Monday, October 4, 2010

Wiping a Hard Drive in Ubuntu

I had an old ATA (PATA) hard drive that I wanted to wipe and dump. I didn't know if there had ever been anything particularly sensitive on there, but anything is possible, and anyway I wanted to know how to do it in Ubuntu.  This post presents what I learned in that process.

After a preliminary search, I came across this advice:  "The first thing to do is to see if hpa is enabled."  "HPA," according to Thinkwiki, was short for "Hidden Protected Area" or "Host Protected Area."  It was "a special area (usually a few gigabytes in size)."  The recommended way to see if hpa was enabled was to type "sudo hdparm -N /dev/sdx."  I did that and got this:

625142448/4385456(625142448?), HPA setting seems invalid (buggy kernel device driver?)
A search for that error message led to just a dozen or so hits, containing various bits of information.  For instance, thorkelljarl noted that "The HDD utilities supplied by Seagate, Samsung and some other HDD makers can set the HDD capacity and should remove HPA totally."  NeCod suggested trying this:
grep -i HPA /var/log/kern.log
That produced two messages, each beginning with the date and time and then reading as follows:
ubuntu kernel: [    3.076473] ata5.01: HPA unlocked: 625140335 - > 625142448, native 625142448
ubuntu kernel: [    3.482031] ata1.00: HPA unlocked: 156299375 - > 156301488, native 156301488
I wasn't sure what those messages meant.  I thought the system in question might have been confused about the hpa on this drive because I had booted the system using a live Ubuntu CD.  WilliTo offered some advice pertaining to RAID, but the first two steps sounded more generically useful:
1- Disable backup bios to disk in gigabyte bios if enabled
2- Disable HPA with HDAT2 (disk must be in sata mode not raid)
Similarly, that Thinkwiki page said "If the HPA is enabled in the BIOS (mode set to "Normal"), Linux may get confused about the correct partition geometry."  I tried rebooting, hit Del to go into the BIOS settings > Advanced BIOS Features > Dual BIOS Recovery Source.  That didn't have an option to disable this; it just had HPA or Backup BIOS options.  A Launchpad page gave me the impression that this was particularly a Gigabyte motherboard problem:
Virtual BIOS solutions - like GigaByte motherboards use

This is absolutely CRITICAL. When the hd is unlocked and fully used new GigaByte boards tend to write 1.5 MB at the end of IDE or SATA drives in legacy mode as BIOS backup. Then HPA is activated, every OS has to respect this otherwise it will definitely overwrite data. That's usally not directly visable for the user, but it definitely happens. Depending of the filesystem used for the partition using that last mb will immediately kill data or it will take time till it is filled, but corruption is inevitable.
That Launchpad page said that HPA takes only 1.5MB.  But I preferred not to have it there, for purposes of this erasure.  I had seen another note, somewhere, indicating that the person in question was finding that the HPA was more like 8GB.

Going back to WilliTo's advice, I did a search for HDAT2.  According to its homepage, HDAT2 was a "program for test or diagnostics of ATA/ATAPI/SATA, SSD and SCSI/USB devices."  A desultory glance at a few reviews suggested that HDAT2 was an OK program.  My next question was whether I could add it to a BartPE bootable USB stick as one more boot utility, but it looked like UBCD4Win (the Ultimate Boot CD for Windows) and/or UBCD had beat me to it.  Rather than pursue that, however, I found that Darik's Boot And Nuke (DBAN) was a simple and highly recommended bootable eraser, so I went with that.

0 comments: