2

I have a hard disk with an unfortunate unrecoverable sector in either the partition table or a superblock, which causes the disk firmware to lock up when that LBA is accessed. I'm interested in recovering data that's far away from the physically bad sectors, which I think I have a good chance of doing if I can instruct Linux to do absolutely nothing with the drive, unless it corresponds to me reading /dev/sdX with a tool I run explicitly such as sg_read_long, sg_write_long, and ddrescue.

Currently, my Linux installation (Ubuntu) attempts to read the partition table and automatically mount; I don't want any of this to occur when the drive is attached by USB after the machine boots. In addition to the all the user-mode stuff like mtab, Nautilus, etc, is there a kernel configuration option I need to set in order to stop all automatic reads to the drive?

Improve this question
3
  • 1
    Does this answer your question? Prevent Linux Probing for Partitions
    – Reinstate Monica
    Commented Feb 19, 2022 at 21:49
  • @ReinstateMonica It may, but this is a two-year-old, resolved question regarding a dead hard drive that I've physically sent to an E-waste recycler shortly after the accepted answer worked for me, so I can't actually validate the answers there (and kernel source changes as suggested there are less appealing than just disabling a bunch of kernel configs as far as complexity)
    – nanofarad
    Commented Feb 19, 2022 at 23:05
  • That's alright; But note that the other answers there don't require a kernel rebuild, just a compiling an external module (a 5 second build time!).
    – Reinstate Monica
    Commented Feb 20, 2022 at 13:32

1 Answer 1

Reset to default
1

You'd have to remove the entire userland that does a plethora of automations (systemd, udev et al.), so build a minimal initramfs with busybox and ddrescue (or other tools you require) only. You can use this guide for reference: https://wiki.gentoo.org/wiki/Custom_Initramfs

In addition to that, you'd have to compile a custom kernel that doesn't support partition tables which otherwise, the kernel itself would attempt to read automatically on its own accord.

This is an unusual configuration as people of course want their partitions to appear so usually all kernels have these set to yes:

CONFIG_MSDOS_PARTITION=y # for old school dos/mbr partitions
CONFIG_EFI_PARTITION=y   # for new GPT/UEFI partitions
# but there are many others like:
CONFIG_AIX_PARTITION=y
CONFIG_MAC_PARTITION=y
CONFIG_SOLARIS_X86_PARTITION=y

To get rid of HDD reads by kernel, you have to disable all of these. Make a kernel that supports no partition tables of any kind.

And even then, you should probably boot your custom kernel + initramfs first, before hot-plugging the drive. Otherwise, the BIOS will already scan the device for boot partitions. You might be able to disable that but you have no direct control over it.

Good luck with your recovery.

is there a kernel configuration option I need to set in order to stop all automatic reads to the drive?

A kernel parameter would make this a lot easier, but I'm not aware of one. At most you can blacklist a device entirely, making it disappear. Might be useful for a dead built-in device you just want to get rid of, but then you can't recover anything from it, either.

Improve this answer
2
  • Thanks! I'm in the midst of finals so I'm not 100-% ready to try this but I'll do so soon and will report back when I get the chance to do it.
    – nanofarad
    Commented Dec 19, 2019 at 14:48
  • 2
    This worked quite well--The only additional steps I needed was making sure that key drivers (SATA, USB, etc) were either built into the kernel image, or the kernel modules were packed into the initramfs.
    – nanofarad
    Commented Dec 22, 2019 at 3:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .