13

I have a bootable FreeBSD drive that I'm using to wipe the contents of a hard drive before donating the PC to my local thrift store. I'm using the following command to achieve this:

dd if=/dev/urandom of=/dev/[drivename] bs=64k

Let's say hypothetically the hard drive has either corrupt sectors or areas that are physically damaged. Would those sectors be overwritten with the above command? Or would it be possible to still extract data from the sectors that are damaged or that are corrupt?

8
  • 9
    You have a security concern and are about to donate a broken computer. Just pull the drive, so they can skip the step of installing onto a bad disk and have to get a new one anyway.
    – Mazura
    Aug 13, 2023 at 18:13
  • 3
    en.wikipedia.org/wiki/Boots_theory - It's expensive to be poor. Someone's going to drop forty bucks on a computer that's going to work for a month. That's more than I pay and I have an actual rig.
    – Mazura
    Aug 13, 2023 at 18:53
  • 1
    The concept of "corrupt sectors" is interesting, since the term is normally used either in the context of "this file is corrupt" or "this filesystem is corrupt". I have definitely seen hardware-level corruption where addresses are written in the factory and never regenerated so are relatively fragile, but I don't know whether that's done these days. The usual case is that an area starts showing an excessive number of correctable errors due to a manufacturing defect, i.e. /definitely/ a "physically damaged" scenario, and the risk is that when it's remapped the original data isn't wiped. Aug 13, 2023 at 18:53
  • 8
    Unless you have data on that corrupt sector that might send somebody to jail for life, or cause the downfall of a major government, I would say don't sweat it. Recovering data from corrupt sectors requires specialised hardware, and the motivation to put in a lot of work -- unlikely for a random PC somebody picks up for $50. I would say you have done due diligence on your data, and can sleep easy. (Of course if your disk does contain such data, then why are you even asking?)
    – TonyK
    Aug 14, 2023 at 0:05
  • 5
    Buy a new 256GB SSD (they are dirt cheap nowadays), put it in the donor PC, take the HDD and drill holes in it, then throw it in the bin.
    – Ian Kemp
    Aug 14, 2023 at 8:33

7 Answers 7

18

This a type of question that depends on point of view:

At some point a damaged sector can not be read from or written to. But a hard drive is designed with the idea that bad sectors can happen at some point.

This would have consequences if there wasn't a mechanism in place to deal with such sectors: Assume the sector at LBA address turs bad, we'd all of a sudden have a hole in our sequential LBA address space. To counter this hard drives maintain a pool of spare sectors. Once the hard drive discovered the sector at LBA 100 for example has issues, it can remap LBA 100 to a spare sector and take the original sector out of commission.

So, no you will not be able to write to LBA 100, that is the original sector, however since the drive will map LBA address to a spare sector you can write to LBA 100 after all. So it will appear you can write to the sector as long as the drive has spare sectors available while you're in fact writing to a different physical sector.

There's a few conditions that will trigger the drive to deal with a bad sector:

  • Error on read. The hard drive will attempt to recover the data from the sector and if it succeeds it may decide to remap the sector. If it can not the sector becomes 'pending' (you can see this in SMART - Pending). It will only remap a pending sector on write.
  • Error on write. If the drive decides a sector can not be reliably used it will remap the sector (You can see this in SMART - Reallocated).

This drive has already been reallocating sectors and there's also pending sectors. Pending sectors will go away if you write to them:

enter image description here

About recovering data, or extracting as you say, data from bad sectors:

The best 'tool' to get data from bad sectors is the hard drive itself. If a drive can not read a sector it will apply all sorts of error recovery tricks without you even having to ask for it. This can take as much time as 20 seconds per sector. It's why people often complain about 'unstable' drives being slow; the drive is simply trying very hard to recover the data from a problematic sector.

Software specialized in recovery of data from such sectors can only do a few things:

  • Ask the drive to try again.
  • Try Long Reads (even though this feature was dropped from the ATA specification long ago). Normally if a drive can't read a sector you will not get any data, just an error. Using the Long Read command you basically tell the drive, give me any data you can read, even if you think it's wrong.
  • Some times it may appear sectors can't be read due to them being bad, while it is some other issue plaguing the drive, a firmware issue for example. In such a case specialized data recovery tools, often a combination of hard and software, may be able to help read those sectors.
  • Usually a data recovery tool will be used to image a drive in multiple passes, where the first pass tries to skip bad sectors as much as possible while each subsequent pass spends more time on the bad sectors. But again, often enough you'll encounter sectors that simply can not be read from.

EDIT: If this is about overwriting data and hitting a bad sector, same mechanisms apply:

If drive discovers a bad sector during the wipe it will be reallocated. Some may argue this is unsafe, or a possible attack vector since the original sector is taken out of commission and thus is not overwritten.

However recovery is unlikely:

  • Access to sectors not mapped to LBA requires quite expensive tools like PC3000.
  • Even then, a bad sector can not be read, that's what defines it as a bad sector. The chance that even with PC3000 the sector data can be recovered is very small.
  • Original data in any sector that is successfully written to (so overwritten) is beyond recovery despite popular myth in which it is believed data can be reconstructed from vague residual traces and whatnot (this claim is bound to be made at some point in this type of threads).

If the drive supports enhanced erase then that would be your best option to securely erase all sectors, including the ones already reallocated.

4
  • 2
    The original poster is asking about wiping a drive before donation. Meaning, if there is a bad sector, the only data the dude wants to write is /dev/urandom; he doesn’t want to read it. But is just curious as what a wipe command, like the one he posted, would do. It wouldn’t write to such a bad sector. But any stray data that is still there is detached from the now wiped file. Making the data useless. Aug 13, 2023 at 0:52
  • 3
    Thank you, it seems I read the question poorly. Aug 13, 2023 at 1:38
  • 5
    I think that myth about recovering after blanking with zeros used to be true but just isn't anymore. The original explanation involved reading the data using an oscilloscope, which tells you its age and also something about the storage density at the time.
    – Joshua
    Aug 14, 2023 at 1:53
  • 2
    @Joshua, I blame CSI ;) Aug 14, 2023 at 19:18
8

To a large extent, the question depends on whether "bad" means that the operating system has marked it as such, or whether the drive's firmware considers it unusable.

In the first case, a lower-level tool might be able to overwrite it.

In the second, the bad area has been marked as unusable and possibly been replaced from a reserve pool, these are firmware operations and there's a real possibility that the "bad" area cannot be overwritten except using a special hardware tool.

If the entire storage area has not been wiped and reformatted at the hardware level, it is likely that a determined and well-funded adversary could recover information from it. Historically, top-level forensic equipment could recover traces of the original data even after a hardware wipe since there were residual traces of the clock/data transitions visible as very faint analogue signals.

Operations at the firmware or OS levels will not prevent that.

Ultimately, the only way to wipe a drive is with a hammer and a furnace.

5

As I am not sure about the behaviour in one setting the following cases apply:

SSD

There is no fixed mapping between the sector(s) that you are trying to erase and the flash block(s) that is used to store the content of those sector(s).

As flash blocks have a limited lifetime in terms of write cycles the firmware of the SSD has to remap flash blocks once they have reached their end of life. This remap operation is not an accident, it is part of regular wear treatment. This aging or wear process is reflected in the change of certain SMART attributes depending on the manufacturer. After remapping you can't reach those sectors anymore by means of your operating system. Specialized tools seem to be able to do that, though.

The anti-forensic splitter in the LUKS encryption system was built to counter such effects.

HDD

The mapping between sector numbers and physical sectors is typically static with the exception of errors that seem to occur at the end of life of the HDD. Pending sectors seem to rise like the volume of an avalanche. The remapping of pending sectors triggered by a write operation to a pending (unreadable) sector makes this sector unavailable to the operating system. Look at the RAW figure for the reallocated sector count (SMART attribute) to determine the extent of what became unaccessible for you.

What I can't tell is if a write operation to a pending sector will trigger a last write attempt to this sector (which might result in a write success) or if the sector will be immediately remapped.

Conclusion

Remapping prevents your erasing efforts for both HDDs and SSDs but remapping is differently distributed over time. The SMART "reallocated sectors" attribute is common for HDDs. You can use it to evaluate how many sectors have become unavailable for overwriting and act accordingly. Given the way of operation of SSDs I would rather physically destroy them than rely on overwriting their content with random data or zeros.

4
  • 1
    This is not a good answer, as it contains little concrete information and a number of vague allusions to things which might or might not happen or be possible. Aug 15, 2023 at 12:25
  • 1
    You might consider rereading my answer if you don't get the point.
    – r2d3
    Aug 15, 2023 at 16:08
  • 1
    Per your suggestion, I have just carefully re-read your answer. This is not a good answer, as it contains little concrete information and a number of vague allusions to things which might or might not happen or be possible Aug 15, 2023 at 17:37
  • 1
    What kind of "concrete information" do you expect that is missing, please? What exactly in my text is "vague allusions"?
    – r2d3
    Aug 15, 2023 at 18:06
2

Short answer: yes, it is good idea to fill the drive with zeroes or random numbers before selling, giving away or re-purposing.

Advice:

Even better would be to fill the drive with known data and then verify if it reads correctly. The badblocks tool has write/wipe mode for such task:

badblocks -w /dev/disk/by-id/ata-MNFCR-MODEL_SERIANO (tip: do not bother with /dev/sd? files, do address drives within /dev/disk/by-id/ to avoid any confusion). It will write four patters to ensure all the bits on the drive are able to change. The last pattern is 0x00 which is convenient. One can sped up the test by specifying only one pattern using -t 0. As a nice side effect you're also testing your cables and IO controller which can be faulty too.

Alternative way is to make the drive to wipe and check itself on its own, using ATA Secure Erase and then SMART Long Self Test. The advantage is that you're not utilizing OS's resources.

How writing can heal the drive:

Sometimes data on a HDD becomes unreadable not because of physical surface failure but because of improper writing due to random power surge or something. Writing over those sectors fully restores it.

1
  • I would use badblocks -wsv ..., -sv shows progress and more verbose.
    – Mint
    Feb 23 at 4:04
0

The old school answer would be "yes, that is how you tell drive firmware to remap the sector and replace it with a good spare sector".

The even older schooler answer would be "no, you will have to tell your disk controller/operating system to do this remapping" (this does not apply to any hard drives you will find today outside of hard core retrocomputing contexts).

The new school answer would be "if bad sectors cause enough upset to make it through the drive firmware's mitigations, unless you are SURE of the cause, consider the drive bad - there is too much of a risk that whatever created any new bad sectors after the time of manufacturing checkout will create more (eg contamination in the drive, or even worse a domino effect going on), outweighing replacement cost). Also there could be performance degradation if a lot of remapped sectors cause a lot of additional seeks (which are extremely expensive on spinning hard drives).

-1

For an SSD, the linux command blkdiscard can tell the disk to drop it's complete contents. This is a good, secure way of wiping a SSD that doesn't require overwriting, AND will hit all the "inactive" and "spare" blocks, as well as any blocks already marked as "bad"

And its very quick too, at 10-20 seconds.

Downside, this doesn't work for a spinning hard drive, and you need to boot off some other disk.

An overwrite, as per your example won't touch the spare/inactive/bad blocks and in theory the content could be extracted later. The likelyhood of secrets being revealed is low, but not zero so paranoia is reasonable here.

2
  • 2
    It's quick because it 'wipes translator'. It does not actually wipe data immediately although it may seem this way, and so leaves window for recovery using something like PC3000. Aug 14, 2023 at 19:19
  • 1
    @JoepvanSteen well - bother. Should I delete ?
    – Criggie
    Aug 15, 2023 at 2:14
-1

So what you are asking is if the drive has a bad sector, and you attempt to write random junk to it, what happens with the bad sector?

Well, it wouldn’t be written to. But a random bit of data left behind on a bad sector is no concern because it is a random bit of data on a bad sector.

What could one get out of such data? Nothing.

It would have as much recoverable value as a lone, random puzzle piece out of a 1,000,000 piece puzzle.

P.S. If you thinking utterly everything on your hard drive is important to degree that every single shred of a sector is valuable, I don’t know what to say.

In my humble opinion, the odds are in your favor to not worry at all. Paranoia about some random person extracting something valuable left behind in a shred of a bad sector is not helpful and not useful.

5
  • 3
    Sectors are four kilobytes, and a few adjacent marked-bad sectors could easily hold significant amounts of data. And some data which is essential not to leak (e.g. a private key) may not take much space at all. Aug 13, 2023 at 16:59
  • 5
    Giacomo1968, I disagree. An unreadable sector does not mean that its content is completely or just largely random. Unreadable means that the ECC code does not match the content of the sector. Depending on the relation of the size of the ECC code area (small) to the sector size (big) a certain (big)? percentage of bits may be OK. Now try to change bits of a README.TXT file randomly with varying intensity, say 0,1%, 1%, 10% of all bits inside to see how much you can read out of it despite the dammage done.
    – r2d3
    Aug 13, 2023 at 18:21
  • 1
    @r2d3 Who cares. A huge hard drive with data that has one bad sector would be practically impossible recover. I highly doubt anything would be read. In reality, practical recovery cannot happen. No need to physically destroy the drive. Aug 14, 2023 at 15:28
  • 2
    More people care more than you think. I don't ask for their reasons. And even you can buy this hard- and software and reading the information that is "practically impossible recover".
    – r2d3
    Aug 14, 2023 at 17:41
  • 1
    @r2d3 If you thinking utterly everything on your hard drive is important to degree that every single shred of a sector is valuable, I don’t know what to say. In my humble opinion, the odds are in your favor to not worry at all. Paranoia about some random person extracting something valuable left behind in a shred of a bad sector is not helpful and not useful. Aug 14, 2023 at 23:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .