(solved) How to probe for hot added IDE drive on live cd

[StifflerStealth]

Hey all,

I'm trying to fix a friend's Windows XP laptop with a very corrupted file system. The only way to get into it is to boot a Gentoo Linux CD and transfer the files to an external hard drive. I managed that, but now I want to wipe the drive using the internal security erase feature, however, the bios issues a security freeze on boot, so I can't do that. On trick is to remove the drive, then hot add it later. Since it's a laptop hard drive, I don't have an adapter to plug it into a desktop with IDE support.

I wait for the boot sequence to reach the CD, and then plug the drive back in. I select the kernel I want and it boots fine, but it does not see the hard drive. I plug the drive in before selecting the kernel, so I thought it would be detected. Is there a way to force detect the hard drive after boot? Or, do you think the bios is turning off the controller when the drive is not detected? Is there a way to force it on?

I would like to use the built in security erase, because it reaches sectors that are not accessible to user programs, even DD. It also helps in detecting drive errors which I suspect there is, but will not know for sure.

Is there anything else I could try that will bypass the bios security freeze?

thanks.
_________________
Nothing to read in this sig. Move along.

[NeddySeagoon]

StifflerStealth,

A few things. IDE drives are not hot pluggable. Some vendors, particularly with drive caddies, make special arrangements to separate data and power timing, so that the drive is not damaged.

As IDE is not designed to be hot pluggable, the kernel does not support it. The only way around that is to make the IDE driver a module and (re)load it after the drie is connected. This won't work if the drive holds the root partition, since you can't unload the module.
You may be able to work around that with a custom initrd that had a long pause to allow you to insert the drive ... but be careful as the hardware can be damaged.

Thats answered you rquestion, now some speculation.
I suspect your drive contains a host protected area ... look in dmesg for references to HPA and the drive.
This means that the drive has been programmed to lie about its size, so the HPA is not available to users. This area is normally used for diagnostics and a restore area, so the user cannot accidently delete it. IF you have a HPA, think twice about removing it.

If you really want to remove the HPA, you can (I forget how) then dd can get at the whole drive.
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.

[StifflerStealth]

Thanks for the info. Luckily the drive did not have a hpa. It was just one partition. I was in a Gentoo live CD environment, so I was able to reload all the modules pertaining to IDE host controllers and Drives, in that process I managed to get the drive recognized and since it was powered up after the bios, it no longer had the bios issued lock out so I was able to perform the secure-erase commands of hdparm. It was a long and complicated process since it was an old laptop with an IDE drive.

I was thinking there was a special probe program that had to be run to gather drive information, like there is for SCSI drives. I didn't think it was reloading the modules.

Well, one problem with the laptop solved!

Thanks again.
_________________
Nothing to read in this sig. Move along.