Home / ubuntu / Questions / 970068
In Process
Justin
Asked: 2017-10-28 19:07:45 +0800 CST

secure erase with hdparm - can still see file content

  • 772

I downloaded latest stable Ubuntu (ubuntu-16.04.3-desktop-amd64.iso image that I double checked for authenticity) and used it to boot my new Win10 system which I wanted to wipe. I followed the instructions, like those at

https://ata.wiki.kernel.org/index.php/ATA_Secure_Erase

to unfreeze the drive and wipe it using the

time hdparm --user-master u --security-erase ... /dev/sda3

command. In fact I ran it another time (after resetting the drive password) and running with --security-erase-enhanced option second time (thanks to http://www.stevenmaude.co.uk/posts/securely-erasing-frozen-hard-disks-with-hdparm instructions).

It took almost 2 hours each time to go through the erase process. At the end, no errors were printed out. 0's were shown for various times, like 0 cpu time and 0 system time. Only the elapsed time was showing ~2 hours.

After those two runs, I was still able to open random text and xml files in both Windows and non-Windows directories and look at their contents even though I had not opened them earlier in that same Ubuntu session, so it could not have cached them!

then...

  • I could no longer boot into Windows - guess that's a good sign :-)

  • After restarting computer and loading up Ubuntu again, it no longer auto-mounts /dev/sda3 (or anything else resembling a hard drive). fdisk -l shows the drive but that's about it.

  • Tried loading Paragon bootable CD and it also shows no filesystem.

Any ideas as to what I am missing?

It's almost as if it blew away the entry into the file system but after the two erases it was still able to navigate and find file content in that same session of running Ubuntu. Now I don't seem to be able to see anything because anything I try to run no longer finds starting point for the file system, but I wonder if all the data is still laid out there on disk?!

Thank you!

secure-erase

2 Answers

  1. (OP here) I cannot double check this as I already cleaned out the drive using Active @Killdisk but I ended up following up with developer of hdparm (Mark L.) who indicated that it's likely the issue was related to the fact that my drive was auto-mounted at the time I was performing secure erase. In his own words:

    you MUST unmount anything that got automounted, because stuff that is mounted gets periodically written to by the kernel (filesystem timestamps etc), which could account for some of the non-zero stuff you saw later.

    The "non-zero stuff" he is referring to is the output of sudo xxd -a /dev/sdX command suggested by sudodus earlier on this thread.

    • 4

  2. I think you needed the reboot for the new mapping of the hard disk drive to be seen by the system.

    If you want to, you can try to recover files from the 'drive surface' with PhotoRec,

    http://cgsecurity.org

    or look at the following link,

    Re: best way to wipe a drive

    which also shows checking the result with xxd

    roten@my-precise:~$ sudo hdparm -I /dev/sdb
...
Security: 
    Master password revision code = 65534
        supported
    not    enabled
    not    locked
    not    frozen
    not    expired: security count
    not    supported: enhanced erase
    88min for SECURITY ERASE UNIT. 
Logical Unit WWN Device Identifier: 50000391f340058c
    NAA        : 5
    IEEE OUI    : 000039
    Unique ID    : 1f340058c
Checksum: correct
roten@my-precise:~$ sudo hdparm --user-master u --security-set-pass Eins /dev/sdb security_password="Eins"

/dev/sdb:
 Issuing SECURITY_SET_PASS command, password="Eins", user=user, mode=high
roten@my-precise:~$ sudo hdparm -I /dev/sdb
...
Security: 
    Master password revision code = 65534
        supported
        enabled
    not    locked
    not    frozen
    not    expired: security count
    not    supported: enhanced erase
    Security level high
    88min for SECURITY ERASE UNIT. 
Logical Unit WWN Device Identifier: 50000391f340058c
    NAA        : 5
    IEEE OUI    : 000039
    Unique ID    : 1f340058c
Checksum: correct
roten@my-precise:~$ sudo time hdparm --user-master u --security-erase Eins /dev/sdb security_password="Eins"

/dev/sdb:
 Issuing SECURITY_ERASE command, password="Eins", user=user
0.00user 0.00system 1:11:03elapsed 0%CPU (0avgtext+0avgdata 2432maxresident)k
0inputs+0outputs (0major+200minor)pagefaults 0swaps
...
Security: 
    Master password revision code = 65534
        supported
    not    enabled
    not    locked
    not    frozen
    not    expired: security count
    not    supported: enhanced erase
    88min for SECURITY ERASE UNIT. 
Logical Unit WWN Device Identifier: 50000391f340058c
    NAA        : 5
    IEEE OUI    : 000039
    Unique ID    : 1f340058c
Checksum: correct
roten@my-precise:~$ sudo time xxd -a /dev/sdb
[sudo] password for roten: 
0000000: 0000 0000 0000 0000 0000 0000 0000 0000  ................
1000000000000 0000 0000 0000 0000 0000 0000 0000  ................
2000000000000 0000 0000 0000 0000 0000 0000 0000  ................
3000000000000 0000 0000 0000 0000 0000 0000 0000  ................
54272.57user 343.93system 15:10:36elapsed 99%CPU (0avgtext+0avgdata 2096maxresident)k
488398400inputs+0outputs (0major+179minor)pagefaults 0swaps
roten@my-precise:~$
    • 3