Friday, December 5, 2014

hard drive - SMART User Capacity and fdisk -l size value differ. Why? Security issue?

I'm just wondering why the size of my drive that smartctl ("User Capacity") shows differ from the value that fdisk -l, dmesg, hdparm shows and differ from the drive specification values from the data sheet. I need some hints to interpret these values.



First I made a




dd_rescue /dev/zero /dev/sdf 


until dd_rescue interrupted with "no space left on device".



The transferred amount was 3000558944256 bytes.
It's similar to the fdisk -l and dmesg amount of bytes.



smartctl -x says:




=== START OF INFORMATION SECTION ===
Model Family: Western Digital Caviar Green (Adv. Format)
(...)
Firmware Version: 80.00A80
User Capacity: 3.000.559.428.096 bytes [3,00 TB]
Sector Sizes: 512 bytes logical, 4096 bytes physical
Device is: In smartctl database [for details use: -P show]
ATA Version is: 8
ATA Standard is: ACS-2 (revision not indicated)
Local Time is: Thu Jul 3 19:10:34 2014 CEST

SMART support is: Available - device has SMART capability.
SMART support is: Enabled


fdisk -l says:



Note: sector size is 4096 (not 512)

Disk /dev/sdf: 3000.6 GB, 3000558944256 bytes
255 heads, 63 sectors/track, 45599 cylinders, total 732558336 sectors

Units = sectors of 1 * 4096 = 4096 bytes
Sector size (logical/physical): 4096 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes


dmesg says:



[  176.168005] sd 5:0:0:0: [sdf] Spinning up disk.............ready
[ 186.352957] sd 5:0:0:0: [sdf] 732558336 4096-byte logical blocks: (3.00 TB/2.72 TiB)



hdparm -I -g /dev/sdf



/dev/sdf:
geometry = 364797/255/63, sectors = 5860466688, start = 0
(that's the fdisk -l value / 512)

LBA48 user addressable sectors: 5860467633
(that's the SMART reported value / 512)



Drive specification from WD Website:



User sectors per drive: 5860533168
(That is LBA48 Value + 65 535) (?!)


hdparm --dco-identify /dev/sdf



DCO Revision: 0x0002

(...)
Real max sectors: 5860533168


hdparm -N /dev/sdf



/dev/sdf:
READ_NATIVE_MAX_ADDRESS_EXT failed: Input/output error



The problem:
It's a difference from 483840 Bytes from the SMART info to the dd_rescue, fdisk and dmesg values. And the product specification shows that the drive is 65535 sectors bigger than reported to SMART and can't be accessed through LBA. So i have 3 size values that i do not understand.



I calculated around and found out that



483840 / 4096 = 118
483840 / 512 = 945
(483840 / 63 (sectors/track) = 7 680)



Perhaps this has some meaning, that the missing bytes are n times the sector size?
Are some sectors unadressable? Why? Is it from LBA -> CHS translation ?



The drive is new from the shop. SMART shows no pending sectors, no reallocation events and no reallocated sectors.



I made some additional experiments:
On my internal harddrive "Hitachi Deskstar T7K500" the SMART and fdisk values don't differ.
On my external USB harddrive "SAMSUNG SpinPoint F2 EG" the SMART and fdisk values don't differ.
It's only on my external USB hard drive (Western Digital My Book).



Perhaps there's some reserved space? For what?
Perhaps it has something to do with the hardware encryption capability (not turned on)?




Could it be that there are bad sectors on the drive that the firmware remapped internally and didn't report to SMART?



The drive came with a bad ntfs file system that was repairable. But a new hard drive shouldn't have a corrupt file system i think. Perhaps here was a internal remap of sectors?



I just found that my other Western Digital external USB drive (Western Digital My Passport Essential SE) has the same issue, there are 2 842 624 bytes missing between SMART output and fdisk -l output. (but there are pending sectors on this drive).



I think this could even be a security issue:



Normally, with the dd_recue command you can be sure to overwrite the whole disk, but with that byte difference issue i'm unsure if everything was overwritten (i know, physically bad sectors and probably internally remapped sectors and pending sectors could be not accessible and couldn't be overwritten but there are no remapped sectors in the SMART log).




In between I heared from the concept of "host protected area" and DCO, but dmesg showed no hint about that. OS is OpenSuse 12.2 and Kernel Version (uname -r) is "3.4.11-2.16-desktop".



Furthermore I found this site:
https://unix.stackexchange.com/questions/139705/why-does-hdparm-see-two-different-values-for-the-size-of-a-drive
what also could be a hint. But I calculated around for my values and didn't found the solution.



Has anyone hints or an explanation for this?



The questions are:
1. Why is there a difference of 483840 bytes between SMART Info and dmesg?
2. Why is there a difference of 65535 sectors between hd specification and LBA Sectors?
3. Is there a Host protected area or a DCO on the drive? How to find out?
4. How big is my harddrive in fact and how can I secure erase it (I assume that ATA SECURITY ERASE UNIT won't work over USB, I'll try it later)



Thanks!

No comments:

Post a Comment

linux - How to SSH to ec2 instance in VPC private subnet via NAT server

I have created a VPC in aws with a public subnet and a private subnet. The private subnet does not have direct access to external network. S...