Need something for disk erasure

[tekinept]

Have a gov contract that requires some report or verification that when a drive is removed, there is a full report stating that fact. It also should be able to remove all the data from the drive (not just removing an LV).
I don't remember any way that AIX allows something like that, anyone have any ideas or apps they could point me to?

 

[kHz]

You need an application like S-Delete that scrubs the data completely using the DoD or Gutmann methods.

 

[tekinept]

DoD specs is exactly what I need. Looks like S-Delete is a win only app.... I would like to have used a bulk erase, but they won't use that here.

 

[plamb]

try WIPE it is free Uses Gutmann's erase patterns, erasing single files and accompanying metadata or entire disks.

 

[spamly]

shred may be an options. I think it's a GNU coreutils download.

http://unixhelp.ed.ac.uk/CGI/man-cgi?shred

A GNU, what would I do without your furry, friendly face...

 

[RodKnowlton]

run diag

somewhere beyond Task Selection->Format Media there's a utility for overwriting a hard drive with up to three different bit patterns on three passes. I've used it before to clear disks on a decommissioned machine.

As I kinda like my disks the way the are, I'm not going to poke around any further to find the exact location in diag, but it's there. I seem to recall it had a non-obvious name, so you may have to look around a bit. It'll give you a screen for selecting the number and form of patterns, so you'll know when you've found it.



Rod Knowlton
IBM Certified Advanced Technical Expert pSeries and AIX 5L
CompTIA Linux+
CompTIA Security+

 

[kHz]

three different bit patterns on three passes.

Didn't you read that he needs to meet DoD standard because he is a gov't contractor?

 

[RodKnowlton]

Unless he's got TOP SECRET rated data, which would probably have him in trouble for starting this thread, the AIX utility will may work just fine.

If the contract calls for the disk to be CLEARED, then running just one bit pattern will meet DoD 5220.22-M specifications.

I know the third pattern option was random, and I'm pretty sure the first two were complements of each other. I'd be suprised if they weren't, as IBM certainly has a few customers with government contracts, not to mention a few government contracts of their own.

If the contract calls for them to be SANITIZED, using all three passes (if they are as I recall) will meet DoD 5220.22-M specifications. Certainly worth checking before laying out any cash.

My personal favorite sanitizing method is the three way wipe followed by good old physical destruction.

To be truly secure, you must grind it into a fine powder, toss it to the wind, and hope that entropy takes care of the rest. While cathartic, this is usually cost prohibitive.





Rod Knowlton
IBM Certified Advanced Technical Expert pSeries and AIX 5L
CompTIA Linux+
CompTIA Security+

 

[kHz]

If he had TOP SECRET or above then DoD calls for the complete destruction (i.e., grind it to powder), as you noted. However, three or less passes is not acceptable for scrubbing government data.

The IL state gov't data security act requires 10 scrubs.

But even if data has been thoroughly overwritten, you may still be able to recover some of it as the magnetization patterns on the hard disk surface are often still visible. 35 is generally accepted as secure as it gets.

 

[tekinept]

I have no top secret clearance, and this is not a facility that really needs top secret, however, it is part of the DoD. They did not require the DoD standard, or state that exactly. However, since they asked (or told us to have it), they probably do need to stay in DoD spec, at least this will keep them off my back or coming back requesting it to be at that level of security.
We actually have a few of these types of contracts, this is the first to ask for it.
I used to work for IBM, and the truly top secret government facilities went nuts with this sort of thing, using a wipe, then bulk eraser, and for good measure, basically melted the drive.
Like I said, they want us to have a report and documentation that we 'guarantee' no data is left for exposure, and I'm really trying to cover my butt.

 

[DukeSSD]

My experience with IBM and DoD, the DoD pay for the replacement disk (so they can hang on to the failed one) then they pay another company to put a "big hammer" through the failed disk.
I don't know if thay crush or degause it but they are the ones with the "certificate" to "dispose" of the disks.