Securely Erasing a Disk

From Leo's Notes
Revision as of 18:32, 3 April 2021 by Leo (talk | contribs) (badblocks)
This page was last edited on 3 April 2021, at 18:32.

Here are some tools and methods to wipe a disk securely.

Tools

dd

Write zeros or pseudorandom data: 

# dd if=/dev/zero of=/dev/sda bs=4K status=progress
# dd if=/dev/urandom of=/dev/sda bs=4K status=progress

dcfldd

dcfldd is based on an old version of dd and has some extra features. It hasn't been updated since 2006. If you only want to write a bit pattern, also look at badblocks.

You can specify a bit pattern: 

# dcfldd pattern="00" of=/dev/sda
# dcfldd pattern="FF" of=/dev/sda

shred

Shred comes as part of coreutils. It will overwrite a file with random data. 

# shred /dev/sda

badblocks

Badblocks can be used to write to and verify a storage device. 

# badblocks -v -w -s -b 4096 -t 0xff /dev/sda

Options are:

  • -v : verbose
  • -w: write
  • -s: show progress
  • -b: block size
  • -t: test pattern

ATA Secure Erase

Modern ATA devices support a security feature which allows for the firmware to initiate a security erase. You need the enable security by setting a password before you can initiate a secure erase.

A ATA secure erase can be done with hdparm.

  1. Enable security using hdparm. 
    # hdparm --user-master u --security-set-pass password /dev/sda
  2. Verify security is enabled. 
    # hdparm -I /dev/sda
  3. Issue the ATA secure erase command. 
    # hdparm --user-master u --security-erase password /dev/sda
  4. Once erased, ensure security is disabled. 
    # hdparm -I /dev/sda


DBAN

Darik's Boot and Nuke. A live disk which will automatically wipe any connected storage devices. This doesn't appear to be updated anymore and newer hardware might not be supported.

DBAN supports the following wipe methods:

  • Quick Erase
  • Canadian RCMP TSSIT OPS-II Standard Wipe
  • American DoD 5220-22.M Standard Wipe
  • Gutmann Wipe
  • PRNG Stream Wipe

Methods

Here are some common wipe methods explained.

DoD 5220.22-M (C)

The DoD 5220.22-M (C) requires overwriting an entire device with a pseudo-random bit pattern once.

DoD 5220.22-M (E)

The DoD 5220.22-M (E) standard, also referred to as the DoD 3-pass method, requires the following:

  1. Overwrite with binary 0's
  2. Overwrite with binary 1's
  3. Overwrite with a random bit pattern

DoD 5220.22-M ECE

DoD 5220.22-M ECE combines DoD 5220.22-M E, C, and E to form a 7-pass variant.

Canadian RCMP TSSIT OPS-II

The Canadian RCMP TSSIT OPS-II wipe method is a 7-pass process:

  1. Overwrite with binary 0's
  2. Overwrite with binary 1's
  3. Overwrite with binary 0's
  4. Overwrite with binary 1's
  5. Overwrite with binary 0's
  6. Overwrite with binary 1's
  7. Overwrite with a random bit pattern and verify the write

Gutmann method

For the overly paranoid, the Gutmann method uses 35-passes using pseudo-random and bit patterns to wipe a device. This is done with the assumption that intelligence agencies can somehow detect the previous bit values using magnetic force microscopes and image analysis.

See: https://en.wikipedia.org/wiki/Gutmann_method