Dd - Destroyer of Disks

These notes cover useful things you can do with `dd`.

Securely erase a drive

This will destroy all data on a drive using `dd`. If you are in a hurry then just drill a hole through the top of case into the platters.

# faster, all zeros
dd if=/dev/zero of=/dev/sda bs=1M
# nearly ten times slower, pseudorandom data
dd if=/dev/urandom of=/dev/sda bs=1M

Alternatively, you can do this:

# faster, all zeros
cp /dev/zero /dev/sda
# nearly ten times slower, pseduorandom data
cp /dev/urandom /dev/sda

Tinfoil hat paranoia

It takes about 15 minutes to destroy a 1GB file using GNU `shred` (default options). It takes 30 seconds to destroy the file using 'dd if=/dev/zero of=somefile bs=1024 count=1M'. This is on a laptop with a 1.6Ghz dual core, 2GB RAM machine with a Seagate Momentus ST9160823AS laptop drive with ext3 filesystem -- in other words, nothing fancy.

Some people say that this isn't really secure because they heard that it's possible to read data that has been overwritten. Peter Gutmann theorized that overwritten data could be recovered through the use of Scanning transmission electron microscopy. He theorized -- never once demonstrated. Somehow this became accepted as fact, so now everyone believes that supposedly the NSA and space aliens can read erased bits on a drive. Maybe they can, but I doubt that even professional forensic security experts can recover data after it has been overwritten with random bits. If your data is so sensitive that the government has to call the NSA or hire space aliens then you don't need my advice. Many drive erasure tools use slow methods to attempt to prevent space aliens from recovering erased data. These tools overwrite data repeatedly. This can take hours! Yet there is not a single example of overwritten data having ever been recovered using any exotic, theoretical method.

One step disk wipe tool

This is useful if you want to reuse a lot of drives: Darik's Boot and Nuke

Erase MBR

I had Linux with GRUB installed on a machine. I needed to get rid of it and put Windows on the machine. I used a Ghost recovery disk to restore Windows on it, but Ghost didn't restore the MBR. GRUB was still lurking in the Master Boot Record. On boot GRUB would try to start but would error out. Wiping out the MBR fixed the problem. This will wipe out the MBR of a disk (sda in this example):

dd if=/dev/zero of=/dev/sda bs=446 count=1

Note that the this only erases part of the MBR with executable boot code. It you also wish you erase the partition table and the entire MBR then use this:

dd if=/dev/zero of=/dev/sda bs=512 count=1

Image a drive over a network

You can image a drive and have it stored directly on a remote server without touching a local disk. Here are two ways to do this.

Image a drive over a network with `dd` and `ssh`

I like this method better because this does it all from a single command on the sending side and the traffic is encrypted:

dd if=/dev/sda | gzip -c - | ssh user@example.com "dd of=disk_image.gz"

Image a drive over a network with `dd` and `nc` (netcat)

This example assumes the receiving machine's IP address is 192.168.1.100. I use port 2222 here, but you can use any port.

Start the receiving side first:

nc -l -p 2222 > disk_image.gz

Then start the sending side:

dd bs=1M if=/dev/sda | gzip -c - | nc 192.168.1.100 2222

Notes

If you are doing this on a live server you will need to unmount the drive or switch to single user mode (reboot and set single for boot option in GRUB) or you can boot from a live CD. If you boot into single user mode, don't forget to manually start the network. I have not done a lot of testing with copying a mounted disk in single user mode. This is not the ideal way, but it seems to work. It's better if the drive is not mounted.

Show progress status statistics of `dd`

Operations with `dd` can take a long time. Unfortunately, there is no command-line option to have `dd` print progress, but you can send the `dd` process a USR1 signal to have it print the progress statistics. For example, say you started `dd` and you know its PID is 15045. Example:

kill -USR1 15045

Here is a fancier example this will update every 10 seconds:

dd if=/dev/sda | gzip -c - | ssh user@example.com "dd of=disk_image.gz" &
pid=$!
while ps -p $pid > /dev/null; do kill -USR1 $pid; sleep 10; done