Related link: http://www.timesonline.co.uk/article/0,,2-1487674,00.html
Bruce Schneier has linked to yet another study that shows that people don’t securely delete data from drives before selling them. This group purchased 111 supposedly clean hard drives and recovered a lot of sensitive information including “national insurance numbers, evidence of a married woman’s affair and detailed biographical information about children.” I think the major issue is that your common guy thinks that formatting the drive is the solution to erase data, and anything more sophisticated than that is too difficult or expensive. Here I’ll show you how to easily shred a drive using free Open Source tools.
The basic problem with a regular format of a hard drive, is that it generally doesn’t actually go back and scramble all of the data. Generally the data is sitting there waiting for someone with low-level tools to recover it. Even if you do a “low-level format” and write over the full drive with zeroes, there’s still a chance that an individual with the right (albeit expensive) equipment can recover data from the drive. Even though the equipment is expensive, that’s a minor issue if the data to be recovered is worth even more (such as company trade secrets, etc.). Because of the magnetic nature of hard drives, even when a sector on the drive is written to, it doesn’t necessarily mean the previous data is completely overwritten. Often you can pick up the trace of the previous write.
The solution to this issue is to write over the drive multiple times with random data, that way any real data that is on there is scrambled with random data that will likely actually overwrite its place on the drive. Doing this isn’t as hard as it might seem, and doesn’t actually require any script-fu. All you need is some sort of bootable Linux distribution, such as Knoppix, that has the “shred” tool installed.
Shred is designed primarily to securely delete files on the system. When you shred a file, shred not only unlinks it, but it also overwrites the sectors on the drive 25 times with random data. Since “everything is a file” on a UNIX system, you can use this to shred the entire partition or even the entire drive.
First, boot your bootable Linux distribution. You don’t need a graphical desktop for this operation, just a terminal, so if it can boot directly to console, save yourself some time and go that route (under Knoppix you’d boot with the knoppix 2 cheat code).
The next step is to identify the partition. If you only have a single IDE drive on the system, likely it will be /dev/hda and if it has a single partition, it will probably show up under /dev/hda1. If you are unfamiliar with Linux and what device your drive will show up as, in the case of a Knoppix CD you can just boot to the full graphical environment and look at the name of the hard drive icons on the desktop for a clue.
After you have identified the partition to shred, the next step is to actually shred it. You will need root permissions for this (most console modes on rescue CDs will automatically give you root permissions) since you are writing directly to the hard drive. Then, run:
# shred -n 2 -z -v /dev/hda1
What this tells shred, is to overwrite the partition 2 times with random data (-n 2) then finish it up by writing over it with zeroes (-z) and show you its progress (-v). Of course, change /dev/hda1 to whatever your partition is. Each pass can take some time, which is why I set it to only do 2 random passes instead of the default 25. You can adjust this number, of course, to your particular level of paranoia and the amount of time you have.
Since shred writes on such a low-level, it doesn’t actually matter what kind of filesystem is on the partition–everything will be unrecoverable. Once shred is finished, you can shut down the machine and sell or throw away the drive with peace of mind.
Does your company have a data shredding policy?
