0

I had malware on a drive device (even if stagnant) I wanted to low level format the device to get rid of. So I hacked your tool hdparm and wore my own poor results. What I did:

hdparm --user-master u --security-erase llformat /dev/sdb    #very similar command argument I used

hdparm -I      #argument was also used

(As a newbie I was not sure if I needed to format the partition sdb* so I just used device name sdb)

Now the boot loader cannot read the hard disk boot sector.

Zanna
  • 70,465
Craig Anders
  • 91
  • Welcome to Ask Ubuntu! OK as per your post, you formatted your drive securely. What is the question? – Andrea Lazzarotto Jul 18 '17 at 10:00
  • 2
    @Andrea his question appears to be that the boot loader can't read the boot sector, but that's a pointless question, as he just erased it. –  Jul 18 '17 at 10:54
  • Yes I did erase the first bit section of the disk, I think, so boot sequence the disk will not read the disk drive because the first sector is the most important [it shows where to start the device], anyone who knows hdparm cli arguments or knows how fdisk could fix this I will kindly repay. – Craig Anders Jul 18 '17 at 14:10
  • 1
    You erased the disk. Do you want to recover data (fairly impossible I suspect) or install something on the disk, format it or...? What is your goal? – Zanna Jul 18 '17 at 19:44
  • I wanted to recuperate the data on the disk is it in anyway posibile to recuperate the data after erasing the Master Boot Record and Partition tables? Thanks I learned a lot. – Craig Anders Jul 20 '17 at 14:53
  • The whole story I have been defending myself against a breach on my computer where the attacker had access to my screen, I have to format a second physical device drive because of malware that writes itself to the MBR installed 2016. – Craig Anders Jul 22 '17 at 09:54
  • What happened is that the attacker saw my tty and the way I was using hdparm and to insult me he decided to use the command on my boot disk so my system froze did a hard reboot and found out that not even grub is recognized, so I became confused. Still have that disk and would like to know if I can restore the data after the format (I do not know is the volume is overwritten with zeros) and after that recuperate the data. This message must not be ideal but I had to explain myself. Have a nice day. – Craig Anders Jul 22 '17 at 09:54
  • First thing would be go to a really clean machine (!) and see if everything has actually been overwritten (wxHexEditor /dev/whatever, see if there's non-zeros somewhere). If it's all zeros, you don't have any realistic chance. Otherwise, see e.g. https://help.ubuntu.com/community/DataRecovery – Wolfgang Noichl Jul 24 '17 at 12:08

1 Answers1

2

Your command did exactly as you intended. Your system erased all data off of your hard drive, including your boot sector and partition table. Due to the nature of secure erase, there is zero chance of recovery. In other words, you now have a fresh hard drive with absolutely no data stored on it.

If you want to boot from this drive again, you'll need to create a new boot sector. The easiest way to do this is to format the drive and install an operating system on it. See How do I install Ubuntu? for instructions as to how to do this.

If you'd rather just use this drive for data storage, format it from Ubuntu and create a partition table. Tools like the built-in Disks utility or gparted would be the easiest ways to achieve this goal.

As I think you're also confused, here's what happens with MBR-based systems.

The first sector of the hard drive (hex offset 0x000 to 0x1ff) contains what's called the Master Boot Record. This contains BIOS instructions, as well as CPU instructions for how to handle and start the computer.

When your BIOS complains about being unable to read the boot sector, it means that your computer failed to find executable code (or encountered an error while executing code), or that the MBR was malformed. As you erased your MBR, it would obviously have no executable code or record of drive information. Therefore, this must be recreated through formatting the drive.

Kaz Wolfe
  • 34,122
  • 21
  • 114
  • 172