RE: DoD aproved disk wiping tool

["Mason, Samuel" <SMason () mt gov>]

I'm not sure if this has been covered yet but NIST has overthrown the multiple-wipe technique on newer drives.

> From http://csrc.nist.gov/publications/nistpubs/800-88/NISTSP800-88_rev1.pdf:

"Studies have shown that most of today's media can be effectively cleared by one overwrite."

(Clearing and purging have merged as terms in ATA disks manufactured after 2001 over 15 GB). Now if DoD is ignoring or 
superseding NIST then so be it but I thought I'd throw that out for those people that may want to follow Fed guidelines 
but want to save themselves time wiping a 200+ GB drive 3 times. :)


Samuel Mason, CISSP
-----Original Message-----
From: listbounce () securityfocus com [mailto:listbounce () securityfocus com] On Behalf Of Timmothy Lester
Sent: Thursday, March 27, 2008 11:35 AM
To: ragdelaed () gmail com; security-basics () securityfocus com
Subject: RE: DoD aproved disk wiping tool

I believe killdisk's free version only supports 1-pass, you have to pay
for DoD wipes

I forgot to mention a good utility called Eraser, which now includes
DBAN.  Eraser can be installed over the network and scheduled to erase
unused disk-space, or files.  It can use several different wiping
methods, including DoDs.  It's a must have...

-----Original Message-----
From: listbounce () securityfocus com [mailto:listbounce () securityfocus com]
On Behalf Of ragdelaed () gmail com
Sent: Thursday, March 27, 2008 10:57 AM
To: security-basics () securityfocus com
Subject: Re: DoD aproved disk wiping tool

These support DOD 5220.22-M guidelines and are free. They may support
5200.28, not 100%. The non software based method is degaussing.

KillDisk
http://www.killdisk.com/downloadfree.htm

Secure Erase. This is the purge approved method that seems to be the
most efficient method. It works on SATA/ATA drives for the most part, no
SCSI. Very fast. Free too.
http://cmrr.ucsd.edu/people/Hughes/SecureErase.shtml

I dont know of any network based tools that can wipe a drive. You might
be able to mount the remote drive with linux and the dd it, but that
would not be approved. I think dd local would meet requirements, but not
network based.

The hard part is that you have to deploy something to the remote target
to keep the deletion going after the deletion has removed the functional
parts of the drive and dropped it from the network. In order to verify
this, I dont know if anyone would approve of a network based solution.

Its best to pull it and wipe it locally.