file wiper

Hi all,

I'm looking for a linux file wiper program to completely erase data from a harddrive. Anyone have any suggestions? Thanks

Hi,

Try shred, it's part of the coreutils so it should be on your box.

Hope this helps.

Thanks for quick reply. I read the man pages on shred and it notes the following:

CAUTION: Note that shred relies on a very important assumption: that the filesystem overwrites data in place. This is the traditional way to do things, but many modern filesystem designs do not satisfy this assumption. The following are examples of filesystems on which shred is not effective:

* log-structured or journaled filesystems, such as those supplied with AIX and Solaris (and JFS, ReiserFS, XFS, Ext3, etc.)

* filesystems that write redundant data and carry on even if some writes fail, such as RAID-based filesystems

* filesystems that make snapshots, such as Network Appliance’s NFS server

* filesystems that cache in temporary locations, such as NFS version 3 clients

* compressed filesystems

I use a Ext3 filesystem on Fedora 3.

Hi again,

Reading the manpages is always a good thing

Almost posted the link for wipe, but this one also excludes ext3 (journaling) filesystems.

Maybe this one does work: http://sourceforge.net/projects/srm/

Did not see any warnings about journaling fs, but they could be in the manpage once you downloaded/installed it. Do be carefull.

Another thing:

Don't know why you need to do this and how often you have to do it. You might consider making (part of) your partitions encrypted and keep the data safe (well, 99,9% safe that is).

Well, if you're wiping the entire drive it dosen't matter if you are using a journaling file system, because the journal gets lambasted as well. If you are shreding specific files and not the entire drive with a journal, then you should be worried.

If the data on the drive is really sensitive, take the drive out, hit it with a sledgehammer and melt it. I'm serious. "Echos" of the data you once had on there still exists. Shred goes down 35 layers, so its genereally pretty secure. I think the FBI can go down 7 layers with special lab equipment. Play it safe and shred the hell out of it. Even shred cannot destroy bad sectors where data still resides. So, there is never 100% certainty that data is unrecoverable unless you heat that drive up past 1200 degrees farenheit for an extended period of time.

I've downloaded srm and read through the man pages and it doesn't say anything about journaling filesystems. I don't want to destroy the harddrive, but simply be able to create a directory, which contains sensitive data, and destroy the directory if I need to. In Windows there is a proram called Ultrawipe that applies some DoD (Department of Defense) algorithm so the data is completely lost. I was looking for something similar for my linux box. Thanks for the help.

One of my favorite utilities is Darik's Boot and Nuke (http://dban.sourceforge.net/). It utterly destroys all data, partitions, whatever, on a hard drive, so if you want to be selective, DBAN is not applicable. You can set the number of random overwrites from 3 to 35. The best thing is, it fits on a bootable diskette. When it has finished cleaning the drive, it writes a report to the diskette.

When I rebuild a computer, I nuke the drives using the the (default) 3 times overwrite, which gives them a pretty thorough workout. I then test them using the manufacturer's software, generally available at the manufacturer's website. If they pass, I assume they are good as new.

I hope this helps.

If you really just want a scratch directory to work on sensitive data only to wipe the contents out later, why not create a new partition that isn't ext3 and mount it specifically for this purpose?

Obviously there are better options (like making the partition encrypted), but this should do what you want.

Micah

TJandE,

Good advice. Thank you. How do you make encrypted partitions and can this be done with the system already running or does this need to be done on a fresh install? Making and encrypted partition that is compatable with shred seems to be a good idea.

I haven't personally needed an encrypted partition yet. http://encryptionhowto.sourceforge.net/ seems to have all the info for Linux distros. It appears to need a kernel patch or two, but that should be explained in the howto.

Micah

try BCWIPE you can wipe entire filesystems off devices with a 35-pass write of random data or you can specify the number of passes your self. The 7-pass option is what the Department of Defense says is standard for securely wiping info from a harddrive.
It's free and you can get it thru a google search. its like 24kb.

Hey, I like it, it rules!
like: bcwipe -md /dev/hd* or /dev/sd*

md is the 7pass DoD statndard or mg is peter Gutmanns 35-pass wipe.

check it out

Originally posted by Travers If the data on the drive is really sensitive, take the drive out, hit it with a sledgehammer and melt it. I'm serious. "Echos" of the data you once had on there still exists. Shred goes down 35 layers, so its genereally pretty secure. I think the FBI can go down 7 layers with special lab equipment.

This may have been true a couple of years ago, but not any more. If the info is classified, then by all means, do a DoD spec wipe (although it won't declassify the drive). You really don't need to do DOD spec wipes on the drives you are giving away or retiring unless you are afraid a hostile government will get ahold of them AND they might suspect there is useful classified data on them AND they could afford to spend the time and money doing a microscopic magnetic recovery. If it's just credit card files / pr0n, or your companies IP, etc. Then no one will bother if the drives are simply zero'd.

If the FBI needed to "go down 7 layers", they would call the NSA who MIGHT be able to do this. But only for a *real* good reason, and if it was worth the months of man hours and millions of dollars. With the current density on newer disks, this sort of thing has become nearly impossible.

Read this paper. And be sure to pay attention to the Epilouge.

bg

Hey man, secuirty is about paranoia. The best network secuity guys have paranoid schizophrenia. When you think the coffee maker is out to get you, then you make sure the network is damned secure. =)

There is an option for mount, something like "-nosync", which switches of buffering thus enforcing imediate writes to the hd. Might also be a good idea to use (possibly also in /etc/fstab) e.g. for the cases where your directory-(content) is smaller than the buffer...