28

I have a laptop with Debian on it, and I am going to sell this laptop.

Would it suffice to erase the Debian installation before selling it to completely clean up my laptop from my personal data, and if yes how can I uninstall Debian (so that there isn't any operating system on the laptop)?

  • 22
    dd if=/dev/random of=/dev/sda bs=4096 – Rui F Ribeiro Jun 14 '17 at 7:02
  • 38
    @RuiFRibeiro Using /dev/random is completely unnecessary. /dev/urandom is perfectly sufficient and it doesn't block, and even /dev/zero will almost certainly do just fine. Also, use a larger block size; I recommend on the order of several megabytes. That will allow the storage subsystem to do proper I/O queuing. – a CVn Jun 14 '17 at 12:43
  • 9
    SSD Secure Erase using hdparm. No need to manually erase with dd, you can tell the drive to nuke itself. – CijcoSistems Jun 14 '17 at 13:29
  • 4
    @CijcoSistems Assuming that you trust the drive's implementation of the ATA SECURE ERASE command. – a CVn Jun 14 '17 at 13:43
  • 6
    An idea for the future - a very efficient and secure way to 'wipe' data from a system is to encrypt the partitions in question before writing any data to them. Then when you want to wipe the system, all you have to do is overwrite the block that stores the encryption key. LUKS makes this very easy, and Debian supports it in the standard installation. Encryption also protects your data in case your computer gets stolen. – user164089 Jun 15 '17 at 7:02

11 Answers 11

49

This nixCraft post explain how to erase hard disk

The secure removal of data is not as easy as you may think. When you delete a file using the default commands of the operating system (for example “rm” in Linux/BSD/MacOS/UNIX or “del” in DOS or emptying the recycle bin in WINDOWS) the operating system does NOT delete the file, the contents of the file remains on your hard disk. The only way to make recovering of your sensitive data nearly impossible is to overwrite (“wipe” or “shred”) the data with several defined patterns. For erasing hard disk permanently, you can use the standard dd command. However, I recommend using shred command or wipe command or scrub command.

Warning: Check that the correct drive or partition has been targeted. Wrong drive or partition target going to result into data loss . Under no circumstances we can be help responsible for total or partial data loss, so please be careful with disk names. YOU HAVE BEEN WARNED!

Erase disk permanently using a live Linux cd

First, download a knoppix Live Linux CD or SystemRescueCd live CD.

Next, burn a live cd and boot your laptop or desktop from live CD. You can now wipe any disk including Windows, Linux, Mac OS X or Unix-like system.

1. How do I use the shred command?

Shred originally designed to delete file securely. It deletes a file securely, first overwriting it to hide its contents. However, the same command can be used to erase hard disk. For example, if your hard drive named as /dev/sda, then type the following command:

# shred -n 5 -vz /dev/sda

Where,

-n 5: Overwrite 5 times instead of the default (25 times).
-v : Show progress.
-z : Add a final overwrite with zeros to hide shredding.

The command is same for IDE hard disk hda (PC/Windows first hard disk connected to IDE) :

# shred -n 5 -vz /dev/hda

Note: Comment from @Gilles
Replace shred -n 5 by shred -n 1 or by cat /dev/zero. Multiple passes are not useful unless your hard disk uses 1980s technology.

In this example use shred and /dev/urandom as the source of random data:

# shred -v --random-source=/dev/urandom -n1 /dev/DISK/TO/DELETE
# shred -v --random-source=/dev/urandom -n1 /dev/sda

2. How to use the wipe command

You can use wipe command to delete any file including disks:

# wipe -D /path/to/file.doc

3. How to use the scrub command

You can use disk scrubbing program such as scrub. It overwrites hard disks, files, and other devices with repeating patterns intended to make recovering data from these devices more difficult. Although physical destruction is unarguably the most reliable method of destroying sensitive data, it is inconvenient and costly. For certain classes of data, organizations may be willing to do the next best thing which is scribble on all the bytes until retrieval would require heroic efforts in a lab. The scrub implements several different algorithms. The syntax is:

# scrub -p nnsa|dod|bsi|old|fastold|gutmann|random|random2 fileNameHere

To erase /dev/sda, enter:

# scrub -p dod /dev/sda

4. Use dd command to securely wipe disk

You can wipe a disk is done by writing new data over every single bit. The dd command can be used as follows:

# dd if=/dev/urandom of=/dev/DISK/TO/WIPE bs=4096

Wipe a /dev/sda disk, enter:

# dd if=/dev/urandom of=/dev/sda bs=4096

5. How do I securely wipe drive/partition using a randomly-seeded AES cipher from OpenSSL?

You can use openssl and pv command to securely erase the disk too. First, get the total /dev/sda disk size in bytes:

# blockdev --getsize64 /dev/sda
399717171200

Next, type the following command to wipe a /dev/sda disk:

# openssl enc -aes-256-ctr -pass pass:"$(dd if=/dev/urandom bs=128 count=1 2>/dev/null | base64)" -nosalt </dev/zero | pv -bartpes

399717171200 | dd bs=64K of=/dev/sda

6. How to use badblocks command to securely wipe disk

The syntax is:

# badblocks -c BLOCK_SIZE_HERE -wsvf /dev/DISK/TO/WIPE
# badblocks -wsvf /dev/DISK/TO/WIPE
# badblocks -wsvf /dev/sda
  • 23
    And be very, very, VERY careful with this. Unless you have absolutely solid backups, there is no going back. – a CVn Jun 14 '17 at 12:42
  • 5
    @MichaelKjörling: That is the whole point !! Any tool that comes with a --undo flag would be unsuitable for the task. – MSalters Jun 14 '17 at 14:57
  • 23
    Be very careful when setting your house on fire — you may become homeless. – gerrit Jun 14 '17 at 16:42
  • 3
    These solutions require booting the OS and erasing the drive out from under the OS. This could cause a kernel panic in the middle of your wipe, leaving the laptop partially unwiped. The right solution is to boot from an external media, unix.stackexchange.com/a/371029/69068 – rrauenza Jun 14 '17 at 17:14
  • 2
    A detail about shred: While there's no problem with erasing a whole parition, it won't work on single files sitting on journaling file systems that also journal data and cow filesystems such as btrfs, because shred will just overwrite a copy instead of the original data. Also, I second @RuiFRibeiro - it's very unlikely that a linux system will have to load modules or drivers from disk while in the process of wiping. – user164089 Jun 15 '17 at 7:03
16

Boot your laptop from USB/CD and use DBAN: https://dban.org/

Regards.

  • 8
    And be very, very, VERY careful with this. Unless you have absolutely solid backups, there is no going back. – a CVn Jun 14 '17 at 12:41
  • 1
    This is the right way -- booting from external media. Trying to erase the OS out from underneath itself could leave you with a partially unwiped disk due to a kernel panic. – rrauenza Jun 14 '17 at 17:17
  • (Granted, if this happens, you then go grab DBAN to finish the job.) – rrauenza Jun 14 '17 at 17:55
  • @MichaelKjörling I don't see the point of these comments. “Unless you have absolutely solid backups”... what kind of assumption is that? Everybody should make daily backups – ideally at least two one of which is located off-site – of any important information. (For the most part, version control systems take care of that easily.) Of course it can't hurt to remind people of the need for backups often... – leftaroundabout Jun 15 '17 at 19:07
  • 1
    @leftaroundabout You've never checked out our data-recovery tag, have you? (Super User has a corresponding one, heavily used.) Yes, backups should be made; automatically, regularly, and with off-site storage, and tested. (Untested backups are worse than worthless.) But people don't, probably for much the same reason why people leave their doors unlocked: the "it won't happen to me" mentality. Most of the time, recovery is doable; but in the case of overwriting literally everything on a storage media, recovery is next to impossible. – a CVn Jun 15 '17 at 20:14
13

I'm going to suggest considering an alternative to wiping the drive.

Wiping the drive is dangerous in that you can lose data permanently. Additionally, depending on how worried you are about someone taking the data, it can be difficult to ensure that some drives are truly non-recoverable (e.g. SSDs that have internal mechanisms that spread writes around).

A simple and 100% effective solution is to just replace the drive with a new one. Keep the drive for yourself, and then you don't even have to worry about it (barring someone breaking into your home or the computer to which it's attached getting compromised). Whether this is worth your money is something only you can determine, but it's a lot less hassle. As a bonus, now you have an extra drive for yourself. Make your decision by weighing the costs vs. the risk of attacks you wish to protect against.

  • This is also a great solution if you have a smaller or older drive and want to take the chance to have a new bigger, solid-state drive. It's great for a desktop. For a laptop it will depend on how hard the replacement is to perform. Again, look for u-tube videos and watch them before actually attempting this. – Michael Durrant Jun 15 '17 at 10:39
  • 2
    @ThorbjørnRavnAndersen I had considered that. That is a factor to consider weighing the costs. Nonetheless, it's guaranteed effective, and that might be worth more to the OP. – jpmc26 Jun 15 '17 at 19:41
  • Selling the drive has it´s downsides and upsides. On one hand, you could make a mistake doing your backups; on the other hand, they age, and dear value decreases rapidly. With a little more money, you can a bigger, and often faster external drive. – Rui F Ribeiro Jun 28 '17 at 8:12
9

I would advise cleaning the disk doing it with:

sudo dd if=/dev/urandom of=/dev/sda bs=4M oflag=direct

I suggest /dev/urandom against /dev/zero especially if dealing with an SSD drive. You can use /dev/zero in mechanical disks, however supposedly using random values instead also adds more noise to a possible act of advanced recovery (not likely to happen, but has to be said).

dd is also more efficient (and faster) than the alternatives proposed here, namely doing a cat.

In addition, this method does not require you to boot from additional media, and dd is present by default in Linux.

Also be careful how you employ this command, as there is no recovery from it. Word of caution, double or triple check if it is the intended device (or even disconnect any external backup drives), as it is very easy to wipe out the wrong device for good by mistake.

  • 1
    Not to wipe the useful cache out with garbage, I recommend to use oflag=direct. – Ayhan Jun 14 '17 at 14:34
  • 1
    /dev/urandom is VERY slow and before deciding to use that, I would advise people to read about Gutmann method. – hschou Jun 15 '17 at 6:43
  • @hschou The link you give us says the method is obsolete. – Rui F Ribeiro Jun 15 '17 at 6:45
  • @RuiFRibeiro Obsolete: and so is /dev/urandom. One have to understand what wiping data is about before using /dev/urandom. If somebody has data which require /dev/urandom I would advise them to destroy the disk instead. – hschou Jun 15 '17 at 6:59
  • 3
    /dev/urandom is non-blocking. it's slower than some PRNGs, but it's definitely not "VERY slow". Perhaps you're thinking of /dev/random? – dn3s Jun 15 '17 at 17:49
7

Login as root:

cat /dev/zero > /dev/sda

There is no need to do it more than once with a harddisk. If you have an old 8" floppy it might be a good idea to erase a few times.

  • 5
    And be very, very, VERY careful with this. Unless you have absolutely solid backups, there is no going back. – a CVn Jun 14 '17 at 12:41
  • 3
    dd is supposed to be faster than cat – Rui F Ribeiro Jun 14 '17 at 13:17
  • 2
    @RuiFRibeiro But it's not unix.stackexchange.com/questions/9432/… XD – gardenhead Jun 14 '17 at 14:55
  • @gardenhead hmmm maybe I will try a couple of tests too later on. Too many variables already. The post is however seems to be talking about a 2GB area to erase; I guess cleaning 100x the size will amplify the differences. Will have to have a look at it later on with more time to spare, thanks for the pointer. – Rui F Ribeiro Jun 14 '17 at 15:03
  • 1
    @RuiFRibeiro dd is 15% faster with bs=1M than cat. With bs=1K the speed is the same. Conclusion: If dd is installed, use that. – hschou Jun 15 '17 at 6:22
3

If you happen to have a Self-Encrypting Drive (most modern HDDs and virtually all SSDs are also SEDs) and there's nothing on the drive worth several $10000 of advanced data recovery services, you can use secure disk erase:

Whole disk erasure is very fast, and remarkably simple for a SED. Simply passing a cryptographic disk erasure (or crypto erase) command (after providing the correct authentication credentials) will have the drive self-generate a new random encryption key (DEK) internally. This will permanently discard the old key, thus rendering the encrypted data irrevocably un-decryptable.

The process is described here in details. Typically, you simply need to run two commands:

hdparm --user-master u --security-set-pass your_password /dev/X
hdparm --user-master u --security-erase your_password /dev/X

Of course, data recovery may still be possible, since HDD manufacturers tend to keep track of which key was used on which HDD, meaning they will also be able to restore it. They only tend to do this for people who come with several $10000 or a court order though, so if the most sensitive bit of information on that HDD is your facebook password, nobody will bother.

If you do have sensitive information on that drive, I'd follow @jpmc26's advice and simply keep the drive for myself. This is 100% secure with close to zero chance to screw something up in the process.

2

You can use the secure-delete tool , which provide 4 useful commands to wipe your hdd.

man srm

is designed to delete data on mediums in a secure manner which can not be recovered by thiefs, law enforcement or other threats. The wipe algorythm is based on the paper "Secure Deletion of Data from Magnetic and Solid-State Memory" presented at the 6th Usenix Security Symposium by Peter Gutmann, one of the leading civilian cryptographers.

Wiping your disk drive clean

Everybody who owns a computer will someday need to dispose of a disk drive. Before you do, it is a good idea to cleanse the drive, so no one can read your sensitive information. Deleting files and reformatting is not sufficient; determined effort can still reveal data from a drive even after it appears to be gone. To do a more thorough job, I suggest using wipe.

The secure-delete options:

srm is used for deleting files and directories.
smem wipes memory space.
sfill cleanses the free space on a drive.
sswap cleans swap spaces.

Note the all the tools used to wipe the hard drive isn't granted , some forensic tools can recover a part of your hard drive data (mails , urls , photos ....).

  • 3
    The paper "Secure Deletion of Data from Magnetic and Solid-State Memory" by Gutmann is over twenty-one years old. Yes, that's right; it was presented in July 1996, and it discusses hardware and data encoding methods that were common in the first half of the 1990s. Any software that cites it today should perhaps not be dismissed outright, but should absolutely be taken with a large handful of salt. Even Gutmann himself points out that with "modern" media, taken to mean HDDs about 200GB in size, overwriting with random data is good enough. It's barely possible to source a 200 GB HDD today. – a CVn Jun 15 '17 at 7:18
0

If you have a HDD you can do it the "hardware way" - just take an inductor with a gap big enough for the drive, plug it into AC and drag the drive through the gap. Keep in mind that it will also destroy some kind of hard drive drivers and you will need professional help in order to have the hard drive running once again.

You can read more about it on Wikipedia. There are even companies who can degauss a HDD for you. If you want to be sure - the only NSA-approved method of destroying a hard drive is shredding a degaussed drive.

However, the easiest way would be just overwriting whole drive with zeros.

  • 1
    The OP wants to sell the laptop... I assume with a working hard drive. – Calimo Jun 16 '17 at 4:41
  • This is known as degaussing and it's destructive for the HDD. If the OP doesn't want to sell the drive, it makes more sense to simply keep it for themselves rather than destroy. – Dmitry Grigoryev Jun 28 '17 at 12:00
0

If your laptop used whole disk encryption from the start, a simple erase and you are good to go!

  • 4
    This doesn't really answer the question. "Simply erase" is a good solution, but the answer should ideally contain information about how to do this. We also don't know if the disk is encrypted or not. – Kusalananda Jun 16 '17 at 12:01
-1

The best thing to do is to copy either some random data or just null data to the drive that the OS is installed on. If it is installed on sda, you can do something like dd if=/dev/zero of=/dev/sda bs=xxx count=1. Instead of xxx you want to find your disk's size, or dd if=/dev/null of=/dev/sda. I personally like this one better.

  • ooops sorry you're right.. do cat /dev/null > /dev/sda instead.. nice catch :) – Al 123 Jun 22 '17 at 3:27
-3

If you want to completely destroy the operating system and everything on it you can use:

sudo chmod -r 755 /  

I have did this by accident once and it destroyed my operating system. My operating system was destroyed immediately and I could not boot it anymore. I had to boot a new operating system off of a disc. I do not know how this works. I have also heard of:

sudo chmod -r 000 /  

Which works by removing all permissions to the hard drive, but I do not know why the other one works and maybe this one works that way to.
I could not get any of my files back. To be safe you would want to boot a new operating system over top of the destroyed one, but even using a live USB or another computer I do not think the files were recoverable. When I ran the above command random numbers stared scrolling on my screen (no idea why) and then after I pressed the power button to force a shutdown my computer would not boot at all(bios and that was it).

  • 2
    Not being able to boot != not being able to access the files. You could boot to a live USB, or connect the disk to another laptop/PC. – muru Jun 28 '17 at 1:57
  • But then if you booted another operating system over it then it is practically gone, am I correct. For me on my computer I found no trace of my files after booting a new operating system from a disc. I say practically, because I do not know if there is some way to recover files from a destroyed and wrote over operating system. I have found files from a perfectly good windows operating system that had a new operating system booted over it, but when I say this command destroyed my operating system I mean that random numbers started scrolling on my screen. I just speak from experience. @muru – Nathan Hill Jun 28 '17 at 17:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy