3 ms·

Is there a good software (preferably open) to remotely kill/erase your data on a Windows machine. Not all versions have bitlocker. Truecrypt's future is unpredi

by chdir 12y ago

Is there a good software (preferably open) to remotely kill/erase your data on a Windows machine. Not all versions have bitlocker. Truecrypt's future is unpredictable.

dr_zoidberg 12y ago
Any "secure eraser" - those programs that rewrite the contents of a file before deletion - does the job. Despite what is claimed (even by those programs and their developers), just 1 pass zeroing out the data is enough to securely delete information from a HDD. Usually they reference a government document that says that physical destruction of the media is the only correct method to erase TOP SECRET (and above) data, but that is mostly paranoid burocracy. If you're using a SDD however, you have to deal with firmware wear-leveling, garbage collection and the drive having a lot of GBs hidden from everyone, even the OS. There are some proposed techniques to force an unavailable block back into the available pool and then reading long-deleted data. Afaik, there's little you can do in this scenario, even full disk encryption might not help you with the old data blocks that are still waiting to be zeroed by the GC. Then again, like you said, FDE is probably the easiest way. TrueCrypt was vulnerable to some on-memory-key attacks, but for data killing its more than enough. There are some projects that have forked TCs code, and there also the old version available thats still fully functional.
- jjoonathan 12y ago
  It's worth mentioning that there are ATA commands for secure erase these days. https://ata.wiki.kernel.org/index.php/ATA_Secure_Erase https://ata.wiki.kernel.org/index.php/ATA_Secure_Erase If you have a linux box handy, you can probe your ATA-compatible drives with: root# hdparm -I /dev/X look for: Security: Master password revision code = 65534 supported enabled not locked not frozen not expired: security count supported: enhanced erase Security level high 2min for SECURITY ERASE UNIT. 2min for ENHANCED SECURITY ERASE UNIT. "Enhanced Security Erase Unit" should get all of the sectors that have been previously used even on a SSD with wear leveling. Of course, you still have to trust that the vendor has correctly implemented it. I have no idea what best practices are in that regard. If anybody here has a better idea, I'd love to hear (Is FIPS certification a good sign? If the drive implements encryption and can therefore do a secure erase by dropping the keys can it be trusted? Can drive vendors generally trusted to not use ECB mode? etc.)
discreditable 12y ago
Windows post-Vista will write zeroes to the entire partition if you format without the quick option. [1] [1] https://support.microsoft.com/kb/941961 https://support.microsoft.com/kb/941961

by chdir 12y ago

Is there a good software (preferably open) to remotely kill/erase your data on a Windows machine. Not all versions have bitlocker. Truecrypt's future is unpredictable.

dr_zoidberg 12y ago

Any "secure eraser" - those programs that rewrite the contents of a file before deletion - does the job. Despite what is claimed (even by those programs and their developers), just 1 pass zeroing out the data is enough to securely delete information from a HDD. Usually they reference a government document that says that physical destruction of the media is the only correct method to erase TOP SECRET (and above) data, but that is mostly paranoid burocracy. If you're using a SDD however, you have to deal with firmware wear-leveling, garbage collection and the drive having a lot of GBs hidden from everyone, even the OS. There are some proposed techniques to force an unavailable block back into the available pool and then reading long-deleted data. Afaik, there's little you can do in this scenario, even full disk encryption might not help you with the old data blocks that are still waiting to be zeroed by the GC. Then again, like you said, FDE is probably the easiest way. TrueCrypt was vulnerable to some on-memory-key attacks, but for data killing its more than enough. There are some projects that have forked TCs code, and there also the old version available thats still fully functional.

jjoonathan 12y ago
It's worth mentioning that there are ATA commands for secure erase these days. https://ata.wiki.kernel.org/index.php/ATA_Secure_Erase https://ata.wiki.kernel.org/index.php/ATA_Secure_Erase If you have a linux box handy, you can probe your ATA-compatible drives with: root# hdparm -I /dev/X look for: Security: Master password revision code = 65534 supported enabled not locked not frozen not expired: security count supported: enhanced erase Security level high 2min for SECURITY ERASE UNIT. 2min for ENHANCED SECURITY ERASE UNIT. "Enhanced Security Erase Unit" should get all of the sectors that have been previously used even on a SSD with wear leveling. Of course, you still have to trust that the vendor has correctly implemented it. I have no idea what best practices are in that regard. If anybody here has a better idea, I'd love to hear (Is FIPS certification a good sign? If the drive implements encryption and can therefore do a secure erase by dropping the keys can it be trusted? Can drive vendors generally trusted to not use ECB mode? etc.)

discreditable 12y ago

Windows post-Vista will write zeroes to the entire partition if you format without the quick option. [1] [1] https://support.microsoft.com/kb/941961 https://support.microsoft.com/kb/941961