Re: New Data Wipe Tools

[Thomas C. Greene]

Dear List,

I have to apologize. I carelessly packed an old version of one of the Linux
wipe scripts (wipefree1.sh) in the archive (LinuxWipeTools.tar.gz) that I
posted. I corrected it on Friday night. If you've downloaded the archive
already, I suggest you do so again from http://basicsec.org/tools.html

Thanks to Jake Appelbaum <jacob@appelbaum.net>, who made some good criticisms
here on the list, I also included more caveats and disclaimers in the README
file so that users won't expect too much of the scripts.

chrz,
--tcg

===============
Thomas C. Greene
Associate Editor
The Register
http://www.theregister.co.uk
http://basicsec.org

----------------------------------------------

Subject: New Data Wipe Tools
Date: Wednesday 08 September 2004 17:10
From: "Thomas C. Greene" <thomas.greene@theregister.co.uk>
To: <bugtraq@securityfocus.com>

I've created a few simple shell scripts that use /dev/urandom to wipe data
from the swap partition, wipe unused disk space on the root partition, or
wipe an entire disk. You'll find them at http://basicsec.org/tools.html.

Data hygiene is generally easier on *nix because there are fewer hiding
places than on a Windows system, but there are no free wipe tools that i'm
aware of. So I got busy.

This is not a perfect solution, but it's a step. I'd be delighted to knows
from fellow list members what I might do to improve them. The scripts are
freely available and freely modifyable (is "modifyable" a legitimate word?)

PS: See the README file for cautions, exceptions, and caveats.

thanks,
--tcg

===============
Thomas C. Greene
Associate Editor
The Register
http://www.theregister.co.uk
http://basicsec.org

[Jake Appelbaum]

--=-TedcgKkl2x2sSaVj5R+K
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable

On Wed, 2004-09-08 at 17:10, Thomas C. Greene wrote:
> I've created a few simple shell scripts that use /dev/urandom to wipe dat=
a=20
> from the swap partition, wipe unused disk space on the root partition, or=
=20
> wipe an entire disk. You'll find them at http://basicsec.org/tools.html.

While I think it's very useful to use a random source of data, you might
also want to try using 'aespipe' from the loop-aes package
(http://loop-aes.sf.net). You can pipe /dev/zero at aespipe. With random
keys you have a much faster source of data to fill the device.

Change the key each overwrite and overwrite a number of times.

> Data hygiene is generally easier on *nix because there are fewer hiding p=
laces=20
> than on a Windows system, but there are no free wipe tools that i'm aware=
of. =20
> So I got busy.

It only seems easier. But the data isn't gone per se.

>=20
> This is not a perfect solution, but it's a step. I'd be delighted to kno=
ws=20
> from fellow list members what I might do to improve them. The scripts ar=
e=20
> freely available and freely modifyable (is "modifyable" a legitimate word=
?)=20

I suggest at the very least, multiple overwrites. A single overwrite
isn't going to erase the data in an unrecoverable manner. It's better
than just rm'ing the file, but it's still recoverable. It really depends
on the threat you are worried about. If it's your kid sister, a simple
'rm -rf' might do. If it's a place where you're selling your hard drive
on ebay, you might want to wipe the entire drive*. If you're worried
that the FBI is going to kick down your door (and you haven't been
served just yet), you want to wipe the drive many times over. Then open
it, sand it down and put it in the microwave for effect :-)

Magnetic force microscopy is a threat that is very real for many people.

It would be of great help for you to read this paper:
http://www.cs.auckland.ac.nz/~pgut00...ecure_del.html

You could also tell users to start off with proper disk encryption in
the first place. It doesn't matter as much about wiping a disk when all
of the data is encrypted. We can all dream, can't we?

If you are really interested, I suggest you also pick up a copy of
"Computer Forensics" by Kruse and Heiser.

* for the record I would not sell my hard drive on ebay with one wipe or
even with many. I know I have bought a few drives just to practice my
recovery skills, I am sure others do this as well.
--=20
Jake Appelbaum <jacob@appelbaum.net>

--=-TedcgKkl2x2sSaVj5R+K
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----

iD8DBQBBQede18o6ui/odcwRAkwUAJ99OPwmgAvBMrsS074ij4TIQdR2lwCeMNtz
P64fGMuwOPPPp/KWLk4LsTw=
=xSK/
-----END PGP SIGNATURE-----

--=-TedcgKkl2x2sSaVj5R+K--

[Brendan Murray]

On Thu, 2004-09-09 at 12:10, Thomas C. Greene wrote:
> I've created a few simple shell scripts that use /dev/urandom to wipe data
> from the swap partition, wipe unused disk space on the root partition, or
> wipe an entire disk. You'll find them at http://basicsec.org/tools.html.
>
> Data hygiene is generally easier on *nix because there are fewer hiding places
> than on a Windows system, but there are no free wipe tools that i'm aware of.
> So I got busy.

DBAN is a nice little tool to wipe disks. Not so good for cleaning up
mem or slack space though, or not so I'd noticed.

"Darik's Boot and Nuke ("DBAN") is a self-contained boot floppy that
securely wipes the hard disks of most computers. DBAN will automatically
and completely delete the contents of any hard disk that it can detect,
which makes it an appropriate utility for bulk or emergency data
destruction."

http://dban.sourceforge.net


>
> This is not a perfect solution, but it's a step. I'd be delighted to knows
> from fellow list members what I might do to improve them. The scripts are
> freely available and freely modifyable (is "modifyable" a legitimate word?)

I think modifiable is.
>
> PS: See the README file for cautions, exceptions, and caveats.
>
> thanks,
> --tcg
>
> ===============
> Thomas C. Greene
> Associate Editor
> The Register
> http://www.theregister.co.uk
> http://basicsec.org
>
>
--
Brendan Murray brendan@wolfhoundsecurity.com
The Observation Post www.wolfhoundsecurity.com
14 Centre Road Phone: +64-3-4543282
RD 2 Ocean Grove Fax: +64-3-4543285
Dunedin. New ZEALAND Mobile: +64-21-1153290
Key fingerprint = 6F3C 3197 8C30 47EF 4E1A 5781 5DCA D13C E895 6106