Re: deleting/writing on a read-only filesystem

classic Classic list List threaded Threaded
6 messages Options
Reply | Threaded
Open this post in threaded view
|

Re: deleting/writing on a read-only filesystem

Bugzilla from leen.meyer@home.nl
On Thursday 03 August 2006 01:43, Greg Freemyer wrote:

> On 8/2/06, Istvan Gabor <[hidden email]> wrote:
> > Hello all:
> >
> > I use suse linux 10.0 default.
> >
> > My hard drive has damaged.
> >
> > (from dmesg:
> > Additional sense: Unrecovered read error - auto reallocate failed
> > end_request: I/O error, dev sdb, sector 8650815  ... etc.)
> >
> >   Whenever the OS can't read something it changes the
> > filesystem mounting as read-only.
> >
> > Since the hard drive still has the warranty I would like to
> > replace it. But before bringing back I'd like to remove some
> > files from the drive.  However I can't write or delete on the
> > damaged harddisk since it always gets mounted as read-only.
> >
> > How could I still erase the drive or force mounting the drive as
> > read-write?
>
> Once your ready to totally wipe the drive, boot from the install CD/DVD.
>
> Then go into rescue mode.
>
> From there you can do something like:
>
> dd if=/dev/zero of=/dev/hdx bs=4k conv=noerror
>
> The above should wipe out 100% of your data, so don't do it until your
> ready.
>
> Also /dev/hdx will need to be set to the correct value for your machine.
>
> FYI: If your paranoid a lot of people claim you need to do multiple
> passes. 3? 7? 35?  All depends who you ask.  Personally, I think 1 is
> fine.

The really paranoid people would do this:

  shred -x /dev/hdx

I did that once with a USB-pendrive. See "man shred" for an explanation.

BTW, it is *thorough*, but be prepared for a loooooooong execution time! You
might have to leave the pc on for the night.

Cheers,

Leen

--
Check the headers for your unsubscription address
For additional commands send e-mail to [hidden email]
Also check the archives at http://lists.suse.com
Please read the FAQs: [hidden email]


Reply | Threaded
Open this post in threaded view
|

Re: deleting/writing on a read-only filesystem

Carl Hartung
On Friday 04 August 2006 15:41, Leendert Meyer wrote:
> The really paranoid people would do this:
>
>   shred -x /dev/hdx
>
> I did that once with a USB-pendrive. See "man shred" for an explanation.

Hi Leen,

I realize you suggested he read the man page for shred, but since this
disclaimer is well towards the bottom, it bears emphasizing:

CAUTION:  Note  that  shred relies on a very important assumption: that
       the file system overwrites data in place.  This is the traditional  way
       to  do  things, but many modern file system designs do not satisfy this
       assumption.  The following are examples of file systems on which  shred
       is not effective:

       * log-structured or journaled file systems, such as those supplied with

              AIX and Solaris (and JFS, ReiserFS, XFS, Ext3, etc.)

regards,

Carl

--
Check the headers for your unsubscription address
For additional commands send e-mail to [hidden email]
Also check the archives at http://lists.suse.com
Please read the FAQs: [hidden email]


Reply | Threaded
Open this post in threaded view
|

Re: deleting/writing on a read-only filesystem

jdd sur free
  be aware also that HD heads are floating and do not always
write at the same place, so its possible to read data on a
disk many times after it have been erased whatever system
you use (of course it needs much and expensive efforts)

so the only effective mean to delete data is a big hammer :-)

jdd

--
http://www.dodin.net
http://dodin.org/galerie_photo_web/expo/index.html
http://lucien.dodin.net
http://fr.susewiki.org/index.php?title=Gérer_ses_photos

--
Check the headers for your unsubscription address
For additional commands send e-mail to [hidden email]
Also check the archives at http://lists.suse.com
Please read the FAQs: [hidden email]


Reply | Threaded
Open this post in threaded view
|

Re: deleting/writing on a read-only filesystem

Bugzilla from leen.meyer@home.nl
In reply to this post by Carl Hartung
On Friday 04 August 2006 21:49, Carl Hartung wrote:

> On Friday 04 August 2006 15:41, Leendert Meyer wrote:
> > The really paranoid people would do this:
> >
> >   shred -x /dev/hdx
> >
> > I did that once with a USB-pendrive. See "man shred" for an explanation.
>
> Hi Leen,
>
> I realize you suggested he read the man page for shred, but since this
> disclaimer is well towards the bottom, it bears emphasizing:
>
> CAUTION:  Note  that  shred relies on a very important assumption: that
>        the file system overwrites data in place.  This is the traditional
> way to  do  things, but many modern file system designs do not satisfy this
> assumption.  The following are examples of file systems on which  shred is
> not effective:
>
>        * log-structured or journaled file systems, such as those supplied
> with
>
>               AIX and Solaris (and JFS, ReiserFS, XFS, Ext3, etc.)

Of course you're quite right. But /dev/hdx does not refer to a file system,
but to the whole (unmounted) disk. So if shred is used that way (/dev/hdx), I
can't share your worries. :)

And, after reading jdd's post, better to /physically/ shred the drive /too/.

Cheers,

Leen

--
Check the headers for your unsubscription address
For additional commands send e-mail to [hidden email]
Also check the archives at http://lists.suse.com
Please read the FAQs: [hidden email]


jhb
Reply | Threaded
Open this post in threaded view
|

Re: deleting/writing on a read-only filesystem

jhb
On Friday 04 August 2006 14:29, Leendert Meyer wrote:

> On Friday 04 August 2006 21:49, Carl Hartung wrote:
> > On Friday 04 August 2006 15:41, Leendert Meyer wrote:
> > > The really paranoid people would do this:
> > >
> > >   shred -x /dev/hdx
> > >
> > > I did that once with a USB-pendrive. See "man shred" for an
> > > explanation.
> >
> > Hi Leen,
> >
> > I realize you suggested he read the man page for shred, but since this
> > disclaimer is well towards the bottom, it bears emphasizing:
> >
> > CAUTION:  Note  that  shred relies on a very important assumption: that
> >        the file system overwrites data in place.  This is the traditional
> > way to  do  things, but many modern file system designs do not satisfy
> > this assumption.  The following are examples of file systems on which
> > shred is not effective:
> >
> >        * log-structured or journaled file systems, such as those supplied
> > with
> >
> >               AIX and Solaris (and JFS, ReiserFS, XFS, Ext3, etc.)
>
> Of course you're quite right. But /dev/hdx does not refer to a file system,
> but to the whole (unmounted) disk. So if shred is used that way (/dev/hdx),
> I can't share your worries. :)
>
> And, after reading jdd's post, better to /physically/ shred the drive
> /too/.
>
> Cheers,
>
> Leen

--
Check the headers for your unsubscription address
For additional commands send e-mail to [hidden email]
Also check the archives at http://lists.suse.com
Please read the FAQs: [hidden email]


Reply | Threaded
Open this post in threaded view
|

Re: deleting/writing on a read-only filesystem

gregfreemyer
In reply to this post by jdd sur free
On 8/4/06, jdd sur free <[hidden email]> wrote:
>   be aware also that HD heads are floating and do not always
> write at the same place, so its possible to read data on a
> disk many times after it have been erased whatever system
> you use (of course it needs much and expensive efforts)
>
> so the only effective mean to delete data is a big hammer :-)
>
> jdd

I would really like to see a definative article from the last 7 or 8
years that supported the above contention.

I know about the often referenced 1995 Gutmann paper.  He basically
said that a lot of drives made in the 80s were so low density and
non-precision it was very hard to "wipe" those without lots of passes.

That early 90's drives were more dense and more precise and thus
easier to wipe with a few passes, but that drives coming on the market
in the mid 1990s were so dense and precise and were using multi-bit
encoding techniques that he could not envision any data recovery after
even a single pass with that class of drive.

Unfortunately, I have not seen any whitepaper etc. that discusses data
recovery from newer generation drives.  ie. anything 4GB or larger
probably is too new to be covered by the Gutman paper.

Greg
--
Greg Freemyer
The Norcross Group
Forensics for the 21st Century

--
Check the headers for your unsubscription address
For additional commands send e-mail to [hidden email]
Also check the archives at http://lists.suse.com
Please read the FAQs: [hidden email]