[Documentation / man p] sg_format question regarding the formatting process on sas drives

[fthobe]

Hey,

There’s a discussion ongoing regarding the formatting of drives using sg_format on the discussions board of ShredOS / nwipe (an open source Linux distribution to wipe disks securely with certification).

Full discussion thread

sg_format I'm assuming you use the format command to wipe the drive although I'm not sure whether it's actually writing every bit in a block or just reformatting the blocks header. The man page doesn't seem to go into detail on that.

Could you weigh in? I would make a PR for the man pages afterwards.

[mwilck]

This is what the sg_format(8) man page says:

       -S, --security
              sets the "Security Initialization" (SI) bit in the FORMAT UNIT command's initialization pattern descriptor within the parameter list. According to SBC-3 the  default  initial‐
              ization  pattern "shall be written using a security erasure write technique". See the NOTES section on the SCSI SANITIZE command. If this option is given then the --ip_def op‐
              tion cannot be given.
[...]
      The  SCSI  SANITIZE  command  was introduced in SBC-3 revision 27. It is closely related to the ATA sanitize disk feature set and can be used to remove all existing data from a disk.
       Sanitize is more likely to be implemented on modern disks (including SSDs) than FORMAT UNIT's security initialization feature (see the --security  option)  and  in  some  cases  much
       faster.

sg_sanitize(8) adds:

This utility invokes the SCSI SANITIZE command. This command was first introduced in the SBC-3 revision 27 draft. The purpose of the sanitize operation is to alter the information in the cache and on the medium of a logical unit (e.g. a disk) so that the recovery of user data is not possible. If that user data cannot be erased, or is in the process of being erased, then the sanitize operation prevents access to that user data.

In the SCSI Spec SBC5, §4.11, we have:

4.11 Sanitize operations
4.11.1 Sanitize operations overview
A sanitize operation causes the device server to:
a) affect the information on the logical unit’s medium such that recovery of logical block data from the
medium is not possible;
b) affect the information in the cache by a method that is not defined by this standard such that
previously existing data in cache is unable to be accessed; and
c) prevent future access by an application client to cache or medium where the device server is unable
to alter the information.
One of the following sanitize operations may be requested on the logical unit’s medium:
a) a sanitize overwrite operation that causes the device server to alter information by writing a data
pattern to the medium one or more times;
b) a sanitize block erase operation that causes the device server to alter information by setting the
physical blocks to a vendor specific value; or
c) a sanitize cryptographic erase operation that causes the device server to change encryption keys to
prevent correct decryption of previously stored information, which may cause protection information, if
any, to be indeterminate.

So in theory, a drive conforming to spec must indeed make all data inaccessible one way or the other. In practice, you're at the mercy of the firmware developers, I would say.

[fthobe]

Hey,

The exact question was this:

sg_format I'm assuming you use the format command to wipe the drive although I'm not sure whether it's actually writing every bit in a block or just reformatting the blocks header. The man page doesn't seem to go into detail on that.

we are aware of the sanitize documentation, though thank you for your comment. The question was if regular format rewrites the entire block (eg with zeroes) or only the block header?

[mwilck]

I can only repeat that that's firmware functionality. The SCSI specification doesn't mandate a specific behavior. I don't think that you can rely on anything beyond what's in the spec, unless a specific vendor makes additional guarantees.