This is a read-only archive. Find the latest Linux articles, documentation, and answers at the new Linux.com!

Linux.com

Feature

Darik's Boot and Nuke: A great tool for obliterating your data

By Lee A. Spain on September 28, 2005 (8:00:00 AM)

Share    Print    Comments   

Do you know what happened to your data when you disposed of your last PC? With identity theft on the rise, it's important to make sure your information is removed before you get rid of that old hard drive. Thanks to the work of developer Darik Horn, there's an excellent tool to wipe data off of a hard disk: Darik's Boot and Nuke (DBAN).

When DBAN is finished with your hard drives, the master boot record, partition table, and every sector of the drive will have been overwritten in accordance with one of five well-regarded industry guidelines. DBAN is powerful stuff and has been used by US federal agencies, such as the Department of Energy's National Nuclear Security Administration (NNSA), to prepare machines for disposal.

In addition to removing personal data, DBAN can also be used to return drives to a pristine state for reuse. DBAN uses Linux to boot up, and can wipe IDE, SATA, XT, and SCSI hard drives. DBAN does not work at all on USB drives, FireWire drives, or hardware RAID devices.

I tried DBAN v.1.0.5 when one of my computers became hopelessly perplexed after multiple installations of various Linux and Windows operating systems. After installing Linspire, SUSE 9.1, and several other distributions, I could not install Linux on my fairly new Celeron D machine with a 40GB hard drive. To make matters worse, I also could not reinstall Windows XP. The XP installer was apparently confused by the presence of a Linux file system. Finally, I resorted to the "nuke" option. I downloaded the DBAN ISO image on another computer, burned it to a CD, and fed it to my malfunctioning PC.

The disk-wiping process is relatively simple. First, I had to go into the BIOS and change the startup options to ensure that it would boot to the CD-ROM drive first. After booting with the DBAN CD, I was presented with a simple text menu with the available options. The menu offers five options -- learn more about DBAN, get a list of quick commands, see troubleshooting tips, start DBAN in interactive mode, or start DBAN in automatic ("autonuke") mode.

My only difficulty was in navigating to an option to read about DBAN and then navigating back to the main menu. DBAN doesn't give you a chance to go back to the main menu once you've chosen one of the menu options. The only choice is to proceed to the next operation, or reboot the machine to start at the main menu.

DBAN boot screen
The DBAN main menu - click to enlarge

Once I was done reading, DBAN gave me the choice of six drive wiping routines. The fastest choice, Quick Erase, simply fills the hard drive with zeroes in one pass. Since technicians with the right equipment could conceivably still recover data from this type of wipe, DBAN rates it as a low-security option.

The second choice, RCMP TSSIT OPS-II, uses the techniques recommended by the Royal Canadian Mounted Police Technical Security Standards for Information Technology in Appendix Ops-II: Media Sanitation. It is rated as a medium-security technique because DBAN makes eight drive-wiping passes with a random byte in the overwrite sequence changed each time. Apparently, the Mounties prefer this to letting horses stomp on hard drives.

The third choice, DoD Short, is based on the American Department of Defense Standard 5220-22.M. It is also rated as a medium-security option because it makes three of the seven passes recommended under the standard.

The fourth option, DoD 5220-22.M, is a stronger medium-security option because it makes the recommended seven passes across each hard drive.

For the fifth option DBAN offers the Gutmann Wipe as a high-security option. It makes 35 passes across the hard drive as outlined in security expert Peter Gutmann's 1996 paper "The Secure Deletion of Data from Magnetic and Solid-State Memory." However, due to changes in the different data encoding schemes now used by modern hard drives, Gutmann no longer recommends 35 passes. A few random passes should suffice.

Finally, DBAN offers the PRNG Stream option. This method overwrites the drive with a stream from the Pseudo Random Number Generator (PRNG). With the PRNG Stream, DBAN users can choose a medium-security option of four passes or a high-security option of eight passes.

For my test, I chose the DoD Short method. DBAN made three passes on my hard drive in an hour and nine minutes.

DBAN is not for the impulsive. If you don't have a government lab, an electron microscope, a dedicated team of computer forensics specialists, and a huge amount of time and money, you will not recover your data after DBAN has wiped your hard drive. Obviously, before you get started, you should backup important data. If you plan to use the computer again, you should have an operating system at hand, and find any driver and application installation disks that you'll need. You'll also want to make sure that your system can boot to something other than your hard drive.

DBAN is also not for the impatient. It can take a long time to write over every sector of your hard drive multiple times. Some users report that DBAN took up to 24 hours to erase their data using the most rigorous methods. While DBAN is constantly improving, if the Linux community does not have a good driver for a particular hard drive, you can expect slow performance. However, if your machine runs Linux well, you probably won't have problems with DBAN.

Overall, I found DBAN to be a great "nuke" option. However, there are a few other open source tools for wiping hard drives. A disk wiping utility called Autoclave performs the same function as DBAN. However, as of last March, it is no longer supported by its developer; he now recommends DBAN instead as a superior tool for wiping disks.

For Windows users, Heidi Computers Ltd. offers a free open source tool called Eraser. It has a utility for creating a DBAN boot CD for drive wiping, but also runs as a desktop application that offers the ability to securely wipe only specified folders and files. Heidi Computers also hosts a DBAN support forum.

For Linux, a secure file wiping utility called Wipe is also available. Additionally, there are also a variety of Linux command-line incantations that can be used to fill a hard drive with zeroes or nulls.

For my needs, DBAN did the trick. Once DBAN was finished with my hard drive, I had a nice clean landing pad for the Linux distribution of my choice.

Share    Print    Comments   

Comments

on Darik's Boot and Nuke: A great tool for obliterating your data

Note: Comments are owned by the poster. We are not responsible for their content.

How to do it without DBAN

Posted by: Preston St. Pierre on September 29, 2005 03:32 AM
Boot to LiveCD:

dd if=/dev/urandom of=/dev/hda
dd if=/dev/zero of=/dev/hda
dd if=/dev/urandom of=/dev/hda

#

Re:How to do it without DBAN

Posted by: walt-sjc on September 29, 2005 04:52 AM
I needed to do this to a few hundred desktop machines several years ago.

A custom tom's rootboot with the a script that dd's from<nobr> <wbr></nobr>/dev/zero is all that's needed unless you are concerned that someone is going to pay THOUSANDS to a recovery firm that MAY be able to pull off some limited info.

The older desktop's I was delaing with had CD's that were way too flakey / frequently not configured to boot. I also didn't want to hook up a monitor and screw with it.

Insert floppy, power on. Script beeps continuously if all is fine. If no beeps, then assume the wipe failed and yank the drive for physical destruction.

#

Re:How to do it without DBAN

Posted by: Anonymous Coward on September 29, 2005 10:00 PM
Agencies can read areas of disks after it has been rewritten several times. Apparently there are tell-tale traces when using the right equipment. They don't use the drive heads or mechanisms, but take the platters out and put them into some contracption like an electron tunneling microscope. I think it was called SQUID, and costs a fortune.

I personally use a hammer, but I don't have to worry about 100s of machines. Although that sounds like fun. There's something nice about taking a drive out and bashing it!

#

Re:How to do it without DBAN

Posted by: Preston St. Pierre on October 01, 2005 07:53 AM
Do your research. Yes, sometimes they can produce data. Most of the time all they produce is unusable garbage, and it is extremely expensive. The chances of that ever happening to your drive are microscopic.

#

Try shred

Posted by: Anonymous Coward on September 29, 2005 06:06 AM
Besides the minimal <tt>dd</tt> method, I like to use <tt>shred</tt>. It's included on most any live CD. Take a look at <tt>info coreutils shred</tt>.

<tt># shred -n 5 -z<nobr> <wbr></nobr>/dev/hda</tt>
(Use with caution.)

Cheers.
Josh

#

Re:Try shred

Posted by: Anonymous Coward on September 29, 2005 09:09 AM
Use shred -v to show progress.

#

Re:Try shred

Posted by: Anonymous Coward on September 29, 2005 08:46 PM
Shred use to be OK but, shred is no longer reliable for permanently wiping a disk. From the shred man page:

The following are examples of file

              systems on which shred is not effective:


              * log-structured or journaled file systems, such as those supplied with


                            AIX and Solaris (and JFS, ReiserFS, XFS, Ext3, etc.)


              * file systems that write redundant data and carry on even if some writes


                            fail, such as RAID-based file systems


              * file systems that make snapshots, such as Network Appliance's NFS server


              * file systems that cache in temporary locations, such as NFS


                            version 3 clients


              * compressed file systems


              In addition, file system backups and remote mirrors may contain copies of the file that

              cannot be removed, and that will allow a shredded file to be recovered later

#

Re:Try shred

Posted by: Anonymous Coward on September 29, 2005 09:45 PM
Shred use to be OK but, shred is no longer reliable for permanently wiping a disk


That's only true if you don't know how to use your tools. Many of the caveats mentioned relate to shredding files on a live filesystem. So if you really want something gone, you not only have nuke the file on the filesystem, but all existing copies, however temporary. shred's man page is simply reminding us of the gotchas.


Popping in a boot CD, then shredding<nobr> <wbr></nobr>/dev/hdX (or other relevant disk), is secure.

#

fdisk of cfdisk would have sufficed

Posted by: Anonymous Coward on September 29, 2005 07:16 AM
"Finally, I resorted to the "nuke" option."

At worst all you'll have needed to do is delete the partition partition table on the disk, any liveCD with fdisk of cfdisk would have sufficed.

#

Re:fdisk of cfdisk would have sufficed

Posted by: Anonymous Coward on September 29, 2005 09:41 AM
no

#

Re:fdisk of cfdisk would have sufficed

Posted by: Anonymous Coward on September 29, 2005 12:29 PM
yes.

#

Re:fdisk of cfdisk would have sufficed

Posted by: Anonymous Coward on September 29, 2005 02:46 PM
No. The filesystem will still be there, and all you'd have to do is reconstruct the partition table. And that's not difficult to do.

Blanking the entire drive with zeroes would probably be sufficient for anyone who isn't totally paranoid. It's still possible to recover data off the drive, but probably beyond the capabilities of 99% of people. Unless they really are out to get you, that'll be enough.

#

Re:fdisk of cfdisk would have sufficed

Posted by: Anonymous Coward on September 29, 2005 10:57 PM
I agree that deleting a partition is not a secure method of erasing a drive. However, the author decided to use DBAN "when one of my computers became hopelessly perplexed after multiple installations of various Linux and Windows operating systems." For this purpose, deleting the partition(s) would have worked.

#

Re:fdisk of cfdisk would have sufficed

Posted by: Anonymous Coward on September 30, 2005 06:19 AM
Word! You have a clue<nobr> <wbr></nobr>:)

#

Re:fdisk of cfdisk would have sufficed

Posted by: Anonymous Coward on September 30, 2005 12:05 AM
Maybe 99% of Linux users.

But make that 99.99% of people in general.

#

Encrypted partitions

Posted by: Anonymous Coward on September 29, 2005 10:28 AM
If you encrypt the data partitions when you install the machine, then all you need to do, to wipe the data, is forget the passphrase.

#

Re:Encrypted partitions

Posted by: Anonymous Coward on October 05, 2005 03:28 AM
You're, right, Captain, Comma!


--Lt. Exclamation!

#

Bah

Posted by: Joseph Cooper on September 29, 2005 12:33 PM
I'm with most of the other posters on this.

It's such a mundane thing...

All you have to do is overwrite the first half meg (or half kilo? I can't remember) and the partition tables are blanked. Fdisk (Linux version, Windows, whichever) will just make a new table from scratch.

Just running DD til it gives up will handle the disk in it's entirety and have it all set to 0s.

Now, this could be a useful tool to have neatly packaged, and a lot of people don't use Linux CLI. I barely have any idea what I'm doing in CLI. It's still such a mundane tool though, it's like reviewing a new version of 'cat' or 'echo'.

#

Re:Bah

Posted by: Anonymous Coward on September 29, 2005 10:29 PM
Yeah, just erase the first 512 bytes of your disk. Then I'll take Norton Disk Edit (circa 1985) and still be able to browse your whole file system. Even if you clobbered the FAT/NTFS/etc tables and root directory, I'll just do a search for "terrorist", "p0rn", "jpg", or "doc" and get to all your confidential documents anyway, which you so conveniently left unoverwritten and unencrypted.

Btw, it would be trivial to write a program that searches a disk for a regular expression representing the number space of major credit cards or bank accounts. Heck, there are people who do that for network sniffers.

#

Re:Bah

Posted by: Kyle Maxwell on September 29, 2005 10:36 PM
No, sorry, wiping the partition table does nothing for you. I've recovered many a system by reconstructing the partition table (not a particularly difficult process) and reading the filesystems. I love it when someone thinks that destroying the partition table is sufficient -- and then I just go ahead and proceed with the investigation.

dd might do what you're looking for, but this is a solution that scales and that I can hand to mid-level staff without worrying about syntax errors and the like. It also means that when management asks, I can specify what standard was used to wipe the systems. The other tools might be "good enough" technically, but there's more to it than that.

#

good article

Posted by: Anonymous Coward on September 29, 2005 01:42 PM
I thought this was a pretty good read; Especially for someone who wants a simple solution to wiping one's drives. Sure, one could pop in a liveCD and use the dd, shred, et al commands, but this DBaN tool (which weighs less than 2MB) makes it a bit more convenient for the rest of us.

Here's another free disk wiping tool: <a href="http://diskzapper.com./" title="diskzapper.com.">http://diskzapper.com./</a diskzapper.com.>

#

Darik's Boot and Nuke: A great tool for obliterating your data

Posted by: Anonymous [ip: 67.160.221.113] on January 25, 2008 10:42 PM
I ran Darik's Boot and Nuke on my loptop, it ran up to the 23 pass out of 35, and then stop staying idle for couple of days. After several hours today, I decided to yanked the floppy disk off and try to re install the configuration cd<>No chance<>It did not work. Then, I tried to load WINDOWS XP Professional and it register no hard drive detected<>Humm<>So I went back to the configuration cd and try to run the process again and pressed F1 for OK, and "C" to cntinue loading the files and programs<>No chance<> Its not working and I don't know what to do?
Should I do what you state on your from page and run Autonuke and then try to run the configuration cd again, or do I have to do something different to recover my system? Please help!
My e mail address, is
itsmeduoard@yahoo.com
Thanks very much
Have a good weekend
Eduoard

#

This story has been archived. Comments can no longer be posted.



 
Tableless layout Validate XHTML 1.0 Strict Validate CSS Powered by Xaraya