0

I need to remove all data from an hard disk where lubuntu 22.04 is installed. I was thinking to boot from an Ubuntu liveUSB image and, from a terminal, use the command:

# the Hard Disk is the device file /dev/sda
> sudo dd if=/dev/zero of=/dev/sda

But this link says:

Be advised this will remove all partition information, but is not a "disk wipe" or "secure delete". If you want to truly be certain that data can not be recovered, the most effective tool to use is a hammer.

Before reading these sentences, I had the impression that the dd command could securely delete all data from a hard disk.

Is the dd command alone not sufficient to securely erase a hard disk?

5
  • 3
    ("secure" is always a relative term. Imagine you went to a lock manufacturer and asked whether their door locks are "secure". For a private household? For a jeweler's front door? For their safe? For a bank's safe? In Stuttgart, Germany, or in the middle of a town in the middle of a civil war with armed factions in needs of funding? For an unsupervised nuclear silo in the middle of the forest? We call this threat modeling: You need to know what you're protecting, and what against, before you can decide which measures suffice.) Jun 27, 2023 at 9:01
  • 1
    What this warning is about: The »binary« data on your hard drive is actually a physical state of magnetization. Think of a »0« being some level below 0.5 and a »1« something above 0.5. Now writing a zero over a one can result in something like 0.1, while writing a zero over a zero results in 0.01, maybe. You don't need a million budget to extract the analog signal from the reading head and fine-tune your decoding algorithm. Your neighbour secret agent knows someone to do that for you. Thus, dding some levels of /dev/random comes closer to the hammer method.
    – Philippos
    Jun 27, 2023 at 10:28
  • 1
    @Philippos-prostrike- that's old information. Just one pass is sufficient or else trust no-one and use a hammer Jun 27, 2023 at 10:31
  • @roaima The article you link illustrates that different recommendations on the number of erase cycles exist today. It concludes, (1) the erasure needs to be verified (a normal user can't do that), you (2) need to weigh the level of security against the time you take and (3) to utilize the drive’s firmware-based erasure commands for sensitive data. Thus, for normal users, more than one pass is still the way to go.
    – Philippos
    Jun 27, 2023 at 11:30
  • 1
    Do not use shred or dd on SSD or newer HDD, use Secure erase superuser.com/questions/1336292/… & tinyapps.org/docs/wipe_drives_hdparm.html
    – oldfred
    Jun 27, 2023 at 14:10

3 Answers 3

1

I think dd from /dev/zero or /dev/urandom may be sufficient, as @roaima said in his comment. But to make sure you're safe, I would use one of the following dedicated tools:

  • shred (From GNU)
  • scrub (From RedHat)

These are tools made especially for securely wiping hard disks using multiple passes, writing random data, etc.

Here is some documentation to go further:

0
0

While mkfs (make file system) or gpartd (partition disk) and similar commands make files inaccessable, the raw data on a hard disk (other than the partition tables or file system metadata) would not be altered by those commands.

To demonstrate, if you have a spare disk or USB stick, call it /dev/$disk, partition it, make an FS on it, fill it with text files, then run mkfs or gpartd, then dd if=/dev/$disk | strings and see if anything looks familiar. Then run dd if=/dev/zero of=/dev/$disk to clear it and dd if=/dev/$disk | strings or dd if=/dev/$disk | od -c to see that it is now empty.

Note that SSDs or new hard drives may require other tools. Also, using LUKS to encrypt most or all of a disk renders it unreadable by others (who lack the passphrase or token) for most practical purposes.

-1

The quickest way to clear all the files is to just run mkfs on the filesystem (you'd need to that anyway after applying most of the suggestions here before the storage was usable).

Even with 'dd' the data previously on the disk (and potentially going back at least one generation) can still be recovered by someone with sophiticated forensic tools. If (for example) you are implementing a capture-response system for a surveillance balloon, then use 'shred' or explosives.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .