Notifications
Clear all

HDD Wiping

27 Posts
9 Users
0 Likes
5,407 Views
(@datar)
Posts: 15
Eminent Member
Topic starter
 

I was wondering, what software/hardware do you guys use to wipe the target drives?

 
Posted : 03/12/2016 12:41 am
(@wookieshaver)
Posts: 27
Eminent Member
 

Speaking for my lab, we use Encase to wipe drives, but we have also used Paladin Linux, Backbox Linux, and Mac to wipe drives just using DD in each case with the linux distros and the mac.

 
Posted : 03/12/2016 12:52 am
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

And if ATA/SATA built-in secure erase should be much faster.

Needs to be validated on the specific device if SSD (never seen any report of ATA secure erase not working on spinning disk drives, but of course it is possible).

jacl

 
Posted : 03/12/2016 1:35 am
(@datar)
Posts: 15
Eminent Member
Topic starter
 

Ok, so I have been using encase as well, but how about when you need to present a proof that the drive was actually wiped? Will encase log will be sufficient? Will it be court acceptable?

 
Posted : 03/12/2016 1:55 am
(@datar)
Posts: 15
Eminent Member
Topic starter
 

Ok, so I have been using encase as well, but how about when you need to present a proof that the drive was actually wiped? Will encase log will be sufficient? Will it be court acceptable?

 
Posted : 03/12/2016 1:56 am
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

Ok, so I have been using encase as well, but how about when you need to present a proof that the drive was actually wiped? Will encase log will be sufficient? Will it be court acceptable?

What if the Encase log is acceptable but right after you ran Encase you wrote something to the disk?

I would be curious to know an example of a request for such a "proof".

jaclaz

 
Posted : 03/12/2016 6:27 pm
JaredDM
(@jareddm)
Posts: 118
Estimable Member
 

Doing full-time data recovery here, we have a lot of drives to wipe each week.

For most SATA drives we use these which are nice and fast. I like that they quickly let us know if there's any bad sectors developing in our destination drives http//www.newegg.com/Product/Product.aspx?Item=N82E16817998225&cm_re=startech_drive_cloner-_-17-998-225-_-Product

For IDE drives which get dropped off here for wiping we use these http//www.ebay.com/itm/like/192041302394?lpid=82&chn=ps&ul_noapp=true

And for SCSI or SAS drives we just use Linux along with SG3_utils to initiate the drive's own built-in wiping functions.

At times I've also used Active@ Killdisk software, such as for wiping the USB native drives like My Passport/Elements or Toshiba Canvio drives.

 
Posted : 03/12/2016 6:33 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

For IDE drives which get dropped off here for wiping we use these http//www.ebay.com/itm/like/192041302394?lpid=82&chn=ps&ul_noapp=true

And for SCSI or SAS drives we just use Linux along with SG3_utils to initiate the drive's own built-in wiping functions.

Don't you certify wiping using (WHY?) "D.o.D. Three Pass Semi Random"?
https://www.data-medics.com/recovery/wp-content/uploads/2015/05/Cert-of-Destruction.jpg

jaclaz

 
Posted : 04/12/2016 1:10 am
JaredDM
(@jareddm)
Posts: 118
Estimable Member
 

For IDE drives which get dropped off here for wiping we use these http//www.ebay.com/itm/like/192041302394?lpid=82&chn=ps&ul_noapp=true

And for SCSI or SAS drives we just use Linux along with SG3_utils to initiate the drive's own built-in wiping functions.

Don't you certify wiping using (WHY?) "D.o.D. Three Pass Semi Random"?
https://www.data-medics.com/recovery/wp-content/uploads/2015/05/Cert-of-Destruction.jpg

jaclaz

If someone specifically wants DoD we'll do it. But, the vast majority of the drives we get dropped off here are just old drives from computer repair shops. They really don't care about DoD or certification, they just want to be sure they're not getting thrown away with data on them. So most often we are just zero filling and logging the serial numbers and times the wipe is started and stopped. For a few of our more security conscious customers, we do the three pass DoD, even though we all know it is completely unnecessary.

Also, more than half the drives we are wiping on a given day are our own destination drives which we wipe between cases to be sure no data from a previous case ever gets accidentally recovered.

 
Posted : 04/12/2016 7:27 am
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

For a few of our more security conscious customers, we do the three pass DoD, even though we all know it is completely unnecessary.

Wheeew! D

jaclaz

 
Posted : 04/12/2016 1:56 pm
Page 1 / 3
Share: