3

I know that with

dd if=/dev/urandom of=/dev/sdX bs=1M count=hdd_size_in_MB

you can wipe a whole disk with random data. But urandom is very slow. So I wonder if it would be possible to just create only like 100MB-1000MB of random data store it in the RAM and write it multiple times over the whole disk instead of creating TBs of random data which is very CPU heavy?

How would I do that?

user3776738
  • 135

2 Answers2

3

Couple of things:

  1. multiple passes in overwriting with random data have long been disputed to be helpful in making data irrecoverable – that paper where that was recommended is technically obsolete. For a more in-depth discussion, you'd want to read https://security.stackexchange.com/questions/10464/why-is-writing-zeros-or-random-data-over-a-hard-drive-multiple-times-better-th/10474#10474 (I also have written a longer rant about this here, somewhere. Point is: any modern recording technique will scramble the data, anyways, making it totally irrelevant whether you overwrite with white data or with constant data from a magnetism point of view. If your threat model is that someone with months of time and an electron microscope as well a lab of experts reads your 0-overwritten hard drive, do not throw it away, resell or reuse it, but physically destroy it. The whole threat model is insane.)
  2. If you wanted the non-recoverability, and if random overwriting actually helped taking a shorter sequence and repeating it leaves you to statistical attacks, driving your approach ad absurdum
  3. No need for dd; a simple cat < /dev/urandom > /dev/sdX would let the kernel decide on sensible read/write sizes itself. I mean, these writes are buffered by the storage layer and the hard drive, anyways.
  4. Instead of doing chacha20 in the kernel single-threadedly and having a context switch every couple of kB, you could ask openssl or similar to encrypt a static seed with chacha20 and write that to disk. (or you could just write your own random number generator and seed it – again, the whole idea of random overwriting is moot, but it should be reasonably impossible to reconstruct the seed of any sufficiently large-state PRNG, even if it's not cryptographically secure)
Marcus Müller
  • 28,836
2

You have among coreutils the shred command which can rewrite randomly a file or a device. It works by default with the whole file device (a partition for example), but the --size/-s can give it a size.

It is quite efficient.

Frédéric Loyer
  • 2,733