[Discuss] Weird new non-empty Dell disk

[bogstad at pobox.com (Bill Bogstad)]

Summary:  Dell shipped me a no-OS server with a pile of factory
diagnostics software "hidden" on the disk.

Was this a mistake at the factory?
Has anybody had something like this happen before?
Any curiosity about what a top 10 ODM (Wistron) uses for testing/configuration?
Other thoughts?

Bill Bogstad

Details:

I bought a low end server directly from Dell (PowerEdge T20) without
an OS, but with a hard drive. This was to replace an older system.
When the new system arrived, I ran the UEFI based diagnostics on it
and in the process noticed that the drive seemed to have no partitions
or OS (as expected).   I physically moved the boot drive containing an
Ubuntu installation from the old system to the new T20.   I've done
this kind of thing before with little or no difficulty and was able to
quickly bring up the new computer with the old system
install/configuration.

WEIRDNESS STARTS here:

Before formatting the drive that came with the new system, I decided
to check and see if there was anything on it.   When, I found it
wasn't blank; but clearly had software on it; I verified it had no
partition table and used testdisk:

http://www.cgsecurity.org/wiki/TestDisk

to recover the "lost" partitions.  TestDisk found two partitions and
reinitialized the
MBR with the following results:

# fdisk -l /dev/sda

Disk /dev/sda: 1000.2 GB, 1000204886016 bytes
255 heads, 63 sectors/track, 121601 cylinders, total 1953525168 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes
Disk identifier: 0x00000000

   Device Boot      Start         End      Blocks   Id  System
/dev/sda1   *          63    22619519    11309728+   c  W95 FAT32 (LBA)
Partition 1 does not start on physical sector boundary.
/dev/sda2        22619520  1953520064   965450272+   7  HPFS/NTFS/exFAT

I now had two partitions which basically cover the whole disk.  I
mounted them read-only:

# mount | grep /mnt/tmp
/dev/sda1 on /mnt/tmp type vfat (ro)
/dev/sda2 on /mnt/tmp2 type fuseblk (ro,nosuid,nodev,allow_other,blksize=4096)
# df /mnt/tmp /mnt/tmp2
Filesystem     1K-blocks    Used Available Use% Mounted on
/dev/sda1       11298672  379824  10918848   4% /mnt/tmp
/dev/sda2      965450272 7822948 957627324   1% /mnt/tmp2

In total, over 8 Gigs of files, software, etc. are on the two
partitions.  The first one is a MS-DOS 5.0 bootable partition while
the second seems to be some version of Windows.   They are both filled
with what appears to be testing and system management software etc.
There are Windows WIM system image files, Norton's ghost utility,
management utilities written in Perl and Python (with the required
dos/windows based interpreters), etc.   There are references to
Wistron (a Taiwanese ODM for Dell).   Most files have dates going back
years, but there are some from September which appears to be when the
system was tested.   Some of those have the unique Dell Service Tag #
of the computer in them.
I tried booting off of the drive and it booted into some kind of
graphics environment with a command prompt window running scripts.   I
chickened out
before it got too far as I hadn't disconnected my Ubuntu data/OS drives.

I'm guessing that this is a test image used by the manufacturer.
Rather then wiping the whole drive, they just zeroed out the partition
table after testing.  It seems that lots of it has nothing to do with
my system, but it was just easier for them to include everything they
might need in their test image then it would be to strip it down for
the particular production run.

I bought two T20s at the same time.  I'll let people know if the
second system has the same thing on its empty drive or if I figure
more things out.