When running a server of any volume, it is likely that there is sensitive data stored on it. Knowing how to destroy that data with confidence is an important skill for any system admin. Luckily Linux has several utilities that can be used to securely wipe partitions, drives, and even an entire server. The tools that I will be looking at are shred, dd, wipefs, and DBAN.
Shred is a common utility that has been around for a while. Shred works by overwriting data to essential make it unrecoverable. By default, it does 3 overwrites, but can be told to do more. An important thing to understand is that it is less effective on certain filesystems. Namely, those are log-structured/journaled filesystems, RAID-based filesystems, Network Files Systems, and compressed filesystems. In simpler terms, it works better on older filesystems and worse on newer ones. If shred is not already installed, it can be installed with the following commands:
# apt-get install coreutils
or
# yum install coreutils
To wipe the 3rd partition on the first drive, the following command could be ran:
# shred –vfz –n 25 /dev/sda3
The –v switch will output the operation on screen. –f will force the wipe even if there are permission discrepancies. –z tells shred to overwrite with all zeros. Lastly, -n tells shred how man overwrite operations to perform, in this case 25.
The same can be done to an entire drive by removing the partition number:
# shred –vfz –n 25 /dev/sda
A random data source can also be used with shred to be used for the overwrite by adding the following switch to the command:
# –random-source=FILENAME
/dev/zero or /dev/urandom can be used and are often already part of the distros image.
dd is a very powerful utility often used to create bit-by-bit perfect data copies. However it can also be used to destroy data. The following is pseudocode for wiping a partition with dd:
# dd if=RANDOMDATA of=/dev/sda1 bs=sector_size
# count=sector_number seek=sector_where_to_start
Wiping an entire drive will have the following syntax:
# dd if=RANDOMDATA of=/dev/sda bs=physical_sector
# count=every_physical_sector seek=0
Some investigation will need to be done with a utility such as fdisk to determine the bs, count, and seek information. The one constant is that if you are wiping an entire drive, the seek will equal 0. dd also requires a random data source, so /dev/zero or /dev/urandom can be put in place of RANDOMDATA.
wipefs, or sometimes just called wipe, is a utility that removes filesystem signatures. This essentially makes the filesystem undetectable by the libblkid library that identifies block devices. It does NOT destroy data, but it can be used as a way to format a drive to allow new data to be written to it. A practical use for this may be repurposing a USB drive or SD card. The following is an example:
# wipefs –a /dev/sde
The –a switch tells it to wipe all partitions. –no-act can be used to see what the results will be without performing the actions.
Lastly, there is DBAN or Darik’s Boot and Nuke. DBAN itself is a free opensource software that is meant for personal use and has no certifiable guarantee of destruction. However there is an enterprise version called blancco that requires a purchase. To use DBAN, it must be put on a bootable device such as a CD or USB drive. Once booted into the software, there is a simple interface that can be used to select the desired drives to be wiped. If wiping the entire server or device is the goal, booting to an external media is the best choice.
Choosing the right utility to perform data destruction is half the battle and knowing the capabilities (and non-capabilities) of whatever is being used is even more important. I would highly recommend reading the man pages for any of these utilities before using them. These tools are invaluable for day-to-day life cycling of equipment and in incident response for data leakage.
*NOTE: Use these utilities at your own risk. Misuse of these utilities can make data completely unrecoverable. I am not responsible for any loss of data.
References:
Binnie, C. (2016). Practical Linux topics. Berkeley, CA: Apress.
