Persistence of home directory after deleting all partitions and reinstalling:

Question

I was running Ubuntu Server on a mdadm RAID1 volume, and I ran into some problems so I decided to just do a clean install.

• I booted with Gparted, stopped the mdadm array, and ran --zero-superblock on each partition, then deleted the partitions using Gparted.

• I then booted from an Ubuntu Server USB, configured the raid from scratch using the manual partitioning option, and installed Ubuntu 18.04.

• First thing after installing the OS, I installed xfce4 and firefox along with a few other standard utilities and rebooted ran startx and fired up Firefox.

When logged I logged in, the tabs that I had open before reinstallation immediately opened up, I was still logged into SO. In fact, my entire home folder was still there.

I thought I had nuked everything and started fresh. I am totally mystified as to how this happened. Upon further inspection, I saw that all my files in my home folder were still there as well.

Is there some step that I missed? I thought the point of --zero-superblock and deleting the partitions was to get rid of any data on the drive. What did I miss? What does it take to do a guaranteed truly clean install? I am certain I have followed the same exact procedure before and my home directory did not persist.

Edit: So I zeroed out the component drives of the array, but now in the manual setup in the installer, I cannot set my new partition to "bootable" (nothing changes when I select it). Oddly, when creating the partitions it no longer asks me if I want to do a primary or a logical partition as it has in past times USING this same installer usb.

Answer 1

The partition table is really just a piece of data that says things like

• Partition 1 starts at track 10 and finishes at track 99
• Partition 2 starts at track 100 and finishes at track 599
• Partition 3 starts at track 600 and finishes at track 16383

If you delete the partition table then the data in tracks 10->99, 100->599, 600->16383 are untouched, just the OS no longer knows how to find it. So if you then recreate the paritition table exactly the same way then your data is still available. I made use of this in 2016 when I destroyed all my partition tables by mistake ( https://www.sweharris.org/post/2016-02-10-break-mbr/ )

If you want to delete the data inside the partitions as well then you either need to zero the whole disk, or else format the partitions. Most installers have an option to say "format partition" when you do your setup.

Or make sure your partitions start in different places (eg 9->100, 101->600, 601->16384) so the data inside doesn't look like a filesystem.

Answer 2

Likely you remand the partitions exactly but did not make new file systems.

mkfs.ext4 /dev/sda1

Other possibilities; Firefox (ubuntu, google, microsoft) can backup stuff to a cloud if you are logged in. There are 2 ways to ensure local data is removed security removed;

Use FDE

cryptsetup luksFormat /dev/sda

Zero the whole drive

cat /dev/zero > /dev/sda

Simply remaking partitions and file systems will certainly make the data require extra work (PhotoRec) to recover.