New Data Wipe Tools

[Thomas C. Greene]

I've created a few simple shell scripts that use /dev/urandom to wipe data
from the swap partition, wipe unused disk space on the root partition, or
wipe an entire disk. You'll find them at http://basicsec.org/tools.html.

Data hygiene is generally easier on *nix because there are fewer hiding places
than on a Windows system, but there are no free wipe tools that i'm aware of.
So I got busy.

This is not a perfect solution, but it's a step. I'd be delighted to knows
from fellow list members what I might do to improve them. The scripts are
freely available and freely modifyable (is "modifyable" a legitimate word?)

PS: See the README file for cautions, exceptions, and caveats.

thanks,
--tcg

===============
Thomas C. Greene
Associate Editor
The Register
http://www.theregister.co.uk
http://basicsec.org

[Derek Martin]

--IS0zKkzwUGydFO0o
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline

On Fri, Sep 10, 2004 at 10:17:05AM -0700, Thomas C. Greene wrote:
> Data hygiene is generally easier on *nix because there are fewer hiding
> places than on a Windows system, but there are no free wipe tools that i'm
> aware of. So I got busy.

Well, there's GNU shred, which is part of the GNU coreutils package...
And there are at least a few others:

http://freshmeat.net/search/?q=secur...&Go.x=0&Go.y=0
http://www.google.com/search?hl=en&l...ux&btnG=Search

I have not used any of these tools, and do not endorse any of them.

--
Derek D. Martin
http://www.pizzashack.org/
GPG Key ID: 0x81CFE75D


--IS0zKkzwUGydFO0o
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQFBQ9ccdjdlQoHP510RAqjIAJ4nt/SY/xEbDwhGeNybZjbAaXNGiwCghdBq
Icjc7BMl5AQQo9fCISGiyfk=
=wo/4
-----END PGP SIGNATURE-----

--IS0zKkzwUGydFO0o--

[Altheide, Cory B.]

> -----Original Message-----
> From: Jake Appelbaum [mailto:jacob@appelbaum.net]
> Sent: Friday, September 10, 2004 10:42 AM
> To: Thomas C. Greene; bugtraq@securityfocus.com
> Subject: Re: New Data Wipe Tools
>
> Magnetic force microscopy is a threat that is very real for
> many people.
>
> It would be of great help for you to read this paper:
> http://www.cs.auckland.ac.nz/~pgut00...ecure_del.html
>

Yes, and pay special attention to this portion:

"Epilogue

In the time since this paper was published, some people have treated the
35-pass overwrite technique described in it more as a kind of voodoo
incantation to banish evil spirits than the result of a technical analysis
of drive encoding techniques. As a result, they advocate applying the voodoo
to PRML and EPRML drives even though it will have no more effect than a
simple scrubbing with random data. In fact performing the full 35-pass
overwrite is pointless for any drive since it targets a blend of scenarios
involving all types of (normally-used) encoding technology, which covers
everything back to 30+-year-old MFM methods (if you don't understand that
statement, re-read the paper). If you're using a drive which uses encoding
technology X, you only need to perform the passes specific to X, and you
never need to perform all 35 passes. For any modern PRML/EPRML drive, a few
passes of random scrubbing is the best you can do. As the paper says, "A
good scrubbing with random data will do about as well as can be expected".
This was true in 1996, and is still true now."

Summary: Gutmann's paper is an academic snapshot that was valid for a short
period of time 8 years ago. While an excellent read, it is no longer
relevant with modern fixed-disk storage. Wipe once and you've jumped
*extremely* far up the data recovery Bell curve. Once you're dealing with
near-mythical advesaries who have the capability (budget + skill + desire)
to recover overwritten data, you're better off disappearing the meat instead
of the bits.

Cory Altheide
Senior Network Forensics Specialist
NNSA Information Assurance Response Center (IARC)
altheidec@nv.doe.gov