Page 3 of 4 FirstFirst 1234 LastLast
Results 21 to 30 of 38

Thread: Shred or wipe an old hard drive?

  1. #21
    Join Date
    Nov 2011
    Location
    /dev/root
    Beans
    Hidden!

    Re: Shred or wipe?

    Quote Originally Posted by unspawn View Post
    Sure enough these erase threads amaze me as well but more for the fact that nobody ever tells 'em to actually verify the end result (regardless of DBAN being able to verify passes). Even w/o practical forensics experience it should be just a common sense thing. Else why make an effort in the first place?..
    Do you mean that DBAN is the only good choice?

  2. #22
    Join Date
    Sep 2011
    Beans
    1,531

    Re: Shred or wipe?

    No. He has a point- it's good practice to verify that the wipe successfully wiped the drive regardless of which you use.

  3. #23
    Join Date
    Nov 2011
    Location
    /dev/root
    Beans
    Hidden!

    Re: Shred or wipe?

    Quote Originally Posted by Ms. Daisy View Post
    No. He has a point- it's good practice to verify that the wipe successfully wiped the drive regardless of which you use.
    I see

    Which method would you suggest?

    It's easy if using dd to write a file named blank until the partition is full and inspect it before wiping it. But the other wiping methods are said to be more efficient.

  4. #24
    Join Date
    Sep 2011
    Beans
    1,531

    Re: Shred or wipe?

    Quote Originally Posted by sudodus View Post
    I see

    Which method would you suggest?
    Thermite.

    As with most things in Linux there are numerous ways to accomplish the same thing. Just pick one you like.

  5. #25
    Join Date
    Nov 2011
    Location
    /dev/root
    Beans
    Hidden!

    Re: Shred or wipe?

    Quote Originally Posted by Ms. Daisy View Post
    Thermite.

    As with most things in Linux there are numerous ways to accomplish the same thing. Just pick one you like.
    You can use an axe and/or sledgehammer too

    But I meant a method to verify any of the suggested non-destructive methods to wipe. Maybe DBAN would be the best of those mentioned in this thread. I've heard of information retrieved from harddisks that have burned in a fire. Maybe that's a fairy-tale, maybe not

  6. #26
    Join Date
    Jan 2007
    Beans
    6,540
    Distro
    Ubuntu 13.04 Raring Ringtail

    Re: Shred or wipe?

    Quote Originally Posted by KegHead View Post
    What if I wanted to do more than one pass with zero's?
    You can check the instructions for any command by prefixing the command with man (for "manual"). So:
    Code:
    man sfill
    Will tell you what the various options do. Most man pages also have a fairly current version available on the net, just Google for it.

    As for sfill, omitting one of the -l switches makes it do two passes instead of one. There's absolutely no point in doing so, it won't make it wipe any better and just makes it take twice as long. A single pass renders your data unrecoverable to any software tool.

  7. #27
    Join Date
    Sep 2011
    Beans
    1,531

    Re: Shred or wipe?

    Quote Originally Posted by sudodus View Post
    You can use an axe and/or sledgehammer too

    But I meant a method to verify any of the suggested non-destructive methods to wipe. Maybe DBAN would be the best of those mentioned in this thread. I've heard of information retrieved from harddisks that have burned in a fire. Maybe that's a fairy-tale, maybe not
    Oh lol I misunderstood.

    To verify that our wiping program wrote zeros to the drive we will use the xxd command with the autoskip option. The output of the command on a drive that has been written with zeros should be only three lines. The first line should be the starting offset followed by row of zeros, the second line will be an asterisk (*) to indicate identical lines, and the third line should be the starting offset of the final line, also followed by a row of zeros. If the drive contains anything other than zeros, the data will be displayed. Type the following into the terminal to verify that the target drive was properly wiped.
    Code:
    sudo xxd -a /dev/sda
    from this
    http://www.epyxforensics.com/node/44
    Last edited by Ms. Daisy; March 9th, 2013 at 09:35 PM.

  8. #28
    Join Date
    Aug 2012
    Beans
    Hidden!

    Re: Shred or wipe?

    Quote Originally Posted by Ms. Daisy View Post
    <snip>...
    To verify that our wiping program wrote zeros to the drive we will use the xxd command with the autoskip option. The output of the command on a drive that has been written with zeros should be only three lines. The first line should be the starting offset followed by row of zeros, the second line will be an asterisk (*) to indicate identical lines, and the third line should be the starting offset of the final line, also followed by a row of zeros. If the drive contains anything other than zeros, the data will be displayed. Type the following into the terminal to verify that the target drive was properly wiped. ... <code snipped>
    Thanks for posting that Ms. Daisy, I'll never again have to sit with eyes glued to the surface scanner viewer window of Spinrite 6 (from grc.com) I was actually doing surface scans for drive maintenance, not for verifying, but it is great to know that when I use shred or dd on a drive I can now check the end results.

    Hexdumping a complete drive and autoskipping the empty space in a terminal, impressive. Many thanks and regards from coldcritter64.

  9. #29
    Join Date
    Nov 2011
    Location
    /dev/root
    Beans
    Hidden!

    Re: Shred or wipe?

    Quote Originally Posted by Ms. Daisy View Post
    Oh lol I misunderstood.

    from this
    http://www.epyxforensics.com/node/44
    Thank you

    So for example

    1. for the first drive (when totally wiped)
    Code:
    sudo xxd -a /dev/sda
    2. for the free space (when dd is used to create the file blank)
    Code:
    sudo xxd -a blank
    and then blank is removed
    Code:
    sudo rm blank
    Edit: and the output should look like this
    Code:
    0000000: 0000 0000 0000 0000 0000 0000 0000 0000  ................
    *
    00ffff0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
    Last edited by sudodus; March 9th, 2013 at 10:38 PM.

  10. #30
    WasMeHere is offline Iced Almond Soy Ubuntu, No Foam
    Join Date
    May 2008
    Location
    Sverige
    Beans
    1,133

    Re: Shred or wipe?

    Quote Originally Posted by KegHead View Post
    Hi!

    I'm just trying to figure out the correct terminal command using wipe three (3) times and an final wipe with zeros, only for free space.

    Can anyone advise, I don't want to make a mistake!

    Thanks!

    KegHead
    Hi Jim

    Boot from another drive, for example your Ubuntu install CD or USB drive. Mount the partition with your file browser.

    Assume it is partition /dev/sda1 and that it is mounted on /media/ubuntu

    Code:
    cd /media/ubuntu
    Check with
    Code:
    df .
    and when OK write to the file blank until the partition is full with
    Code:
    sudo dd if=/dev/urandom of=blank bs=4096
    Now you have one random write. Then use shred for two random writes and one zero pass on the file blank with
    Code:
    shred -n 2 -z blank
    Now check (if you like) with
    Code:
    sudo xxd -a blank
    You should get something like this output (the last address is probably different, but the content should be zeros all the way)
    Code:
    0000000: 0000 0000 0000 0000 0000 0000 0000 0000  ................
    *
    00ffff0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
    Finally remove blank
    Code:
    sudo rm blank
    and that's it

    Quote Originally Posted by Ms. Daisy View Post
    Oh lol I misunderstood.

    from this
    http://www.epyxforensics.com/node/44
    Thank you for your valuable link to
    Code:
    sudo xxd -a /dev/sda

Page 3 of 4 FirstFirst 1234 LastLast

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •