Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.
Sign up to join this community
I have a laptop with Debian on it, and I am going to sell this laptop.
Would it suffice to erase the Debian installation before selling it to completely clean up my laptop from my personal data, and if yes how can I uninstall Debian (so that there isn't any operating system on the laptop)?
This nixCraft post explain how to erase hard disk
The secure removal of data is not as easy as you may think. When you delete a file using the default commands of the operating system (for example “rm” in Linux/BSD/MacOS/UNIX or “del” in DOS or emptying the recycle bin in WINDOWS) the operating system does NOT delete the file, the contents of the file remains on your hard disk. The only way to make recovering of your sensitive data nearly impossible is to overwrite (“wipe” or “shred”) the data with several defined patterns. For erasing hard disk permanently, you can use the standard dd command. However, I recommend using shred command or wipe command or scrub command.
Warning: Check that the correct drive or partition has been targeted. Wrong drive or partition target going to result into data loss . Under no circumstances we can be help responsible for total or partial data loss, so please be careful with disk names. YOU HAVE BEEN WARNED!
Erase disk permanently using a live Linux cd
First, download a knoppix Live Linux CD or SystemRescueCd live CD.
Next, burn a live cd and boot your laptop or desktop from live CD. You can now wipe any disk including Windows, Linux, Mac OS X or Unix-like system.
1. How do I use the shred command?
Shred originally designed to delete file securely. It deletes a file securely, first overwriting it to hide its contents. However, the same command can be used to erase hard disk. For example, if your hard drive named as /dev/sda, then type the following command:
# shred -n 5 -vz /dev/sdaWhere,
-n 5: Overwrite 5 times instead of the default (25 times). -v : Show progress. -z : Add a final overwrite with zeros to hide shredding.The command is same for IDE hard disk hda (PC/Windows first hard disk connected to IDE) :
# shred -n 5 -vz /dev/hda
Note: Comment from @Gilles
Replace shred -n 5 by shred -n 1 or by cat /dev/zero. Multiple passes are not useful unless your hard disk uses 1980s technology.
In this example use shred and /dev/urandom as the source of random data:
# shred -v --random-source=/dev/urandom -n1 /dev/DISK/TO/DELETE # shred -v --random-source=/dev/urandom -n1 /dev/sda2. How to use the wipe command
You can use wipe command to delete any file including disks:
# wipe -D /path/to/file.doc3. How to use the scrub command
You can use disk scrubbing program such as scrub. It overwrites hard disks, files, and other devices with repeating patterns intended to make recovering data from these devices more difficult. Although physical destruction is unarguably the most reliable method of destroying sensitive data, it is inconvenient and costly. For certain classes of data, organizations may be willing to do the next best thing which is scribble on all the bytes until retrieval would require heroic efforts in a lab. The scrub implements several different algorithms. The syntax is:
# scrub -p nnsa|dod|bsi|old|fastold|gutmann|random|random2 fileNameHereTo erase /dev/sda, enter:
# scrub -p dod /dev/sda4. Use dd command to securely wipe disk
You can wipe a disk is done by writing new data over every single bit. The dd command can be used as follows:
# dd if=/dev/urandom of=/dev/DISK/TO/WIPE bs=4096Wipe a /dev/sda disk, enter:
# dd if=/dev/urandom of=/dev/sda bs=40965. How do I securely wipe drive/partition using a randomly-seeded AES cipher from OpenSSL?
You can use openssl and pv command to securely erase the disk too. First, get the total /dev/sda disk size in bytes:
# blockdev --getsize64 /dev/sda 399717171200Next, type the following command to wipe a /dev/sda disk:
# openssl enc -aes-256-ctr -pass pass:"$(dd if=/dev/urandom bs=128 count=1 2>/dev/null | base64)" -nosalt </dev/zero | pv -bartpes399717171200 | dd bs=64K of=/dev/sda
6. How to use badblocks command to securely wipe disk
The syntax is:
# badblocks -c BLOCK_SIZE_HERE -wsvf /dev/DISK/TO/WIPE # badblocks -wsvf /dev/DISK/TO/WIPE # badblocks -wsvf /dev/sda
--undo flag would be unsuitable for the task.
shred: While there's no problem with erasing a whole parition, it won't work on single files sitting on journaling file systems that also journal data and cow filesystems such as btrfs, because shred will just overwrite a copy instead of the original data. Also, I second @RuiFRibeiro - it's very unlikely that a linux system will have to load modules or drivers from disk while in the process of wiping.
Boot your laptop from USB/CD and use DBAN: https://dban.org/
Regards.
I'm going to suggest considering an alternative to wiping the drive.
Wiping the drive is dangerous in that you can lose data permanently. Additionally, depending on how worried you are about someone taking the data, it can be difficult to ensure that some drives are truly non-recoverable (e.g. SSDs that have internal mechanisms that spread writes around).
A simple and 100% effective solution is to just replace the drive with a new one. Keep the drive for yourself, and then you don't even have to worry about it (barring someone breaking into your home or the computer to which it's attached getting compromised). Whether this is worth your money is something only you can determine, but it's a lot less hassle. As a bonus, now you have an extra drive for yourself. Make your decision by weighing the costs vs. the risk of attacks you wish to protect against.
I would advise cleaning the disk doing it with:
sudo dd if=/dev/urandom of=/dev/sda bs=4M oflag=direct
I suggest /dev/urandom against /dev/zero especially if dealing with an SSD drive. You can use /dev/zero in mechanical disks, however supposedly using random values instead also adds more noise to a possible act of advanced recovery (not likely to happen, but has to be said).
dd is also more efficient (and faster) than the alternatives proposed here, namely doing a cat.
In addition, this method does not require you to boot from additional media, and dd is present by default in Linux.
Also be careful how you employ this command, as there is no recovery from it. Word of caution, double or triple check if it is the intended device (or even disconnect any external backup drives), as it is very easy to wipe out the wrong device for good by mistake.
/dev/urandom is VERY slow and before deciding to use that, I would advise people to read about Gutmann method.
/dev/urandom is non-blocking. it's slower than some PRNGs, but it's definitely not "VERY slow". Perhaps you're thinking of /dev/random?
Jun 15, 2017 at 17:49
Login as root:
cat /dev/zero > /dev/sda
There is no need to do it more than once with a harddisk. If you have an old 8" floppy it might be a good idea to erase a few times.
dd is 15% faster with bs=1M than cat. With bs=1K the speed is the same. Conclusion: If dd is installed, use that.
If you happen to have a Self-Encrypting Drive (most modern HDDs and virtually all SSDs are also SEDs) and there's nothing on the drive worth several $10000 of advanced data recovery services, you can use secure disk erase:
Whole disk erasure is very fast, and remarkably simple for a SED. Simply passing a cryptographic disk erasure (or crypto erase) command (after providing the correct authentication credentials) will have the drive self-generate a new random encryption key (DEK) internally. This will permanently discard the old key, thus rendering the encrypted data irrevocably un-decryptable.
The process is described here in details. Typically, you simply need to run two commands:
hdparm --user-master u --security-set-pass your_password /dev/X
hdparm --user-master u --security-erase your_password /dev/X
Of course, data recovery may still be possible, since HDD manufacturers tend to keep track of which key was used on which HDD, meaning they will also be able to restore it. They only tend to do this for people who come with several $10000 or a court order though, so if the most sensitive bit of information on that HDD is your facebook password, nobody will bother.
If you do have sensitive information on that drive, I'd follow @jpmc26's advice and simply keep the drive for myself. This is 100% secure with close to zero chance to screw something up in the process.
You can use the secure-delete tool , which provide 4 useful commands to wipe your hdd.
man srmis designed to delete data on mediums in a secure manner which can not be recovered by thiefs, law enforcement or other threats. The wipe algorythm is based on the paper "Secure Deletion of Data from Magnetic and Solid-State Memory" presented at the 6th Usenix Security Symposium by Peter Gutmann, one of the leading civilian cryptographers.
Everybody who owns a computer will someday need to dispose of a disk drive. Before you do, it is a good idea to cleanse the drive, so no one can read your sensitive information. Deleting files and reformatting is not sufficient; determined effort can still reveal data from a drive even after it appears to be gone. To do a more thorough job, I suggest using wipe.
The secure-delete options:
srm is used for deleting files and directories.
smem wipes memory space.
sfill cleanses the free space on a drive.
sswap cleans swap spaces.
Note the all the tools used to wipe the hard drive isn't granted , some forensic tools can recover a part of your hard drive data (mails , urls , photos ....).
The necessity of multi-pass overwrite was valid 35 years ago but has been obsolete for 25-30 years.
The Urban Legend of Multipass Hard Disk Overwrite (archived link)
Fortunately, several security researchers presented a paper [WRIG08] at the Fourth International Conference on Information Systems Security (ICISS 2008) that declares the “great wiping controversy” about how many passes of overwriting with various data values to be settled: their research demonstrates that a single overwrite using an arbitrary data value will render the original data irretrievable even if MFM and STM techniques are employed.
The researchers found that the probability of recovering a single bit from a previously used HDD was only slightly better than a coin toss, and that the probability of recovering more bits decreases exponentially so that it quickly becomes close to zero.
Therefore, a single pass overwrite with any arbitrary value (randomly chosen or not) is sufficient to render the original HDD data effectively irretrievable.
[WRIG08] Craig Wright; Dave Kleiman; R.S. Shyaam Sundhar (December 2008). “Overwriting Hard Drive Data: The Great Wiping Controversy” Lecture Notes in Computer Science (Springer Berlin / Heidelberg); ISBN 978-3-540-89861-0 (https://link.springer.com/chapter/10.1007/978-3-540-89862-7_21). Some pages available for preview in Google Books.
Thus, this is all you need:
sudo dd if=/dev/zero of=/dev/sda bs=4M oflag=direct
If you have a HDD you can do it the "hardware way" - just take an inductor with a gap big enough for the drive, plug it into AC and drag the drive through the gap. Keep in mind that it will also destroy some kind of hard drive drivers and you will need professional help in order to have the hard drive running once again.
You can read more about it on Wikipedia. There are even companies who can degauss a HDD for you. If you want to be sure - the only NSA-approved method of destroying a hard drive is shredding a degaussed drive.
However, the easiest way would be just overwriting whole drive with zeros.
If your laptop used whole disk encryption from the start, a simple erase and you are good to go!
The best thing to do is to copy either some random data or just null data to the drive that the OS is installed on. If it is installed on sda, you can do something like dd if=/dev/zero of=/dev/sda bs=xxx count=1. Instead of xxx you want to find your disk's size, or dd if=/dev/null of=/dev/sda. I personally like this one better.
If you want to completely destroy the operating system and everything on it you can use:
sudo chmod -r 755 /
I have did this by accident once and it destroyed my operating system. My operating system was destroyed immediately and I could not boot it anymore. I had to boot a new operating system off of a disc. I do not know how this works. I have also heard of:
sudo chmod -r 000 /
Which works by removing all permissions to the hard drive, but I do not know why the other one works and maybe this one works that way to.
I could not get any of my files back.
To be safe you would want to boot a new operating system over top of the destroyed one, but even using a live USB or another computer I do not think the files were recoverable. When I ran the above command random numbers stared scrolling on my screen (no idea why) and then after I pressed the power button to force a shutdown my computer would not boot at all(bios and that was it).
dd if=/dev/random of=/dev/sda bs=4096/dev/randomis completely unnecessary./dev/urandomis perfectly sufficient and it doesn't block, and even/dev/zerowill almost certainly do just fine. Also, use a larger block size; I recommend on the order of several megabytes. That will allow the storage subsystem to do proper I/O queuing.hdparm. No need to manually erase with dd, you can tell the drive to nuke itself.