The original post: /r/datahoarder by /u/InsecureErasure on 2024-07-23 16:02:41.
I recently purchased a Western Digital hard drive, specifically model WD10SPZX (WD Blue 2.5'' SATA 1 TB) through Amazon. I wasn't looking for anything special, just another drive to copy some data to, so SMR was just acceptable to me.
For obvious reasons, I checked the S.M.A.R.T. data to see if it was indeed a new disk. According to this data, it had only been on for 3 hours. I didn't think much of it, as I found that this may be normal for some manufacturers who perform quality tests on their disks.
However, I was not entirely convinced and decided to go further and used some tools to recover disk data. My surprise was huge when I found that the disk had at least two partitions with data: a first VFAT partition with what seems to be FreeDOS and another one with software that I haven't had time to check yet, but that seems to be related to Lenovo recovery partitions (still digging into this.)
These are the contents of the first partition:
$ sudo fdisk -l /dev/sdc
Disk /dev/sdc: 931.51 GiB, 1000204886016 bytes, 1953525168 sectors
Disk model: SPZX-24Z10
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes
Disklabel type: gpt
Disk identifier: 6F955C7F-6D3B-F440-9B5A-AD08401E16B2
Device Start End Sectors Size Type
/dev/sdc1 2048 2050047 2048000 1000M Microsoft basic data
/dev/sdc2 2050048 1953521663 1951471616 930.5G Microsoft basic data
$ findmnt /mnt
TARGET SOURCE FSTYPE OPTIONS
/mnt /dev/sdc1 vfat ro,relatime,fmask=0022,dmask=0022,codepage=437,iocharset=ascii,shortname=mixed,utf8,errors=r
$ ls /mnt
COMMAND.COM KERNEL.SYS LICENSE.TXT README.TXT SRC 'System Volume Information'
$ cat /mnt/README.TXT
Readme file
This is a freedos system, The kernel included on the boot disks is 2026a, the freedos kernel source is src\KE2026AS.ZIP, or you can found at http://www.freedos.org/, the command shell inlcuded is 0.84-pre, the source is src\commands.zip, or you can be found at http://www.freedos.org/
Jun 28, 2006
The disk was advertised as new and was sold directly by Western Digital in Europe (labeled as coming from Germany.)
Have you come across similar cases with Western Digital disks or other manufacturers?
I am still investigating the contents of the disk with forensic tools looking for more data. Am I being overly paranoid and this is content that may be there due to the quality testing they put the disks through?
Thanks in advance!