Tuesday I wrote a bit about securely erasing data from a hard drive and I mentioned Darik’s Boot and Nuke.  DBAN is a nifty little system that will write a bootable diskette or CD that you can use to completely (as much as reasonably possible) eliminate all traces of your data from a hard drive.  The image that it writes contains a pared-down bootable Linux system and the program that actually erases the data.  It’s all quite easy to use.

I used the free Eraser program to create the DBAN bootable disk and then popped that into my Devil Machine (a Celeron 666 lab machine) to test it out.  DBAN supports a number of different secure erasure techniques, ranging from very low to very high security.  The default is the DOD 5220.22-M method, which the program ranks as medium security.  At that level your data probably won’t hide from the FBI or the NSA, but your average identity thief or local law enforcement crime lab wouldn’t be able to do anything with it.  I tried to use the more secure Gutmann technique, but the program failed because it was unable to allocate enough memory.  I don’t know why, exactly, but I didn’t feel like futzing with it.  Besides, I’ve never used this lab machine for anything critical, so the chances of it containing anything personal or incriminating are vanishingly small.

It took DBAN right at two hours to make the seven passes required to securely erase my 100 GB drive.  I guess it would take 10 or more hours to complete the 37 passes of the Gutmann method?  I’ll try it on one of the other systems.

My only question now is how I prove that the thing actually worked?  I’m no dummy, but I have absolutely no way to verify that the program did what it claims to do.  I could download the source code and build my own version of the program to ensure that what I ran is indeed what the author wrote.  I’m even capable of understanding what the code does.  I could prove that it actually implements the secure erasure methods that it claims.

I could inspect data on the individual disk sectors, but all that will tell me is that the drive electronics can’t discern any meaningful data.  I don’t have the equipment or the knowledge to inspect the drive any other way.

I’m satisfied that what I downloaded works, and I’m not going to fret about it.  But this illustrates a fundamental truth about security.  At some point you have to trust somebody.  I’m smarter than your average computer user (about computers, anyway), able to read and understand source code and inspect disk sectors to see if any of my data remains in a normally readable.  But even I have to take somebody’s word for it that the method used by DBAN actually makes it difficult or impossible to reconstruct meaningful data from my hard drive.

In any case, I strongly recommend Eraser and DBAN.  Do yourself a favor and use them before you let go of a hard drive.