special device with major and minor device numbers "1, 5"?
Code:
# ls -l /dev/zero
crw-rw-rw-. 1 root root 1, 5 2013-03-14 15:48 /dev/zero
What do you see when you run "dd if=/dev/zero count=1 | hexdump" ?
Yes, it is connected via a USB socket, it's a 4GB flash drive (Yeah, I know, don't waste precious flash write data, etc, etc, don't defragment them, etc, etc, etc) that I happened to have laying around with no important data on it, considering you got it first try I assume that means it's a pretty common issue with flash drives.

Running DD & hexdump results in (had to re-zero the drive (with count=20, just to be sure it's greater than count=10), I had done other stuff with it since):-
Code:
automatic@automatic-G74Sx:~$ sudo dd if=/dev/sdc count=10 | hexdump
0000000 0000 0000 0000 0000 0000 0000 0000 0000
*
10+0 records in
10+0 records out
5120 bytes (5.1 kB) copied, 0.0070375 s, 728 kB/s
0001400
automatic@automatic-G74Sx:~$
And running the ls command does result in 1, 5, although, I presume where you said "System where /dev/null got replaced" you mean /dev/zero, if not, fill me in?

Only thing however is that the hexdump seems extremely small (512*10=5,120, quite a few bytes compared to what it returned), I'm not really sure as to why it's only one line.
 
Old 03-16-2013, 08:06 PM   #10
rknichols
Senior Member
 
Registered: Aug 2009
Distribution: CentOS
Posts: 2,959

Rep: Reputation: 1268Reputation: 1268Reputation: 1268Reputation: 1268Reputation: 1268Reputation: 1268Reputation: 1268Reputation: 1268Reputation: 1268
hexdump suppresses consecutive identical lines and just shows an asterisk. Your output shows that the 5120 bytes were indeed all zeros. So, there is no problem with /dev/zero, and your drive has indeed been zeroed, but the drive is not properly handling the low-level read command from hdparm.

No, I did mean "/dev/null". It was an example of something that can go wrong, and there was an off chance that something similar might have happened to /dev/zero, though I would expect dire results for the rest of your system if that were indeed the case.

Incidentally, that non-zero data represents a string of ASCII characters:
Code:
../devices/pci0000:00/0000:00:1c.3/0000:04:00.0/usb3/3-1/3-1:1.0/host6/target6:0:0/6:0:0:0/block/sdc
Looks like something left over in a buffer when hdparm was finding the device in /sys and not something returned from the flash drive at all.
 
1 members found this post helpful.
Old 03-16-2013, 08:08 PM   #11
Automatic
Member
 
Registered: Mar 2013
Posts: 42

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by rknichols View Post
hexdump suppresses consecutive identical lines and just shows an asterisk. Your output shows that the 5120 bytes were indeed all zeros. So, there is no problem with /dev/zero, and your drive has indeed been zeroed, but the drive is not properly handling the low-level read command from hdparm.

No, I did mean "/dev/null". It was an example of something that can go wrong, and there was an off chance that something similar might have happened to /dev/zero, though I would expect dire results for the rest of your system if that were indeed the case.

Incidentally, that non-zero data represents a string of ASCII characters:
Code:
../devices/pci0000:00/0000:00:1c.3/0000:04:00.0/usb3/3-1/3-1:1.0/host6/target6:0:0/6:0:0:0/block/sdc
Looks like something left over in a buffer when hdparm was finding the device in /sys and not something returned from the flash drive at all.

Fair enough, thanks a lot!
 
Old 03-16-2013, 08:12 PM   #12
linosaurusroot
Member
 
Registered: Oct 2012
Distribution: OpenSuSE,RHEL,Fedora,OpenBSD
Posts: 979
Blog Entries: 2

Rep: Reputation: 235Reputation: 235Reputation: 235
Also the block of data you've shown comes out as this:
Quote:
../devices/pci0000:00/0000:00:1c.3/0000:04:00.0/usb3/3-1/3-1:1.0/host6/target6:0:0/6:0:0:0/block
So I suggest you've re-added some formatting somehow after wiping the disk
or wiping got interrupted unfinished
or you're looking somewhere different from what was wiped
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Writing to NFS share leaves local copy of files Mark_667 Programming 2 06-21-2012 06:40 AM
Writing data to /dev/usb/lp0 kewl Linux - Newbie 1 07-07-2010 11:10 AM
using flash drive changes device /dev/sr0 to /dev/sr1 for mapping to /dev/pktcdvd/0? lugoteehalt Linux - Software 3 10-24-2007 11:27 AM
Formatting hard drive leaves out bits?? Pedroski Linux - Hardware 10 05-16-2007 03:28 PM
I cannot access EITHER CD drive! And there's no /dev/hdc or /dev/hdd or /dev/cdrom! Dmalic Linux - Hardware 13 11-18-2005 08:11 PM


All times are GMT -5. The time now is 08:39 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration