SMART User Capacity and fdisk -l size value differ. Why? Security issue

hard driveSecuritysmart

I'm just wondering why the size of my drive that smartctl ("User Capacity") shows differ from the value that fdisk -l, dmesg, hdparm shows and differ from the drive specification values from the data sheet. I need some hints to interpret these values.

First I made a

dd_rescue /dev/zero /dev/sdf 

until dd_rescue interrupted with "no space left on device".

The transferred amount was 3000558944256 bytes.
It's similar to the fdisk -l and dmesg amount of bytes.

smartctl -x says:

=== START OF INFORMATION SECTION ===
Model Family:     Western Digital Caviar Green (Adv. Format)
(...)
Firmware Version: 80.00A80
User Capacity:    3.000.559.428.096 bytes [3,00 TB]
Sector Sizes:     512 bytes logical, 4096 bytes physical
Device is:        In smartctl database [for details use: -P show]
ATA Version is:   8
ATA Standard is:  ACS-2 (revision not indicated)
Local Time is:    Thu Jul  3 19:10:34 2014 CEST
SMART support is: Available - device has SMART capability.
SMART support is: Enabled

fdisk -l says:

Note: sector size is 4096 (not 512)

Disk /dev/sdf: 3000.6 GB, 3000558944256 bytes
255 heads, 63 sectors/track, 45599 cylinders, total 732558336 sectors
Units = sectors of 1 * 4096 = 4096 bytes
Sector size (logical/physical): 4096 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes

dmesg says:

[  176.168005] sd 5:0:0:0: [sdf] Spinning up disk.............ready
[  186.352957] sd 5:0:0:0: [sdf] 732558336 4096-byte logical blocks: (3.00 TB/2.72 TiB)

hdparm -I -g /dev/sdf

/dev/sdf:
 geometry      = 364797/255/63, sectors = 5860466688, start = 0             
(that's the fdisk -l value / 512)

 LBA48  user addressable sectors: 5860467633 
(that's the SMART reported value / 512)

Drive specification from WD Website:

User sectors per drive: 5860533168
(That is LBA48 Value + 65 535) (?!)

hdparm –dco-identify /dev/sdf

DCO Revision: 0x0002
(...)
Real max sectors: 5860533168

hdparm -N /dev/sdf

/dev/sdf:
 READ_NATIVE_MAX_ADDRESS_EXT failed: Input/output error    

The problem:
It's a difference from 483840 Bytes from the SMART info to the dd_rescue, fdisk and dmesg values. And the product specification shows that the drive is 65535 sectors bigger than reported to SMART and can't be accessed through LBA. So i have 3 size values that i do not understand.

I calculated around and found out that

483840 / 4096 = 118
483840 / 512 = 945
(483840 / 63 (sectors/track) = 7 680)

Perhaps this has some meaning, that the missing bytes are n times the sector size?
Are some sectors unadressable? Why? Is it from LBA -> CHS translation ?

The drive is new from the shop. SMART shows no pending sectors, no reallocation events and no reallocated sectors.

I made some additional experiments:
On my internal harddrive "Hitachi Deskstar T7K500" the SMART and fdisk values don't differ.
On my external USB harddrive "SAMSUNG SpinPoint F2 EG" the SMART and fdisk values don't differ.
It's only on my external USB hard drive (Western Digital My Book).

Perhaps there's some reserved space? For what?
Perhaps it has something to do with the hardware encryption capability (not turned on)?

Could it be that there are bad sectors on the drive that the firmware remapped internally and didn't report to SMART?

The drive came with a bad ntfs file system that was repairable. But a new hard drive shouldn't have a corrupt file system i think. Perhaps here was a internal remap of sectors?

I just found that my other Western Digital external USB drive (Western Digital My Passport Essential SE) has the same issue, there are 2 842 624 bytes missing between SMART output and fdisk -l output. (but there are pending sectors on this drive).

I think this could even be a security issue:

Normally, with the dd_recue command you can be sure to overwrite the whole disk, but with that byte difference issue i'm unsure if everything was overwritten (i know, physically bad sectors and probably internally remapped sectors and pending sectors could be not accessible and couldn't be overwritten but there are no remapped sectors in the SMART log).

In between I heared from the concept of "host protected area" and DCO, but dmesg showed no hint about that. OS is OpenSuse 12.2 and Kernel Version (uname -r) is "3.4.11-2.16-desktop".

Furthermore I found this site:
https://unix.stackexchange.com/questions/139705/why-does-hdparm-see-two-different-values-for-the-size-of-a-drive
what also could be a hint. But I calculated around for my values and didn't found the solution.

Has anyone hints or an explanation for this?

The questions are:
1. Why is there a difference of 483840 bytes between SMART Info and dmesg?
2. Why is there a difference of 65535 sectors between hd specification and LBA Sectors?
3. Is there a Host protected area or a DCO on the drive? How to find out?
4. How big is my harddrive in fact and how can I secure erase it (I assume that ATA SECURITY ERASE UNIT won't work over USB, I'll try it later)

Thanks!

Best Answer

This is not an answer but might help. I have a similar situation with a USB external hard drive reporting different capacity when queried in different ways.

smartctl -i -d scsi /dev/sdb gives:

smartctl 6.2 2013-07-26 r3841 [x86_64-linux-3.14.27-std-def-alt1] (ALT Linux 6.2-alt0.M70P.1)
Copyright (C) 2002-13, Bruce Allen, Christian Franke, www.smartmontools.org

=== START OF INFORMATION SECTION ===
Vendor:               BUFFALO
Product:              HD-PNTU3
Revision:             0001
User Capacity:        1,000,173,428,736 bytes [1.00 TB]
Logical block size:   512 bytes
Logical Unit id:      0x6000039426a846b30000000000000000
Device type:          disk
Local Time is:        Thu Jan 22 19:57:29 2015 JST
SMART support is:     Unavailable - device lacks SMART capability.

However, smartctl -i -d sat /dev/sdb gives:

smartctl 6.2 2013-07-26 r3841 [x86_64-linux-3.14.27-std-def-alt1] (ALT Linux 6.2-alt0.M70P.1)
Copyright (C) 2002-13, Bruce Allen, Christian Franke, www.smartmontools.org

=== START OF INFORMATION SECTION ===
Model Family:     Toshiba 2.5" HDD MQ01ABD...
Device Model:     TOSHIBA MQ01ABD100
Serial Number:    72D7F1JHS
LU WWN Device Id: 5 000039 426a846b3
Firmware Version: AX0A1U
User Capacity:    1,000,204,886,016 bytes [1.00 TB]
Sector Sizes:     512 bytes logical, 4096 bytes physical
Rotation Rate:    5400 rpm
Device is:        In smartctl database [for details use: -P show]
ATA Version is:   ATA8-ACS (minor revision not indicated)
SATA Version is:  SATA 2.6, 3.0 Gb/s (current: 3.0 Gb/s)
Local Time is:    Thu Jan 22 19:57:36 2015 JST
SMART support is: Available - device has SMART capability.
SMART support is: Enabled

They differ not only in the capacity, but also the model name, and whether or not it is reported that the physical sector size is 4096 bytes. Now, in my case:

  • hdparm -I /dev/sdb seems to see the larger capacity / 4KiB-physical-sector information.

  • hdparm -g /dev/sdb, fdisk -l /dev/sdb, cat /sys/block/sdb/size and cat /sys/block/sdb/queue/physical_block_size all show the smaller capacity / 512B-physical-sector information.

As for the security issue, it should be OK if nobody has ever written sensitive data to the "inaccessible" sectors. fdisk can't see them, and, in my case, Windows isn't seeing them either. Probably they've never belonged to a partition.

However, it seems that some LVM tools do get confused by the discrepancy: https://unix.stackexchange.com/questions/139705/why-does-hdparm-see-two-different-values-for-the-size-of-a-drive/180808

Related Question