2

I'm looking for a way to check if the entire binary contents of a USB device are purely 0s.

I'm trying this command: sudo xxd /dev/sdb | uniq but it has no output and just runs forever.

I've considered the Sort command, but my understanding is that it requires a file to read rather than just the standard terminal output.

update: I realised I could check with sudo xxd -a /dev/sdb, but my question still stands: is there a way to uniquely sort output of the terminal without saving it to a file first?

  • 2
    cmp /dev/sdb /dev/zero should be cmp: EOF on /dev/sdb. As for sort, it's just something | sort, nothing special about it, except you'll run out of memory if you try dumping gigabytes of zeroes into it... – frostschutz Apr 18 '14 at 19:13
2

xxd doesn't strike me as the right hammer for this screw. You can run tr to remove null bytes and see if there's anything left:

[ -n "$(</dev/sdb tr -dc '\0' | head -c 1)" ]

You can also use od, which collapses null-filled lines:

[ "$(od -tx1 -An -w1 | head -n 2 | tr -d ' \n')" = "00*" ]
|improve this answer|||||
1

Simply using od or hexdump should be fine since these programs avoid outputting repeated lines (or use xxd -a as above). Eg:

$ truncate -s 1M test
$ hexdump test
0000000 0000 0000 0000 0000 0000 0000 0000 0000
*
0100000
$ od test
0000000 000000 000000 000000 000000 000000 000000 000000 000000
*
4000000

If the drive is zeroed then the output won't be much different than this except that the final address will be much larger. If you see any other data, you could just hit Crtl-C.

To avoid continuing after non-zero data has been found and filling up the terminal, you could do something like this (in bash):

count=0
stdbuf -oL od /dev/sdb |
  while read line; do
    echo "$line"
    (( ++count > 3 )) && break
  done

This will print at most 4 lines of output, from which you can tell if the drive is zeroed or not.

Top have done this dirtily with sort, you could have done sudo xxd /dev/sdb | sort -u. Adding the -u option to sort is equivalent to doing sort | uniq.

|improve this answer|||||
0

i think this command will do the trick for you

xxd /dev/sdb | grep -v '0000 0000 0000 0000 0000 0000 0000 0000'

if the drive has been zeroed this command will return no output. Incase it has any bytes left on it, command will be happy to prompt it on the screen

Thanks

|improve this answer|||||
0

dd /dev/zero is referred to as Forensic Wipe and is typically done before forensically imaging data from one device to another in order to mitigate cross contamination. This includes new devices freshly removed from their packaging due to manufacturer files and so forth.

EXECUTE FORENSIC WIPE:

Download "dd for Windows" and open Windows Command-line ("cmd.exe").

Type: "cd /D [directory]" to the "dd" folder.

Type: "dd --list" to show list of Volumes, Disks, and Partitions. Locate your device.

Type: "dd if=/dev/zero of=\\?\Device\Harddisk1\Partition0 --progress"

Choose between "/dev/zero" and "/dev/random" as the write operation. Ensure you select your device based on step 3.

VERIFY ZERO WRITE OPERATION:

Wait for the zero or random write process to complete and then run hexdump to display hexadecimal value, which should read all zeros for "/dev/zero" process. Choose one of the following:

Type: "dd if=\\?\Device\Harddisk1\Partition0 | hexdump -C"

Type: "hexdump.exe -C \\.\d:" where [\\.\d:] is [unformatted directory]

The result of Zero Write using "dd if=\?\Device\Harddisk1\Partition0 | hexdump -C" and will continue parsing zeros (null data) until the end of the drive. The drive used in the image was NOT formatted after executing the Zero Write procedure. The following image depicts what would be considered a Zero Write success: enter image description here

The hexadecimal printout result after ONLY formatting the drive. This shows any alteration to the drive contents will trigger a printout instead of running through the entire drive showing all zeros (null data). The following image depicts what would be considered a Zero Write fail: enter image description here

WARNING:

The drive must be in an unreadable state (RAW - format drive before use) otherwise "Error native opening file...operation completed successfully" or "Error writing file...Access is denied" will result without any action taken using the Windows based "dd" tool.

The easiest method for placing the drive into RAW state is to execute the "/dev/zero" process explained above, it will immediately fail, then remove and reinsert the drive. The "format before use prompt..." will appear, click cancel, and then repeat the same "/dev/zero" process to either write zeros (null data) or pseudo-random data to the drive.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.