A bad sector in computing is a disk sector on a disk storage unit that is unreadable. Upon taking damage, all information stored on that sector is lost. When a bad sector is found and marked, the operating system like Windows or Linux will skip it in the future. Bad sectors are a threat to information security in the sense of data remanence.
Bad sectors can be "soft" (logical) or "hard" (hardware, physical), depending on what is making the sector inaccessible. In case of power loss, bit rot (more likely on floppy disks), or firmware issues, the on-disk format can be corrupt beyond what the error correcting code can fix. This is a "soft" bad sector: writing over the corruption would succeed.[1]
On the other hand, sectors broken physically cannot be restored: writing would fail, forcing a remap. A new drive may start with some innocuous bad sectors due to manufacturing flaws. Larger patches occur throughout use, due to head crash, wear-and-tear, physical shock, or dust intrusion.[2][1]
Bad sectors may be detected by the operating system or the disk controller. Most file systems contain provisions for sectors to be marked as bad, so that the operating system avoids them in the future. Disk diagnostic utilities, such as CHKDSK (Microsoft Windows), Disk Utility (on macOS), or badblocks (on Linux) can actively look for bad sectors upon user request.
With the advent of SMART-enabled disk controllers (see below), the burden of avoiding bad sectors more commonly falls to the disk.[3] Some newer file systems such as Btrfs and ZFS do not have a bad-block avoidance feature at all.[4] Software tools that look for bad blocks still have a use case: by issuing writes at detected bad sectors, one can expedite the remapping process, avoiding further attempts at reading the bad sector.[5]
When a sector is found to be bad or unstable by the firmware of a disk controller, a modern (post-1990) disk controller remaps the logical sector to a different physical sector. Typically, automatic remapping of sectors only happens when a sector is written to – failed reads remain marked "pending". In the normal operation of a hard drive, the detection and remapping of bad sectors should take place in a manner transparent to the rest of the system and in advance before data is lost. There are two types of remapping by disk hardware: P-LIST (mapping during factory production tests) and G-LIST (mapping during consumer usage by disk microcode).[3]
Utilities can read the Self-Monitoring, Analysis, and Reporting Technology (SMART) information to tell how many sectors have been reallocated, and how many spare sectors the drive may still have.[6] Because reads and writes from G-list sectors are automatically redirected (remapped) to spare sectors, it slows down drive access even if data in drive is defragmented. Once the G-list is filled up, the storage unit must be replaced.[7][8]
Compared to ATA, the SCSI command set allows finer-grained management of bad sectors. Users can read the G-LIST, control whether automatic remap is performed, and use a dedicated command REASSIGN BLOCKS to manually remap if needed. The command set also provides a way to perform low-level format with FORMAT UNIT.[9]
The Windows program ATATool can be used to create deliberate "soft" bad sectors by manipulating the sector Error correction code (ECC) data. This can be used to verify bad sector support in disk utilities and forensic tools. For instance, to make sector 10 bad:
ATATOOL /BADECC:10 \\.\PhysicalDrive1
hdparm has a --make-bad-sector command that works similarly. For newer drives, it can alternatively use WRITE_UNCORRECTABLE_EXT to "flag" a sector as bad: the drive controller would not attempt to read, but fail immediately.[5]
In a 2007 study, CERN observed 1.53 million hard drives from 30 models over 32 months and analyzed the drive read errors returned. They noted that 3.5% of drives developed "latent read error" (i.e. unreadable bad sector), and that a disk with a bad sector is more likely to develop more. Bad sectors cluster spatially (in a 10–MB neighborhood) and temporally. Errors recovered by ECC, which are reported by enterprise drives (using the SCSI command set), also suggest a higher chance of a bad sector in the future.[10]