Linux command to query hard drive information

What Linux distribution are you using?

If it is one that 'helpfully' automounts file systems on hard drives, you could either stop it doing so by editing a config file (I have to admit to not knowing which one off the top of my head), or boot your computer with any one of the forensic Linux boot disks, and use the same commands you are using now.

I have the Ubuntu based SMART Linux installed on a machine and the hdparm command is definitely in there (I've just checked).

You're using a write blocker because you don't want writes to the drive, but if your Linux box doesn't automount for you then you have no need for a write blocker.

HTH

For on-site acquisition, I am using Helix. I prefer using the HWB as it ensures the integrity of the process especially if you are in front of a lawyer, judge, etc.

The problem is not that hdparm is not on the system, though. The issue is when you attach a disk via USB/Firewire (i.e. not directly on an ATA/IDE bus), hdparm generally fails on the IDENTIFY command. I wondered if anyone has found other commands that nicely query a USB attached drive in Linux. The next best thing I have found, as I mentioned, is lshw. Thanks.

What information do you need that isn't obtained by the Tableau?

It would be nice, as a matter of record, to have the following (which is a sample of hdparm -I /dev/hda)

/dev/hda

ATA device, with non-removable media
Model Number WDC WD400BB-00DEA0
Serial Number WD-WMAD11111111
Firmware Revision 05.03E05
Standards
Supported 5 4 3
Likely used 6
Configuration
Logical max current
cylinders 16383 16383
heads 16 16
sectors/track 63 63
–
CHS current addressable sectors 16514064
LBA user addressable sectors 78165360
device size with M = 1024*1024 38166 MBytes
device size with M = 1000*1000 40020 MBytes (40 GB)
Capabilities
LBA, IORDY(can be disabled)
bytes avail on r/w long 40
Standby timer values spec'd by Standard, with device specific minimum
R/W multiple sector transfer Max = 16 Current = 0
Recommended acoustic management value 128, current value 254
DMA mdma0 mdma1 mdma2 udma0 udma1 *udma2 udma3 udma4 udma5
Cycle time min=120ns recommended=120ns
PIO pio0 pio1 pio2 pio3 pio4
Cycle time no flow control=120ns IORDY flow control=120ns
Commands/features
Enabled Supported
* SMART feature set
Security Mode feature set
* Power Management feature set
* Write cache
* Look-ahead
* Host Protected Area feature set
* WRITE_BUFFER command
* READ_BUFFER command
* DOWNLOAD_MICROCODE
SET_MAX security extension
Automatic Acoustic Management feature set
* Device Configuration Overlay feature set
* SMART error logging
* SMART self-test
Security
supported
not enabled
not locked
not frozen
not expired security count
not supported enhanced erase
HW reset results
CBLID- above Vih
Device num = 0 determined by CSEL
Checksum correct

Hey ahoog,

Just type in google "tableau-parm"

Regards

Thanks a bunch, it looks great and exactly what I needed! The project webpage just gives me a 404

http//projects.sentinelchicken.org/tableau-parm

but this page

http//www.asoto.com/id247.html

had some information. I'll install this weekend and test. Thanks again.

That did the trick, thanks a bunch. For those interested, here's sample output when connected to a SATA drive and USB to my workstation

wintermute/home/ahoog/src/tableau-parm-0.1.0# tableau-parm /dev/sde
## Bridge Information ##
chan_index 0x00
chan_type SATA
writes_permitted FALSE
declare_write_blocked TRUE
declare_write_errors TRUE
bridge_serial 000ECC020035C00F
bridge_vendor Tableau
bridge_model T35e
firmware_date Jul 11 2007
firmware_time 125543

## Drive Information ##
drive_vendor
drive_model WDC WD2500JD-55HBB1
drive_serial WD-WCAL73972498
drive_revision 08.02D08

## Drive HPA/DCO/Security Information ##
security_in_use FALSE
security_support TRUE
hpa_in_use FALSE
hpa_support TRUE
dco_in_use FALSE
dco_support TRUE
drive_capacity 488397168
hpa_capacity 488397168
dco_capacity 488397168