|
Hardwipe supports a range of data sanitization schemes in common use throughout government agencies around
the world. These are described below, and are listed in order of how long they will typically take to run,
from the fastest to the slowest.
Verification: All schemes can be performed with an option to verify the last overwrite pass.
Fast Zero
This is the simplest scheme and overwrites data in a single pass with zero value bytes. The use of zero
value data make it useful for virtual disk optimization. However, it is suggested that the
Random Data scheme or GOST R 50739-95
be preferred for general use.
Random Data
This scheme overwrites data in a single pass with pseudo-random values. A verification pass can also be performed
if required.
GOST R 50739-95
The GOST R 50739-95 scheme performs 2 overwrite passes, and is implemented as follows:
- 1. Writes zero bytes (0x00)
- 2. Writes pseudo-random bytes
- 3. Optional last pass verification
This scheme was originally defined in the Russian Federation and is sometimes refered to in the West as
"GOST P50739-95". Further information is available
here.
DOD 5220.22-M
Hardwipe implements this scheme as follows:
- 1. Writes zero bytes (0x00)
- 2. Writes high bytes (0xFF)
- 3. Writes pseudo-random bytes
- 4. Optional last pass verification
This data sanitization method was originally defined by the US National Industrial Security Program (NISP) in
the document DOD 5220.22-M. Use of this scheme with the verification option is equivalent DOD 5220.22-M(d),
but note that only the last pass is verified. This implementation also appears to be compliant with the
following other schemes:
HMG IS5,
AFSSI-5020, and
NAVSO P-5239-26.
Note. Although the DOD 5220.22-M overwrite scheme originated in US Department of Defense, it is no
longer used within the various members of the CSA.
Schneier
The Schneier scheme performs 7 overwrite passes, and is implemented as follows:
- 1. Writes high bytes (0xFF)
- 2. Writes zero bytes (0x00)
- Passes 3-7: Writes pseudo-random bytes
- 8. Optional last pass verification
The Schneier method was created by Bruce Schneier and appeared in his book "Applied Cryptography:
Protocols, Algorithms, and Source Code in C" (ISBN 978-0471128458).
Gutmann
The Gutmann method performs 35 overwrite passes, using specific byte patterns, as follows:
- Passes 1-4: Writes pseudo-random bytes
- 5. Writes 0x55 bytes
- 6. Writes 0xAA bytes
- 7. Writes the sequence: 0x92, 0x49, 0x24
- 8. Writes the sequence: 0x49, 0x24, 0x92
- 9. Writes the sequence: 0x24, 0x92, 0x49
- 10. Writes 0x00 bytes
- 11. Writes 0x11 bytes
- 12. Writes 0x22 bytes
- 13. Writes 0x33 bytes
- 14. Writes 0x44 bytes
- 15. Writes 0x55 bytes
- 16. Writes 0x66 bytes
- 17. Writes 0x77 bytes
- 18. Writes 0x88 bytes
- 19. Writes 0x99 bytes
- 20. Writes 0xAA bytes
- 21. Writes 0xBB bytes
- 22. Writes 0xCC bytes
- 23. Writes 0xDD bytes
- 24. Writes 0xEE bytes
- 25. Writes 0xFF bytes
- 26. Writes the sequence: 0x92, 0x49, 0x24
- 27. Writes the sequence: 0x49, 0x24, 0x92
- 28. Writes the sequence: 0x24, 0x92, 0x49
- 29. Writes the sequence: 0x6D, 0xB6, 0xDB
- 30. Writes the sequence: 0xB6, 0xDB, 0x6D
- 31. Writes the sequence: 0xDB, 0x6D, 0xB6
- Passes 32-35: Writes pseudo-random bytes
- 36. Optional last pass verification
Note. The Gutmann method was originally designed for a different kind of hard disk than used today and,
because of this, its use is probably overkill for modern HDDs. In an epilogue to the original paper, Gutmann
himself said that "For any modern PRML/EPRML drive, a few passes of random scrubbing is the best you can do."
For solid state drives, however, it is believed that there is some benefit with a high number of overwrite
passes. See here for more information.
|
