14

Will # dd if=/dev/zero of=/dev/sda wipe out a pre-existing partition table?

Or is it the other way around, i.e, does

# fdisk /dev/sda g (for GPT)

wipe out the zeros written by /dev/zero?

muru
  • 69,900
  • 13
  • 192
  • 292
  • 6
    That's not `/dev/zero` wiping something out, it's `dd` wiping it out by copying over it. The facts that the bytes happen to be zero, and that the zero bytes happen to come from `/dev/zero` instead of some other source of zeroes, are minor details. – chrylis -cautiouslyoptimistic- Nov 26 '18 at 03:07
  • 2
    If you just want to wipe the partition table, [wipefs](https://linux.die.net/man/8/wipefs) could be more reliable. – pipe Nov 26 '18 at 09:14

2 Answers2

22

Will dd if=/dev/zero of=/dev/sda wipe out a pre-existing partition table?

Yes, the partition table is in the first part of the drive, so writing over it will destroy it. That dd will write over the whole drive if you let it run (so it will take quite some time).

Something like dd bs=512 count=50 if=/dev/zero of=/dev/sda would be enough to overwrite the first 50 sectors, including the MBR partition table and the primary GPT. Though at least according to Wikipedia, GPT has a secondary copy of the partition table at the end of the drive, so overwriting just the part in the head of the drive might not be enough.

(You don't have to use dd, though. head -c10000 /dev/zero > /dev/sda or cat /bin/ls > /dev/sda would have the same effect.)

does fdisk /dev/sda g (for GPT) wipe out the zeros written by /dev/zero?

Also yes (provided you save the changes).

(However, the phrasing in the title is just confusing, /dev/zero in itself does not do anything any more than any regular storage does.)

ilkkachu
  • 133,243
  • 15
  • 236
  • 397
  • Side note: if the output of the `/bin/ls` is enough short, then the write operation might overwrite only the few some bytes of the MBR, and the most important part (beginning and ending sectors of the partitions) can remain intact. Although an MBR reinstall (most commonly, `grub --install /dev/sda`) is still required to make the system bootable again. – peterh Nov 25 '18 at 17:33
  • 8
    @peterh Note that they're redirecting the actual `ls` binary, *not* the output from running it. The smallest possible "Hello World" ELF binary seems to be [98 bytes](https://codegolf.stackexchange.com/a/5741/10873) (so less than an MBR), but I think it's safe to assume that any binary with actual features should be bigger than an MBR (the notoriously small FreeBSD implementation of `ls` is 32784 bytes long, even large enough to overwrite the start-of-disk portion of a GPT). ;) – n.st Nov 25 '18 at 17:52
  • Oh yeah, you could use the output of `ls` too. A listing of `/usr/bin` would probably be long enough. I was going to use just `echo` as an example, but IIRC you need almost 500 bytes to overwrite an MBR partition table, so it's a bit weary to type. (whatever the exact number was) – ilkkachu Nov 25 '18 at 18:18
  • 1
    You should probably use bs and count with dd for this, otherwise it will be going for some time, You only need to zero the sector. 512 bytes for legacy disks. (see @n.st below) In fact the partition table is at the end of this and is small enough for you to make a copy and zero with a hex editor before copying back to preserve the boot content. There are tools for this as well, it is common for NAS disk initialisation to do this. – mckenzm Nov 26 '18 at 00:50
  • bs doesn't need to exactly match the disk's block size; it should be a large _multiple_ of it. `bs=1M` or `bs=8M` (with count=1) might greatly improve performance due to reducing the syscall back-and-forth between dd and the kernel. – u1686_grawity Nov 26 '18 at 06:56
  • @grawity Correct in principle (and thus good to keep in mind for larger writes), but when overwriting a 0.5 kB MBR or 17 kB GPT, the actual time saving will be tiny. – n.st Nov 26 '18 at 09:52
  • @ilkkachu The structure of the MBR is as follows: 446 bytes boot code (padded as needed), 64 bytes partition table, 2 bytes magic value to let the BIOS know the media is bootable. For comparison the boot record on a FAT media has just 3 bytes reserved for code in the beginning (enough for a jump instruction) and then follows file system data and the rest of the sector is available for more boot code. ext{2,3,4} leaves the entire first two sectors blank for boot code to use. – kasperd Nov 26 '18 at 13:45
  • 1
    Just wanted to add that in case of GPT drives, you MUST wipe the end of disk as well. A compliant GPT implementation will check the secondary table at the end of the disk and re-write the first part as well (ignoring whatever you have there already). See: https://news.ycombinator.com/item?id=18541493 – wbkang Dec 03 '18 at 01:32
10

The partition table is stored near the beginning1 of the (logical2) disk device.

Overwriting that area with anything (zeroes from /dev/zero or any other data) will replace the partition table with gibberish, so it will no longer be obvious where the partitions on the device begin.
One can still scan the whole disk and try to identify the "magic bytes" that mark the beginnings of file systems, though.

Conversely, if you use fdisk (or any other partitioning tool) to create a new partition table, the tool will overwrite the first few bytes of the disk to store that new table.

There's only one beginning to the disk, so whatever you do last will "stick" there.

Note, however, that some partition table formats (like GPT) will keep backup copies in different places (e.g. at the end of the disk for GPT), from which some of the partition information can be recovered.

1: e.g. in the first 512 bytes for an MBR or the first and last 17408 bytes for a GPT
2: The drive can internally remap the logical blocks to different parts of the physical medium, but that mapping is invisible to (and unimportant for) the operating system.

n.st
  • 7,918
  • 4
  • 35
  • 53
  • 1
    Almost right - the (old, MBR type) partition table resides in bytes 1BE - 1FD of the MBR. The first few bytes contain the IBL (initial boot loader) . – RudiC Nov 25 '18 at 23:15
  • @RudiC Good point, I've stated it more precisely now. – n.st Nov 25 '18 at 23:24