0

Some background: I paid up person in my local area to install a live USB to two jump drives for my own use some time ago.

I never used them. I did however load them up this morning because I'm trying to reset my OS. And I noticed that once I deleted the partitions containing the Ubuntu OS that there was a PVE from proxmox remaining on the entire drive. Which is weird to me because I've never seen partitions have a partition appear once they're deleted. The other thing is this drive is not at full capacity for that partition I think there's a hidden partition, but I'm not sure The difference is like almost 2 gigabytes.

This person claimed that because the USB is 2.0 they would take longer to produce the two jump drives. I thought huh that's a little funny, I didn't know writing a live USB took that long.

I have a background in computer science and I am very familiar with computers just not Linux. I don't know what proxmox PVE is or what its used for exactly. I do however understand from a Google search that it's a hypervisor for Linux. Which tells me this is probably a virtual partition that contained the live USB.

My questions now are: why does this expansive partition exist and does it appear at malicious to you based on this description? I'm getting very suspicious of this drive.

Edit/Clarifiation: What legitimate possible uses might exist for using ProxMox PVE to install the linux live to my USB drives and what possibly malicious actions made may exist?

Improve this question
6
  • We can't answer that without knowing what the drive contains. It may be a simple error of some sort, or it may be malicious. To find out, a forensic examination has to be done. We can't do that for you.
    – vidarlo
    Nov 19 at 18:29
  • What was the method you used to delete the partitions?
    – u1686_grawity
    Nov 21 at 6:27
  • @vidarlo I mentioned what it contains already. Maybe my method of explanation was inadequate... point being. The partitions I deleted were contained within the PVE partition. I discovered the PVE partition only after deleting the linux live usb partitions. I guess the real question here is are there any potentially malicious actions that could have been made by using PVE to install a liveusb by a third party and barring that what legitimate actions might have been made by that party using PVE?
    – user22945870
    Nov 21 at 15:51
  • @u1686_grawity I used ubuntu 22.04's 'disks' application to delete them which then revealed the PVE partition spanning the vast majority of the drive.
    – user22945870
    Nov 21 at 15:52
  • Proxmox, pve.proxmox.com/wiki/Main_Page, seems like a legitimate installation tool. That said, there are free virtual machine setups, such as Oracle's VirtualBox, and I do not know the advantages of one over the other.
    – DrMoishe Pippik
    Nov 21 at 16:09

1 Answer 1

Reset to default
0

The other thing is this drive is not at full capacity for that partition I think there's a hidden partition, but I'm not sure The difference is like almost 2 gigabytes.

That's fairly normal; the whole partition table likely came with the image (most "live" Linux images are pre-partitioned whole-disk images) and it was tailored for the smallest supported USB stick. For example, a 2 GB image would have partitions that fit in that 2 GB resulting in empty space when written to a larger device.

It's the least weird thing about live images; often they're built to act simultaneously as disk images and CD images, with two or three overlapping partition tables depending on how the computer looks at it.

And I noticed that once I deleted the partitions containing the Ubuntu OS that there was a PVE from proxmox remaining on the entire drive. Which is weird to me because I've never seen partitions have a partition appear once they're deleted

Writing a new image usually does not remove all previous data if the image is smaller than the target disk. As mentioned, many pre-made images are small so that they could fit into any kind of USB stick; so for example, if you write a 1GB image to a 8GB disk, it'll overwrite just the 1GB while the remaining 7GB will keep the same data as before, even if it's now no longer attached to any partition.

In particular, my main guess is that the disk had two partition tables, with Proxmox having used GPT-style partitioning before it was overwritten with Ubuntu which probably had a MBR-style partition table, at which point only the primary GPT table was overwritten but the backup at the end was not (maybe because the Ubuntu image was also small).

One of the features GPT has is the 'backup' partition table that exists at the end of the disk, and it is normally ignored, but if you manually remove the main partition tables (both MBR and GPT) from the beginning of the disk, then the backup GPT will "come back to life" with whatever partitions were defined previously – this won't bring back contents that the new image had overwritten, but it can certainly cause old partition names to show up.

The actual explanation is difficult to give without knowing what the disk originally had, how Ubuntu was installed on it, and what exactly was done to it after.

This person claimed that because the USB is 2.0 they would take longer to produce the two jump drives. I thought huh that's a little funny, I didn't know writing a live USB took that long.

They're technically correct; it indeed takes around 4-5× longer to write the same amount of GB through a 2.0 connection than a 3.x one.

For an average-size live image, it might be 4-5 minutes through 2.0 versus one minute through 3.x. (They didn't actually say "hours" or "days", did they?)

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .