Will dd if=/dev/zero of=/dev/sda wipe out a pre-existing partition table?

linux dd fdisk gpt

9,512

Solution 1

Will dd if=/dev/zero of=/dev/sda wipe out a pre-existing partition table?

Yes, the partition table is in the first part of the drive, so writing over it will destroy it. That dd will write over the whole drive if you let it run (so it will take quite some time).

Something like dd bs=512 count=50 if=/dev/zero of=/dev/sda would be enough to overwrite the first 50 sectors, including the MBR partition table and the primary GPT. Though at least according to Wikipedia, GPT has a secondary copy of the partition table at the end of the drive, so overwriting just the part in the head of the drive might not be enough.

(You don't have to use dd, though. head -c10000 /dev/zero > /dev/sda or cat /bin/ls > /dev/sda would have the same effect.)

does fdisk /dev/sda g (for GPT) wipe out the zeros written by /dev/zero?

Also yes (provided you save the changes).

(However, the phrasing in the title is just confusing, /dev/zero in itself does not do anything any more than any regular storage does.)

Solution 2

The partition table is stored near the beginning¹ of the (logical²) disk device.

Overwriting that area with anything (zeroes from /dev/zero or any other data) will replace the partition table with gibberish, so it will no longer be obvious where the partitions on the device begin.
One can still scan the whole disk and try to identify the "magic bytes" that mark the beginnings of file systems, though.

Conversely, if you use fdisk (or any other partitioning tool) to create a new partition table, the tool will overwrite the first few bytes of the disk to store that new table.

There's only one beginning to the disk, so whatever you do last will "stick" there.

Note, however, that some partition table formats (like GPT) will keep backup copies in different places (e.g. at the end of the disk for GPT), from which some of the partition information can be recovered.

^{1: e.g. in the first 512 bytes for an MBR or the first and last 17408 bytes for a GPT}
^{2: The drive can internally remap the logical blocks to different parts of the physical medium, but that mapping is invisible to (and unimportant for) the operating system.}

9,512

muru

I have been using Linux primarily since 2009, usually Arch Linux (<3) and Ubuntu. I like C++, Python and Bash (but use zsh as my primary shell).

Updated on September 18, 2022

Comments

muru over 1 year

Will # dd if=/dev/zero of=/dev/sda wipe out a pre-existing partition table?

Or is it the other way around, i.e, does

# fdisk /dev/sda g (for GPT)

wipe out the zeros written by /dev/zero?
- John H over 5 years
  
  That's not /dev/zero wiping something out, it's dd wiping it out by copying over it. The facts that the bytes happen to be zero, and that the zero bytes happen to come from /dev/zero instead of some other source of zeroes, are minor details.
- pipe over 5 years
  
  If you just want to wipe the partition table, wipefs could be more reliable.
peterh over 5 years

Side note: if the output of the /bin/ls is enough short, then the write operation might overwrite only the few some bytes of the MBR, and the most important part (beginning and ending sectors of the partitions) can remain intact. Although an MBR reinstall (most commonly, grub --install /dev/sda) is still required to make the system bootable again.
n.st over 5 years

@peterh Note that they're redirecting the actual ls binary, not the output from running it. The smallest possible "Hello World" ELF binary seems to be 98 bytes (so less than an MBR), but I think it's safe to assume that any binary with actual features should be bigger than an MBR (the notoriously small FreeBSD implementation of ls is 32784 bytes long, even large enough to overwrite the start-of-disk portion of a GPT). ;)
ilkkachu over 5 years

Oh yeah, you could use the output of ls too. A listing of /usr/bin would probably be long enough. I was going to use just echo as an example, but IIRC you need almost 500 bytes to overwrite an MBR partition table, so it's a bit weary to type. (whatever the exact number was)
RudiC over 5 years

Almost right - the (old, MBR type) partition table resides in bytes 1BE - 1FD of the MBR. The first few bytes contain the IBL (initial boot loader) .
mckenzm over 5 years

You should probably use bs and count with dd for this, otherwise it will be going for some time, You only need to zero the sector. 512 bytes for legacy disks. (see @n.st below) In fact the partition table is at the end of this and is small enough for you to make a copy and zero with a hex editor before copying back to preserve the boot content. There are tools for this as well, it is common for NAS disk initialisation to do this.
user1686 over 5 years

bs doesn't need to exactly match the disk's block size; it should be a large multiple of it. bs=1M or bs=8M (with count=1) might greatly improve performance due to reducing the syscall back-and-forth between dd and the kernel.
Rob C over 5 years

@ilkkachu The structure of the MBR is as follows: 446 bytes boot code (padded as needed), 64 bytes partition table, 2 bytes magic value to let the BIOS know the media is bootable. For comparison the boot record on a FAT media has just 3 bytes reserved for code in the beginning (enough for a jump instruction) and then follows file system data and the rest of the sector is available for more boot code. ext{2,3,4} leaves the entire first two sectors blank for boot code to use.
wbkang over 5 years

Just wanted to add that in case of GPT drives, you MUST wipe the end of disk as well. A compliant GPT implementation will check the secondary table at the end of the disk and re-write the first part as well (ignoring whatever you have there already). See: news.ycombinator.com/item?id=18541493