PDA

View Full Version : How can I make the entire disk partition completely empty in a very short time?


T010
November 25th, 2008, 04:42
I have spent some time figuring out how to format a FreeBSD disk
partition properly; but I still don't know right now.

Can anyone tell me how to format the disk partition on FreeBSD?
Will it be as simple as when it is done on MS-DOS?

How to format without directly deleting every file of the disk?
(because that's going to be too time-consuming)

T010.

Oko
November 25th, 2008, 05:06
man fdisk

graudeejs
November 25th, 2008, 05:23
do you want to sanitize it?
if so, example:
dd if=/dev/random of=/dev/ad0s1a bs=1m
if you want to edit slices, i recommend using sysinstall
sysinstall > custom > partions (or something like that) > edit them and press W, act accordingly to message boxes. After than quit sysinstall.
if you want to edit labels
bsdlable -e /dev/ad0s1

to delete any recoverable information, it's not enough to just use rm -R /some/path, you can however use rm -PR /some/path

another simple, insecure way is newfs

however the best way would be dd if=/dev/random of=/dev/ad0s1a bs=1m, end if you're afraid from FBI, do it multiple times, as if you rewrite data once it can sill be recovered. It can still be recovered after multiple rewrites (min 3, the more the better), but that will require way more expensive equipment, and much more time.

Read this, if you're interested for more
http://www.usenix.org/publications/library/proceedings/sec96/full_papers/gutmann/

susanth
November 25th, 2008, 05:57
Read this, if you're interested for more
http://www.usenix.org/publications/library/proceedings/sec96/full_papers/gutmann/

Really Helpful link.
Thanks;

I want to thank u via Thank Button.
I was using it few days back ! But now that button is not available !!!

dragon
November 25th, 2008, 06:19
I think this may be helpful.
"dd if=/dev/zero of=/dev/ad1 count=2"

cliedo
November 25th, 2008, 06:33
If you don't want to destroy the msdos partitions, and you have access to an old hard drive. You can use it to practice and get more comfortable with using sysinstall you have not informed us if you want to keep your windows files or have a dedicated disk for freebsd

graudeejs
November 25th, 2008, 06:40
susanth >>> thanks is working fine for me

SirDice
November 25th, 2008, 09:17
I have spent some time figuring out how to format a FreeBSD disk
partition properly; but I still don't know right now.

Can anyone tell me how to format the disk partition on FreeBSD?
Will it be as simple as when it is done on MS-DOS?

How to format without directly deleting every file of the disk?
(because that's going to be too time-consuming)

T010.

Man newfs.. It's as simple as newfs /dev/ad0s1a assuming there are already partitions inside the slice.

susanth
November 25th, 2008, 09:28
susanth >>> thanks is working fine for me

:) Now Thanks Button works; Some trouble with cache was the prob;

iic2
June 1st, 2009, 22:26
killasmurf86, at command-line I type:
dd if=/dev/random of=/dev/ad0s1h bs=1m
dd: /dev/ad0s1h: Operation not permitted

What am im missing? And how about .snap being loss.

SirDice, at command-line I type:
newfs /dev/ad0s1h
newfs: /dev/ad0s1h: failed to open disk for writing

Is this suppose to be done with sysinstall or something?

I can't find a full-block of code anywhere that can present a live example.

SirDice
June 1st, 2009, 23:01
First, you need to be root to do that dd stuff. And you have to make sure the filesystem you're working on isn't mounted.

Second, do you actually have an h partition? Have a look with bsdlabel:
bsdlabel ad0s1

Make sure it isn't mounted, use the mount command:
mount

phoenix
June 2nd, 2009, 00:09
do you want to sanitize it?
if so, example:
dd if=/dev/random of=/dev/ad0s1a bs=1m
if you want to edit slices, i recommend using sysinstall

Don't use sysinstall. You shouldn't ever need to touch sysinstall after installing the system.

Instead, use sade. This gives you the same fdisk/bsdlabel interface as sysinstall uses, but without all the extra gunk from sysinstall.

fronclynne
June 2nd, 2009, 00:18
if you're afraid from FBI, do it multiple times
If you are really afraid of J. Edgar and his Jack-Booted thugs, remove the platters and reduce them to a fine powder. Also be prepared to do a long sit in the pokey for destroying evidence.

For most (SFW) users fdisk, bsdlabel, & newfs on the intended portion is fine and won't take more than a couple of minutes.

vivek
June 2nd, 2009, 00:37
There was a price sometime ago for recovery data after running dd command. Nobody able to claim it back...

SirDice
June 2nd, 2009, 09:25
There was a price sometime ago for recovery data after running dd command. Nobody able to claim it back...

That's because renting an electron microscope was more expensive then the price of winning :e

hedwards
June 3rd, 2009, 04:07
That's because renting an electron microscope was more expensive then the price of winning :e
Not really, when I was in college we had could gain access to the campus electron microscope. It was kind of involved, but they mostly just made you prove you could operate it without damaging the equipment. The prize from a successful recovery would have gone a long ways towards paying for tuition.

I'm guessing that other schools out there provide similar opportunities.

EDIT: And apparently the college my mother teaches at has one just sitting in one of the classrooms, for no particular reason. It's a shame, because it wouldn't take too long to roll it 20 feet out of the room and to freedom.

EDIT2: I assume you're really implying the clean room requirements.

iic2
June 3rd, 2009, 17:18
If you are really afraid of J. Edgar and his Jack-Booted thugs, remove the platters and reduce them to a fine powder. Also be prepared to do a long sit in the pokey for destroying evidence.

Jack-Booted thugs
LOL
or just lay a giant magnet on top of it. heh

iic2
June 3rd, 2009, 18:05
I have nothing to hide, but knowing your disk is killasmurf86 (completely sanitized) kind of make you feel you done something special.
....
SirDice
1:First, you need to be root to do that dd stuff. And you have to make sure the filesystem you're working on isn't mounted.
I think I am root. Am I root when it on my home machine and I root and password. How do I make sure that a file-system is not mounted ??? I better read read read.

2:Second, do you actually have an h partition?
I think i do. I df -h read [/dev/ad0s1g] [/dev/ad0s1h] and I named the G and H
Have a look with bsdlabel(8):
# bsdlabel ad0s1
Make sure it isn't mounted, use the mount(8) command:
# mount
I'm going to read this today and try most suggestion here. Right now I got more concern about 1 &2 which make me wonder are they really there and is it more to being root that just logging in! No need to reply if i am really root and H drive is there ... im just paranoid i guest. I'm still playing with install anyway due to the other thread I posted. This could take days, even weeks. I got plenty of coffee.

This is an old but most interesting thread.
Thanks for the additional answers

SirDice
June 3rd, 2009, 18:18
If the partition shows up with df, it's mounted. You cannot newfs or dd a partition that's mounted. Unmount it first.

graudeejs
June 4th, 2009, 17:59
But if you have encrypted entire disk with geom_eli, and J. Edgar and his Jack-Booted thugs are trying to break your door you run

$ geli kill -a


from geli man page

kill This command should be used in emergency situations. It will
destroy all keys on the given provider and will detach it
forcibly (if it is attached). This is absolutely a one‐way
command ‐ if you do not have a metadata backup, your data is
gone for good. In case the provider was attached with the −r
flag, the keys will not be destroyed, only the provider will
be detached.

−a If specified, all currently attached providers will
be killed.

mk
June 4th, 2009, 19:10
@iic2 can you by chance stop altering forum default font? it's literally hurt my eyes.

OP: how about using defibrilator? or even thermite? :-p

P.S the last one is from discovery channel - that old brit make real magic with some of those :)

iic2
June 5th, 2009, 02:27
mk, are you guys using a freeBSD machine to view web pages? Either way others has said something about that so OK, I will not change default again.

SirDice, I see way you did not believe that I had created a G and H drive on my machine. I now playing with size of partitions and I now notice FreeBSD will display an lonely (X) for the (I) partition using 7.2 and I am surprise. So the buck stop here at a workable H partition. That's cool :) :) :)

But because of what you said that's why I'm in the proccess of doing this sizing thing cause last time I made 1.8 Gig and my H partition. Empty partitions gets 4kb for snap so my H read 1.7 gig. Maybe this is normal but I'm going to check for sure... I should have done df and not df -h for byte size. But either way it took away a lot of MB's. That's why I'm checking.

PS: I did the G and H thing on 6.4 last week with no problem. I did not know there were limits tell now.

And install will not mount X ...error mounting.

iic2
June 5th, 2009, 18:52
THIS INSTALL and what I declare as size has changed:
4,774,68 MB available (FDISK read)
Disk:ad0 Partition name:ad0s1 Free: 7257229 blocks (3543 mb)

Partition Declared Actual-Size Received Available Bytes Missing
ad0s1a 310 mb 300 m - 307246 b 133 m 10 m
devfs 310 mb 1.0 0 b swap
ad0s1d 311 mb 301 m - 308270 b 277 m 10 m
ad0s1e 315 mb 305 m - 312238 b 281 m 10 m
ad0s1f 1200 mb 1.1 g - 1187278 b 125 m ??
ad0s1g 343 mb 332 m - 340014 b 305 m 10 m
ad0s1h 2000 mb 1.9 g - 1983380 b 1.7 g TONS

Free: 4097165 blocks (2000 mb) This was left-over for H partition.

Those missing MB must be BSD Disk Labels and such? I don't know, I wish some one would tell me. But for several 100's of MG to be missing for a EMPTY partition should be accounted for.

Now I see it the bulk of it ...

df -m
Filesystem Declared Received Used Available Capacity Mounted
ad0s1h 2000 m 1936 m 1 m 1780 m 0% /H

2000 x 1024 = 2,048,000 byte or 2000 mb
Actual-size = 1,982,464 byte or 1936 mb
Used-Labels = 65,536 byte or 64 mb

Actual size -- 1936 - 1780 = 156 megabytes un-accounted for.

The system labels or what-ever has its needed bytes (64 mb) I think. But still 156 megabytes is un-accounted for. Can anyone explain this ... My concern is of a possible leak which can compomise security and not all user would won't to give-up this extra drive up just because. And if no one has an answer, please report-this cause only you may accually know for sure if it should be at minium.

How do I save Print-Screen so I can save the [df] information do disk?