WipeDrive Enterprise Versin 8, March 31, 2017 Table f Cntents IMPORTANT! PLEASE READ CAREFULLY:... 4 General Infrmatin... 4 WipeDrive Enterprise... 4 Overview... 4 Key Features... 5 Secure Remval f HPA and DCO... 5 Secure Erase Optin... 5 Detailed Audit Lgging... 5 Running WipeDrive Enterprise... 6 Wiping Remte Cmputers Via WipeDrive.EXE... 7 Overview... 7 Required fr Remte Desktp Cnnectin:... 7 Required fr PSExec:... 7 Remte Desktp Cnnectin Walkthrugh... 8 WipeDrive Bt Via CD r USB... 13 Overview... 13 System Requirements... 13 BIOS Settings... 13 Wipe Prcess via CD r USB... 14 Cnfiguratin Settings... 16 WipeDrive Bt Via PXE... 19 Setup Diagram... 20 Wipe Prcess Via PXE... 21 Install the PXE Server... 23 Overview... 23 WipeDrive Bt Via.EXE... 24 Overview... 24 System Requirements... 24 Setup Diagram... 24 Wipe Prcess Via.EXE... 25 Overwrite Patterns... 28 Lg Frmat Types... 29 Plain Text Lg File Optin... 29 Extensible Markup Language (XML) Lg File Optin... 31 2
WipeDrive Enterprise Versin 8, March 31, 2017 Cmma Delimited (CSV) Lg File Optin... 33 PDF Lg File Optin... 35 HTML Lg File Optin... 37 Audit Lg Destinatin Optins... 40 USB Drive Optin... 40 Netwrk File System Optin... 40 Email Optin... 40 MySQL/MS SQL Audit Lgging Optin... 41 Addendum 1 - Setting Up SQL Lgging... 41 SQL Database Viewer (Audit Tl)... 42 Addendum 2 - Cmmand Line Parameters... 43 Wiping and Verifying... 44 Lgging... 44 Lgging t FTP... 44 Lgging t Email... 45 Lgging t SQL Database... 45 Addendum 3 Drive Verificatin... 45 Addendum 4 Lg Field Explanatin... 46 Addendum 5 MD5 Hash... 47 Addendum 6 Optins: Wiping Tab... 49 3
WipeDrive Enterprise Versin 8, March 31, 2017 IMPORTANT! PLEASE READ CAREFULLY: Thank yu fr chsing WipeDrive Enterprise. Befre running WipeDrive, please make sure that any files, flders, and any ther infrmatin yu wish t preserve is backed up n anther media device (CD/DVD/EXT HD). WipeDrive will securely delete all infrmatin n the hard drive(s); the infrmatin will NOT be recverable by any means including frensic recvery tls. General Infrmatin WipeDrive Enterprise will nt be able t access the drive's previusly allcated drive letter (c: d: etc.). Details such as the drive size, serial number and manufacturer will be displayed in the drive selectin menu t help identify individual drives. While wiping a hard drive n a laptp it is recmmended that it remain plugged-in t a pwer surce as the wiping prcess can take an extended amunt f time and may lck the hard drive if the laptp lses pwer. (Factrs such as hard drive size and wiping methds determine this amunt f time.) WipeDrive Enterprise OVERVIEW When a Windws r Linux system saves a file, it des tw things: it creates an entry fr the file in the Master File Table, which functins as a srt f table f cntents fr the drive, and it saves the file data itself nt sectrs f the hard drive. If a file is deleted using the Recycle Bin, the file is nt actually deleted. The file s entry in the Master File Table is deleted, but the data itself still remains intact n the hard drive, while the space that it ccupies is marked fr use, letting the system knw that the space is available fr new files t be written t. Unless new data is written t the space held by the deleted file, the riginal file still exists n the drive in its riginal state. Any number f file recvery prgrams can easily lk thrugh the drive and find remnants f the file s entry in the Master File Table and put the file back tgether, making it as if it was never deleted in the first place. The nly way t truly delete a file is t verwrite it with ther infrmatin. The primary purpse f WipeDrive is t securely verwrite all data t make any type f data recvery impssible and dcument the prcess t cmply with all applicable crprate and gvernment regulatins. 4
WipeDrive Enterprise Versin 8, March 31, 2017 Key Features SECURE REMOVAL OF HPA AND DCO A hst prtected area, smetimes referred t as hidden prtected area, is an area f a hard drive that is nt nrmally visible t an perating system. A Device Cnfiguratin Overlay (DCO) is a hidden area n many f tday s Hard Disk Drives (HDDs). Usually when infrmatin is stred in either the DCO r Hst Prtected Area (HPA), it is nt accessible by the BIOS, OS, r the user. As part f the wipe prcess WipeDrive securely remves and verwrites all data cntained in HPA s and DCO s. SECURE ERASE OPTION A mdern hard drive cmes with many spare sectrs. When a sectr is fund t be bad by the firmware f a disk cntrller, the disk cntrller remaps the lgical sectr t a different physical sectr. The ANSI T-13 cmmittee which versees the Advanced Technlgy Attachment (ATA) (als knwn as IDE) interface specificatin and the ANSI T-10 cmmittee which gverns the Small Cmputer System Interface (SCSI) specificatin have incrprated int their standards a cmmand feature knwn as Secure Erase (SE). It cmpletely erases all reallcated disk sectrs (sectrs that the drive n lnger uses because they have hard errrs in them). WipeDrive uses the SE cmmand as part f its United States Department f Defense 5220.22-M cmpliant (DD 5220.22-M) wipe prcess, t ensure the erasure f remapped sectrs. DETAILED AUDIT LOGGING Dcumenting the secure data destructin prcess is requirement fr mst Gvernment agencies, cmpanies invlved in health care and the financial sectr. WipeDrive creates an audit lg dcumenting every necessary detail t cmply with all majr regulatins including DD 5220.22-M, HIPAA, SOX and thers. 5
WipeDrive Enterprise Versin 8, March 31, 2017 Running WipeDrive Enterprise Because rganizatins can be large r small, centralized r with thusands f lcatins WipeDrive Enterprise has multiple implementatin ptins. Each ptin has its strengths; all are available t yu under yur license agreement. WipeDrive Enterprise can be implemented and run in three different ways. Fr specific instructins and details please see the crrespnding sectin. The three ptins are: Bting frm the CD r USB (see page 13) Nrmally the best methd when wiping a small number f systems. Target System WipeDrive Enterprise PXE Sftware Designated Server Via PXE netwrk bting (see page 19) Nrmally the best methd when many cmputers are brught t a central lcatin. Netwrk Switch Client Cmputers Hard Drives Administratr System Via.EXE (see page 24) Nrmally the best methd when many cmputers are n the same netwrk. This ptin allws systems t be wiped remtely. WipeDrive Executable Applicatin Client Cmputers Hard Drives 6
WipeDrive Enterprise Versin 8, March 31, 2017 Wiping Remte Cmputers Via WipeDrive.EXE OVERVIEW This methd is best if wanting t securely wipe a cmputer nt readily accessible. Using the WipeDrive applicatin yu can wipe a cmputer remtely ne f tw ways; thrugh Remte Desktp Cnnectin r thrugh PsExec. This walkthrugh will cver bth. Befre prceeding with this ptin please nte the required criteria necessary fr this t wrk. REQUIRED FOR REMOTE DESKTOP CONNECTION: Cmputer Name User User Passwrd (a passwrd MUST exist) Micrsft prvides a thrugh FAQ sheet abut using this prgram at the fllwing lcatin: http://windws.micrsft.cm/en-us/windws-vista/remte-desktp-cnnectin-frequently-asked-questins REQUIRED FOR PSEXEC: PsExec: http://technet.micrsft.cm/en-us/sysinternals/bb897553.aspx Grant permissins thrugh Regedit (See PSExec setup page 10) Cmputer Name User User Passwrd (a passwrd MUST exist) 7
WipeDrive Enterprise Versin 8, March 31, 2017 REMOTE DESKTOP CONNECTION WALKTHROUGH Befre using this ptin make sure the client cmputer either already has the WipeDrive executable prgram r has access t it via a dwnlad r netwrk. If yu are unable t place the WipeDrive wizard frm yur lcatin nt the client cmputer refer t the PsExec remte wiping ptin. Step 1: The Remte Desktp Cnnectin prgram is included in the Windws prgram s n install is necessary. It can be fund under Start - All Prgrams - Accessries Running the prgram will reveal the fllwing windw. Nte: On Windws 10 it can be fund under Start All Apps Windws Accessries. Step 2: Next enter the Cmputer name f the machine yu wish t access as well as the user. If it desn t ask fr a user at this pint just enter the Cmputer name and click Cnnect. Step 3: Once the prgram cnnects t the machine it will require yu enter the lgin credentials. This will nt wrk if the cmputer yu are attempting t access isn t passwrd prtected, there must be a passwrd. Once the User name and Passwrd are entered click OK. 8
WipeDrive Enterprise Versin 8, March 31, 2017 Step 4: Yu may see this authenticatin required windw appear. This warning is just a precautin in the event yu are lgging int a malicius cmputer. T access the remte cmputer click Yes t authrize a cnnectin. Step 5: After authrizing a cnnectin yur screen will change t the desktp f the client cmputer. Frm here yu can manipulate the cmputer and run the WipeDrive Wizard. Navigate t the lcatin f WipeDrive and launch the wizard. See page 24 fr a walkthrugh n using the WipeDrive executable. 9
WipeDrive Enterprise Versin 8, March 31, 2017 Remte wiping via PsExec Walkthrugh Befre beginning this prcess understand the ptins fr this methd are limited at this time. There are plans t increase the custmizability f using PsExec but fr nw this prgram will run WipeDrive with the fllwing settings: Wipe ALL drive Wipe methd Department f Defense 3-Pass There are a few things that must happen prir t using this sftware fr yur remte wiping needs. Dwnlad and extract PsExec frm the fllwing lcatin: http://technet.micrsft.cm/en-us/sysinternals/bb897553.aspx Extract the files t a knwn lcatin. PsExec needs permissins t access the client cmputer and make changes. This will require that yu edit the Regedit n the client cmputer. Access client cmputer and pen Regedit. Navigate t the fllwing lcatin: HKEY_LOCAL_MACHINE\Sftware\Micrsft\Windws\CurrentVersin\Plicies\System Once in this flder add the fllwing by right clicking, selecting New and then chsing DWORD (32-bit) Value Give it the name LcalAccuntTkenFilterPlicy Right click LcalAccuntTkenFilterPlicy and select Mdify t set the value t 1. Click OK Clse Regedit. Uplad the WipeDrive wizard nt the client machine unless yu plan t cpy the file ver frm the hst cmputer t the client using PsExec. Once these steps are cmplete yu can begin using PsExec, the fllwing walkthrugh will demnstrate hw t d this. Step 1: Run the cmmand prmpt n the hst machine. D this by clicking Start and typing cmd int the Search prgrams and files field then press Enter. T run the prgram navigate t where the PsExec files are lcated. In this screen sht the PsExec files are dwnladed and extracted within the Dwnlads flder. Press Enter t start 10
WipeDrive Enterprise Versin 8, March 31, 2017 Step 2: This step is split int tw parts: running WipeDrive frm the WipeDrive applicatin already n the client cmputer and using PsExec t cpy the WipeDrive executable t the client machine and then running it. Part 1: Running WipeDrive frm the executable already lcated n the client. This screen sht shws an example f hw t use PsExec t run WipeDrive frm an executable that already exists n the client. The fllwing is an explanatin f each cmmand being passed t PsExec: Psexec: runs the prgram \\Test: This is the name f the client machine u: Username f accunt n client cmputer p: Passwrd f user accunt n client cmputer h: This cmmand is required fr clients running Windws Vista r higher. C:\WipeDriveWizard.exe : This is the lcatin f the WipeDrive executable. In this example the prgram is lcated n the rt f the C drive. --remte: Allws yu t remtely start the prgram (Be sure t use duble dashes) --cli: must have s prgram knws t run in cnsle frm (Be sure t use duble dashes) If all parameters are valid and PsExec can find the lcatin f WipeDrive, the WipeDrive Wizard will begin installing the necessary tls t remtely run the sftware. At this pint the client machine will rebt int WipeDrive and begin wiping ALL drives using the Department f Defense 3-Pass wipe methd. 11
WipeDrive Enterprise Versin 8, March 31, 2017 Part 2: Using PsExec t cpy and run WipeDrive nt client cmputer. First, place a cpy f the WipeDrive wizard int the same flder where psexec.exe is lcated. This is critical in rder fr the prgram t find and cpy the applicatin. Here is a screen sht f hw t prperly setup the parameters in rder t cpy the WipeDrive wizard frm the hst machine t the client. Just as befre, here is an explanatin f the parameters required t cpy the WipeDrive applicatin t the client cmputer and then run it: Psexec: Run fllwing parameters thrugh PsExec \\Test: Name f client cmputer u: Username f accunt n client cmputer p: Passwrd f user accunt n client cmputer h: This cmmand is required fr clients running Windws Vista r higher c WipeDriveWizard.exe: The cpy cmmand fllwed by the file t be cpied and ran n the client machine. (Only wrks if file is fund in same lcatin as PsExec) --remte: Allws yu t remtely start the prgram (Be sure t use duble dashes) --cli: must have s prgram knws t run in cnsle frm (Be sure t use duble dashes) If all parameters are valid and PsExec can find the lcatin f WipeDrive the fllwing screen will appear: As yu can see PsExec cpied the WipeDrive Wizard and began installing the necessary tls t remtely run the sftware. At this pint the client machine will rebt int WipeDrive and begin wiping ALL drives using the Department f Defense 3-Pass wipe methd. 12
WipeDrive Enterprise Versin 8, March 31, 2017 WipeDrive Bt Via CD r USB OVERVIEW Running WipeDrive via CD r USB is nrmally a gd chice when then number f cmputers t be wiped are small as the CD/USB must be inserted and bted n each system. SYSTEM REQUIREMENTS All versins f DOS, Windws 3.x, 9x, NT, 2000, XP, Vista, 7, OS/2, PC-based, 8, 8.1, and 10, Linux, Unix and Intel-based Mac systems. Any type f hard drive (IDE, SCSI, SATA, SSD). CD-ROM Drive 64 MB RAM BIOS SETTINGS T run WipeDrive Enterprise via CD/USB insert the media int the cmputer and check that the BIOS is set t first bt frm the CD r USB drive. T change the bt sequence, access the BIOS f the cmputer during the initial start-up f the system. When the cmputer first turns n/restarts a screen will flash with ptins t enter either Setup r Bt, as well as a key t press fr each crrespnding ptin. See table belw fr knwn BIOS keys based n system manufacturer. The key must be pressed quickly, therwise the cmputer will cntinue with its usual bting rutine. Manufacturer Acer Cmpaq Dell emachine Gateway HP IBM Lenv Apple Micrn Sny Tshiba BIOS Key F1, F2, CTRL+ALT+ESC F10 F2, DEL DEL, F2 F1, F2 F1, F2, ESC F1 F1, F2 Hld dwn Optin F1, F2, r DEL F2, F3 ESC, F1 NOTE: If yur particular cmputer r manufacturer is nt displayed, the BIOS keys are nrmally either DEL r F2. 13
WipeDrive Enterprise Versin 8, March 31, 2017 Wipe Prcess via CD r USB Step 1 Insert WipeDrive int the CD-ROM drive r USB prt and restart the cmputer. WipeDrive will nw lad the necessary drivers. Step 2 WipeDrive will nw ask fr yur Clud Activatin Cde. If yu have a Clud Activatin Cde, enter it in the 4 bxes nw then press Use Clud. Yur cde can be fund in the email with yur dwnlad links. If yu have a dngle, please insert the dngle nw and press Use Dngle. Step 3 WipeDrive will nw display all attached hard drives. Please select the drives yu wish t securely erase. Select Next t cntinue. Step 4 If yu wish t change the lg frmat r destinatin; please select Optins. Frm here yu can als set Custm Lg Fields, enter yur activatin cde r dngle credentials, r view Netwrk Utilities 14
WipeDrive Enterprise Versin 8, March 31, 2017 Step 5 By selecting the inf icn next t the drive serial number, yu can view the Drive Details. Step 6 By selecting the Sectr icn next t the drive serial number yu can see the Sectr Viewer. Step 7 In the bttm right hand crner f the Drive Selectin screen, yu can select Wipe Drives r Verify Drives. Select Next t cntinue. Step 8 The verwrite pattern can be changed n this screen. WhiteCanyn recmmends either the Standard Overwrite r the DD 5220.22-M Overwrite Pattern. Please see page 32 fr mre details n wipe patterns. Select Next t cntinue. Step 9 WipeDrive will warn that this prcess is irreversible. Select Wipe t cntinue. 15
WipeDrive Enterprise Versin 8, March 31, 2017 Step 10 WipeDrive will nw begin wiping the hard drive. Warning: If yu cancel the wipe befre cmpletin there may still be recverable data left n the drive. Step 11 When the prcess is cmpleted WipeDrive will display the Wiping Results screen and save the lg file if applicable. Step 12 Select Lg Results t view the lgging details. Click Rebt r Shut Dwn t exit WipeDrive. Cnfiguratin Settings Lg Types WipeDrive ffers a variety f different lg type frmats. Within the Optins menu, under the Lg Types and Destinatins tab, simply select in which frmat/s yu wuld like the lgs t be created.* *The Database frmat requires additinal infrmatin in rder t prperly create the file. These details include: Server Type (MySQL r MS SQL) Hst Username 16
WipeDrive Enterprise Versin 8, March 31, 2017 Passwrd Database credentials Prt/Instance Lg Destinatin Fr user cnvenience, WipeDrive has multiple methds in which a lg file may be saved. Please reference the fllwing instructins n hw t take advantage f these ptins. All authenticatin data t external servers is sent in plain text. WipeDrive shuld be used in a trusted internal netwrk if prtecting the authenticatin data t the third-party servers is a pririty. Windws Share This feature allws the user t save the lg file t a shared netwrk f files. The fllwing infrmatin is required: FTP Hst Username Passwrd Dmain Path (ptinal). The FTP ptin allws the user t save the lg file t an FTP server. This requires the fllwing infrmatin: Hst, Username Passwrd Path (ptinal) Remvable By default WipeDrive will try t lg t a remvable USB drive. In rder t ensure the lgging prcess is a success, make sure a USB drive is plugged int the cmputer running WipeDrive. Email WipeDrive als allws the user t send the lg file t a specific email. Nte: The sending party will be labeled as rt. The user must enter the fllwing infrmatin: Hst Username 17
WipeDrive Enterprise Versin 8, March 31, 2017 Passwrd Frm (sending email) T (receiving email) CC Subject Custm Lg Fields The Custm Lg Fields tab under Settings allws the user t add additinal infrmatin t the lg file. Infrmatin such as the Cmputer ID, a Username, as well as any ther custm infrmatin the user wishes include in the file. Cmputer ID This feature allws the user t give the cmputer being wiped a specific identificatin label. WipeDrive will prmpt the user t enter the Cmputer ID after the warning page prir t the initiatin f the wiping prcess. Username The username feature wrks the same way as the Cmputer ID. The user will be prmpted t enter a username prir t the wiping prcess. Custm Fields A user can add up t 10 custm lg fields. Each field can be selected t prmpt the User either befre r after the wiping prcess t enter a value r enter the default value at this screen. See addendum 7 fr mre custm ptins. 18
WipeDrive Enterprise Versin 8, March 31, 2017 WipeDrive Bt Via PXE Overview Running WipeDrive via PXE is nrmally a gd chice when the number f cmputers t be wiped is large. Because the server cntrls the prcess, it is nt necessary t attach mnitrs, mice r keybards t wrkstatins. The prgress fr each individual system is displayed n the server, the nly requirement is that the bt pririty fr the system be set t Netwrk Bt. Depending n the hardware used WipeDrive can supprt hundreds f systems simultaneusly. System Requirements Cmputer designated t be the server (will nt be wiped) with at least the fllwing hardware: Pentium III-class prcessr r better 1 GB RAM CD-ROM drive Netwrk card If using Clud activatin r lgging utside the PXE netwrk a secnd netwrk card is required. One r mre machines, referred t as the clients, with at least the fllwing hardware: Pentium-class prcessr r better 512 MB RAM Netwrk card Netwrk switches and cabling t cnfigure all f the machines (server and clients) t be in the same netwrk. 19
WipeDrive Enterprise Versin 8, March 31, 2017 SETUP DIAGRAM WipeDrive Enterprise PXE Sftware Designated Server Netwrk Switch Client Cmputers Hard Drives 20
WipeDrive Enterprise Versin 8, March 31, 2017 Wipe Prcess Via PXE Step 1 Insert the WipeDrive PXE CD int the CD-ROM drive and restart the Server. Please Nte: The Server must have at least 1 GB f RAM. The cmputer will then display the WipeDrive Client Screen. T edit the type f wipe, please select Change Client Settings. Step 2 WipeDrive will nw list the Wipe Settings that can be adjusted. Please select the necessary ptins then select the Lg Types and Destinatins tab. Step 3 The Lg Types and Lg Destinatins menu will allw the User t adjust these settings. Select the necessary ptins and select the Custm Lg Fields tab. Step 4 The Custm Lg Fields menu will allw the User t include specific fields in the Lg File. WipeDrive will prmpt fr these fields prir t running the deletin. Please select the Activate tab. 21
WipeDrive Enterprise Versin 8, March 31, 2017 Step 5 The Activatin menu allws the user t select activatin ptins. These ptins include Clud Accunt activatin, using an activatin dngle n the PXE server, and/r using the activatin dngle n the client machines. Next click the Alerts tab. Step 6 The Alerts menu allws the User t select alert methds fr when the wipe cmpletes n the Client machines. Click Accept t save the ptins. Step 7 Restart each Client machine. The Client machines will bt int WipeDrive ver the Netwrk and begin the wipe. The Server will display the wipe prgress n each Client machine. 22
WipeDrive Enterprise Versin 8, March 31, 2017 Install the PXE Server OVERVIEW If yu prefer nt t bt frm any btable media each time yu run the PXE server, it is pssible t install PXE t the server instead. It des nt make any difference n hw the sftware runs hwever, and is slely based n preference. Step 1 Insert the WipeDrive PXE CD int the CD-ROM drive and restart the Server. Please Nte: The Server must have at least 1 GB f RAM. The cmputer will then display the WipeDrive Client Screen. Step 2 Type exit anywhere n the screen and select yes t g t the cmmand prmpt. Frm here, type the fllwing withut qutatins and press enter: cd /hard_drive_install Nw type the fllwing withut qutatins and press enter t install t the hard drive:./hdinstall.sh Step 3 PXE is nw installed n the machine. Yu can nw eject the CD and restart the cmputer t cntinue PXE as nrmal. 23
WipeDrive Enterprise Versin 8, March 31, 2017 WipeDrive Bt Via.EXE OVERVIEW Running WipeDrive via EXE is nrmally a gd chice when then number f cmputers t be wiped is large and the systems are spread ut ver multiple lcatins. The.EXE build is a scripted build f WipeDrive that can be run ver a netwrk n any x86 system t which yu have administrative rights. The system will wipe remtely and send a lg file fr cnfirmatin when the prcess is cmplete. SYSTEM REQUIREMENTS Cmputer running Windws 98, NT, 2000, 2003, XP, Vista and 7. 8, 8.1 and 10 with disabled UEFI 256 MB Free Hard Drive Space 512 MB RAM SETUP DIAGRAM 24
WipeDrive Enterprise Versin 8, March 31, 2017 Wipe Prcess Via.EXE Step 1 Place WipeDrive n t the Client s desktp then duble click t run WipeDrive. Step 2 Windws will nw ask if yu wuld like t run this prgram. Please select Yes. Step 3 WipeDrive may ask fr an activatin cde, please enter the prvided cde given t yu nce the purchase was made. Many Enterprise licenses will skip this step if using a Dngle r a custm build. In rder t mve frward a valid activatin cde is required. After the cde is entered the Next buttn will activate. Click Next t prceed t the next screen. Step 4 Click n the drp dwn list t select which drive t wipe. There are nly tw ptins when selecting hard drives t be wiped, All Drives r a single individual drive. After selecting a drive click Next t cntinue. Step 5 At the Wipe Selectin menu, select the required wipe and select Next. 25
WipeDrive Enterprise Versin 8, March 31, 2017 Step 6 WipeDrive will nw verify that yu wish t securely verwrite the hard drive(s). Select Next t cntinue. Step 7 Befre beginning the wiping prcess WipeDrive will first install the required files. Step 8 In rder t verwrite the entire hard drive WipeDrive runs utside f Windws within a Linux kernel. Fr this t happen the cmputer must restart and bt int the WipeDrive prgram. Click Restart t begin this prcess. Step 9 Once the cmputer restarts yu will see a Bt Manager windw. Make sure t select WipeDrive Enterprise therwise the cmputer will bt back int Windws. Press Enter t cntinue. 26
WipeDrive Enterprise Versin 8, March 31, 2017 Step 10 At this pint WipeDrive will immediately begin wiping the drive(s) selected during setup. This screen will prvide sme useful infrmatin such as Time Remaining and if any disk errrs are detected. Step 11 After WipeDrive finishes it will display a screen stating whether r nt the hard drive was successfully verwritten as well as lgging results. This cncludes the WipeDrive prcess, yu can nw click either Rebt t restart the cmputer and reinstall an perating system. Or chse Shut Dwn t turn the cmputer ff. 27
WipeDrive Enterprise Versin 8, March 31, 2017 Overwrite Patterns WipeDrive Enterprise prvides specific verwrite patterns in cmpliance with varius gvernment agencies. The supprted verwrite patterns are listed and described in detail belw: Standard Single Pass - One verwrite (0 s) SSD Smarter Wipe Three verwrites. (0 s, specialized pattern designed fr SSD s, 0 s) DD 5220.22-M - Three verwrites with ne verificatin. (0 s, 1 s, Randm) DD 5220.22-M - Seven verwrites. (0 s, 1 s, Randm) HMG IS5 Baseline - One verwrite with verificatin. (0 s) HMG IS5 Enhanced - Three verwrites with verificatin. (0 s, 1 s, Randm) Canadian OPS-II - Seven verwrites with verificatin. (0 s, 1 s, Randm) Canadian CSEC ITSG-06 Three verwrites with single end verificatin. US Army AR380-19 Three verwrites with single end verificatin. US AFSSI 5020 Three verwrites with single end verificatin. US AFSSI 8580 Eighteen verwrites. German VSITR - Seven verwrites. NAVSO P-5239-26 - Three verwrites with verificatin. NCSC-TG-025 - Three verwrites with verificatin. Russian GOST P50739-95 versin 2 One verwrite. Australian DSD ACSI-33 (XO-PD) - Three verwrites with tw verificatins. SecureErase + 1 verwrite with verify r NNSA NAP 15.1-C Tw verwrites with single end verificatin. (0 s and 1 s) BSI-2011-VS Tw verwrites with tw verificatins. Btable Reprt Reprt that is saved t the hard drive and is btable. Custm Overwrite - User defined verwrite pattern. 28
WipeDrive Enterprise Versin 8, March 31, 2017 Lg Frmat Types PLAIN TEXT LOG FILE OPTION WipeDrive by default uses a plain text file frmat which can be saved t any destinatin ptin. A sample plain text lg file is shwn belw: 29
WipeDrive Enterprise Versin 8, March 31, 2017 The text file recrds the fllwing: Drive infrmatin MANUFACTURER SERIAL NUMBER DRIVE SIZE Settings User (Only applies when username prmpting is selected in Settings ) Cmputer ID (Only applies when Cmputer ID prmpting is selected in Settings ) Custm Field (Only applied when custm fields are created in Setttings ) Wiping Methd Operatin (Either verwrite r verify) Wipe Type Dates and Time Date & Time peratin started Date & Time peratin finished Ttal elapsed time Result f peratin Hard Drive Results Disk sectr read/write errrs Dirty/Unreadable disk sectrs HPA Detected HPA Erased Secure Erase Utilized 30
WipeDrive Enterprise Versin 8, March 31, 2017 EXTENSIBLE MARKUP LANGUAGE (XML) LOG FILE OPTION WipeDrive Enterprise can create an XML lg file, which is a ne page certificate detailing the system hardware and wipe prcess. The lg file type can be changed under Settings. A sample XML file is shwn belw: The XML lg file cntains the fllwing infrmatin if applicable: Hardware Infrmatin Cmputer Vendr Cmputer Mdel Cmputer Serial Number Mtherbard Vendr 31
WipeDrive Enterprise Versin 8, March 31, 2017 Mtherbard Mdel Asset Tag Chassis Type Prcessr RAM NIC Hard Drive Display Adapter Multimedia Adapter Strage Cntrller Number f USB, USB2, and USB3 prts Wipe Infrmatin Number f Target Drive Manufacturer f Hard Drive Drive Mdel Drive Serial Number Hard Drive Size Time Operatin Began Result f Operatin Username (Only applies if Username prmpt is selected under Settings. ) Cmputer ID (Only applies if Cmputer ID prmpt is selected under Settings. ) Custm Field (Only applied if custm fields are created under Settings. ) Duratin Wipe Methd Dirty Sectrs Drive Errrs Detected HPA Fund HPA remved Secure Erase Passes 32
WipeDrive Enterprise Versin 8, March 31, 2017 COMMA DELIMITED (CSV) LOG FILE OPTION A sample CSV file is shwn belw: The purpse f the.csv file is t allw lgs created by WipeDrive Enterprise t be easily imprted int a database r spreadsheet. The fllwing are details abut the peratin included in the cmma delimited file: Hard Drive Infrmatin Cmputer ID Cmputer ID Date & Time Drive Number Drive Mdel Drive Serial Drive Size Operatin Results Actin Result Actin Duratin Actin Start Time Actin End Time Username Actin Number f Wipes Detected Drive Errrs Dirty Sectrs Hardware Infrmatin Mtherbard Vendr Mtherbard Prduct CPU (Will include all CPUs present) RAM 33
WipeDrive Enterprise Versin 8, March 31, 2017 NIC Optical Drive Hard Drive(s) Vide Card Multimedia Card Number f USB prts Number f USB2 prts Cmputer Infrmatin Cmputer Vendr Cmputer Mdel Cmputer Serial Hard Drive Security Features HPA Detected HPA Remved DCO Detected DCO Remved Secure Erase Passes Secure Erase Enhanced Passes User Number Username 34
WipeDrive Enterprise Versin 8, March 31, 2017 PDF LOG FILE OPTION WipeDrive includes the ptin t lg a reprt in PDF frmat which can be saved t any destinatin ptin. An example can be seen belw: This reprt includes the fllwing details: Hardware Infrmatin Cmputer Vendr Cmputer Mdel Cmputer Serial Mtherbard Vendr Mtherbard Mdel Prcessr RAM NIC Which includes: Vendr and Mac Address DVD Writer Drive(s) Which includes: Vendr, Prduct, Serial, and Size 35
WipeDrive Enterprise Versin 8, March 31, 2017 Display Adapter Multimedia Adapter USB Prts Wipe Infrmatin Sftware Versin Target Drive Wipe Methd Actin Result Time Duratin Vendr Drive Mdel Drive Serial Drive Size Dirty Sectrs Drive Errrs Detected DCO Fund DCO Remved HPA Fund HPA Remved Secure Erase Passes 36
WipeDrive Enterprise Versin 8, March 31, 2017 HTML LOG FILE OPTION WipeDrive includes the ptin t lg a reprt in HTML frmat which can be saved t any destinatin ptin. An example can be seen belw: This reprt includes the fllwing details: Hardware Infrmatin Cmputer Vendr Cmputer Mdel Cmputer Serial Mtherbard Vendr Mtherbard Mdel Prcessr RAM NIC Which includes: Vendr and Mac Address DVD Writer Drive(s) Which includes: Vendr, Prduct, Serial, and Size Display Adapter Multimedia Adapter USB Prts Wipe Infrmatin Sftware Versin Target Drive Wipe Methd Actin Result 37
WipeDrive Enterprise Versin 8, March 31, 2017 Time Duratin Vendr Drive Mdel Drive Serial Drive Size Dirty Sectrs Drive Errrs Detected DCO Fund DCO Remved HPA Fund HPA Remved Secure Erase Passes 38
WipeDrive Enterprise Versin 8, March 31, 2017 BOOTABLE REPORT WipeDrive includes the ptin t lg a btable reprt t the hard drive. The reprt is then accessed by bting t the hard drive itself. This reprt includes the fllwing details: Wipe Infrmatin Sftware Versin Target Drive Wipe Methd Actin Result Time Duratin Drive Vendr Drive Mdel Drive Serial Drive Size Dirty Sectrs Drive Errrs Detected Secure Erase Passes 39
WipeDrive Enterprise Versin 8, March 31, 2017 Audit Lg Destinatin Optins USB DRIVE OPTION Any lg file type can be sent t a USB drive cnnected t the wipe machine. The USB drive must meet the fllwing criteria: 1. The USB size must be less than 16 GB therwise WipeDrive see it as an external HDD. 2. Frmatted in Fat 32; Linux prefers this type f frmat. 3. The USB drive must be frmatted and cnnected prir t bting int WipeDrive. NETWORK FILE SYSTEM OPTION WipeDrive Enterprise will write any f the lg file types t a lcatin n the lcal netwrk. This lg ptin requires a netwrk cnnectin fr the PC and permissin t access the designated flder. It als needs the fllwing infrmatin: 1. Prtcl Samba/ FTP 2. Server Name 3. User Name 4. Passwrd 5. Path EMAIL OPTION WipeDrive Enterprise will send any f the lg file types t a specific email address. This lg lcatin requires the fllwing infrmatin: 1. Server Name 2. Frm 3. T 4. CC 5. SMTP Username 6. SMTP Passwrd 40
WipeDrive Enterprise Versin 8, March 31, 2017 MYSQL/MS SQL AUDIT LOGGING OPTION WipeDrive Enterprise will send any f the lg file types t a MYSQL r MSSQL database. Mre infrmatin can be fund under Addendum 1. This lg lcatin requires the fllwing infrmatin: 1. Hst 2. Database 3. Username 4. Passwrd Addendum 1 - Setting Up SQL Lgging System Requirements (Server) MySQL Server 5.0 (r newer) MS SQL Server 2008 (r newer) Any perating system that supprts a MySQL/MS SQL installatin System Requirements (Wrkstatin/Client) Windws XP, Vista, r 7, 8, 8.1, 10.NET Framewrk 2.0 (r newer) Preparatin Befre the database can be initialized, yu will need t create a new blank database. This step must be perfrmed by hand. Fr security purpses, it is als highly recmmended t create a new user wh nly has access t this database. Please cnsult the MySQL/MS SQL dcumentatin r yur systems administratr if yu need assistance creating the database r new user. Initializatin Once the database has been created, launch the WipeDrive Database Initializer. A screensht f the user interface: Please fill in all prvided fields: 1. Database Name: The name f the newly created database. 2. Hst: The machine hsting the SQL database. This can be either an IP address r a DNS hstname. 3. Username: The name f a SQL user that has sufficient privileges t create tables in the database yu just created. 4. Passwrd: The passwrd fr abve username. Click the Ppulate Database buttn t cmplete initializatin f the database. If there are any errrs during the initializatin prcess, the prgram will display a message bx with debugging infrmatin. Once cmplete the server is cnfigured fr use with WipeDrive Enterprise. 41
WipeDrive Enterprise Versin 8, March 31, 2017 SQL Database Viewer (Audit Tl) The SQL database viewing utility, herein knwn as the Audit Tl, is used t view the audit lgs created by WipeDrive when used in cnjunctin with a SQL database. The tl is very simple t use and prvides an easy interface fr management t use fr audit purpses. System Requirements Windws XP, Vista, 7 (32-/64-bit cmpatible), 8, 8.1, 10.NET Framewrk 3.5 Basic Operatin T cnnect t the database yu will need t prvide the fllwing details: Hst: The IP address r DNS hstname f the server hsting the SQL database. Database: The name f the WipeDrive database. Username: The user accunt with credentials allwing it t view the WipeDrive database. Passwrd: The passwrd fr the user accunt prvided abve. Once successfully cnnected t the database, yu will see the main UI appear that shws all f the lgging peratins that have been perfrmed as well as their results. Yu are able t view which lgs are cnnected t which drives as well as which cmputer hardware was used when wiping said drive. Yu can als imprt XML files by clicking n Imprt Lg in the tp right hand crner then brwsing fr the XML yu wish t imprt. 42
WipeDrive Enterprise Versin 8, March 31, 2017 Addendum 2 - Cmmand Line Parameters Apart frm bth the TUI and GUI, WipeDrive can be run frm the cmmand line using the fllwing ptinal parameters belw. In rder t access the cmmand line, simply press ESC anytime within the TUI. When at the cmmand prmpt, typing wipedrive with n parameters will start the standard TUI driven WipeDrive prgram. Cmmand Line Usage: Example setup: wipedrive --wipe-level=1 --disk=0 --lg-directry=remvable --lg-file-types=x This particular cmmand tells WipeDrive t perfrm a Standard Overwrite n the first hard drive and t recrd an XML lg t an attached USB drive. Here is a list f each wipe methd and its crrespnding character: Wipe Level Name List: 1 = Single Overwrite (RECOMMENDED) (Recmmended fr mst security needs.) Nte: Overwriting data nce will make it impssible fr anyne t recver yur data using any sftware prgram. 2 = DD 5220.22-M 3-Pass 3 = DD 5220.22-M 7-Pass 4 = HMG IS5 Baseline 5 = HMG IS5 Enhanced 6 = Canadian OPS-II 7 = US Army AR380-19 8 = US Air Frce 5020 9 = German VSITR a = NAVSO P-5239-26 b = NCSC-TG-025 c = Russian GOST P50739-95 d = Australian ASCI-33 (X0-PD) e = SecureErase + 1 (NNSA NAP 14.1-C) f = Canadian CSEC ITSG-06 g = Air Frce 8580 y = Hardware lg nly NO WIPE z = Custm Overwrite pattern 43
WipeDrive Enterprise Versin 8, March 31, 2017 Here is a list f cmmnly used cmmand parameters. WIPING AND VERIFYING --wipe-level --disk --d-verify LOGGING --lg-directry --lg-file-types --username --cmputer-id --custm field Sets the default wipe level and disables the ptin fr the user t chse a wipe level thrugh the interface. (Values 1-9 and a-z) Sets the selected disk t wipe. (Use -1 t wipe all drives) Perfrms a full verificatin pass. Path where lg files will be saved. Lg file(s) frmat (r=regular, d=delimited, x=xml, q=sql, etc) User value, if n value is prvided yu will be prmpted t enter ne. Cmputer ID value, if n value is prvided yu will be prmpted t enter ne. Custm field, if n value is prvided yu will be prmpted t enter ne. LOGGING TO FTP --ftp-server --ftp-user --ftp-passwrd --ftp-directry FTP server name FTP username FTP passwrd Directry n the FTP server where the lg files shuld be saved. 44
WipeDrive Enterprise Versin 8, March 31, 2017 LOGGING TO EMAIL --mail-server --mail-frm --mail-t --mail-cc --mail-passwrd --mail-subject Email server t use t email lgs Name f persn email is frm (nte: rt will be the sender) Email address f lg(s) recipient Additinal address t email lgs Passwrd f SMTP user (nly specify if required by email server) Subject fr email LOGGING TO SQL DATABASE --db-hst --db-name --db-username --db-passwrd Fr a mre cmplete list cntact ur supprt team. Hstname f machine serving the database Name f the WipeDrive lgging database Database username Database passwrd Addendum 3 Drive Verificatin Drive verificatin is dne as part f a specific wipe pattern (i.e. DD 5220.22-M) r as a stand-alne functin. When drive verificatin is perfrmed, the disk is checked t certify that the drive is in ne f three states: 1. The drive cntains all binary 0 s 2. The drive cntains all binary 1 s 3. The drive cntains a repeated value (i.e. all a s) 4. The drive cntains randm data* If the drive is in ne f the three states the verificatin will pass, if nt the prcess will fail. Nte: WipeDrive uses a randm pattern where a randm character is generated fllwed immediately by its bitwise cmpliment. In this way, it is pssible t determine that the drive has been verwritten by randm data by the WipeDrive prgram. 45
WipeDrive Enterprise Versin 8, March 31, 2017 Addendum 4 Lg Field Explanatin Belw is a brief explanatin f each lg field that the sftware reprts. Hardware Infrmatin Wipe Infrmatin Cmputer Vendr Lists the vendr f the cmputer. Cmputer Mdel Lists the mdel f the cmputer Cmputer Serial Number Lists the serial number f the cmputer Mtherbard Vendr Lists the vendr f the mtherbard Mtherbard Mdel Lists the mdel f the mtherbard Asset Tag Lists the asset tag (usually in place f the cmputer serial number) Chassis Type Lists the chassis type Prcessr Lists infrmatin abut the prcessr (vendr, name, speed, etc.) RAM Lists infrmatin abut the RAM (vendr, capacity, speed, etc.) NIC Lists infrmatin abut the NIC (vendr, MACAdress, Speed, etc.) Hard Drive Lists infrmatin abut each individual drive Display Adapter Lists infrmatin abut the display adapter (vendr, prduct, PciID) Multimedia Adapter Lists infrmatin abut multimedia cards (vendr and prduct) Strage Cntrller Lists infrmatin abut the strage cntrller (vendr, prduct, etc.) Number f USB, USB2, and USB3 prts Lists the number f each type f USB prt. Number f Target Drive Numbers each f the drives Manufacturer f Hard Drive Lists the manufacturer f each hard drive Drive Mdel Lists the mdel f each hard drive Drive Serial Number Lists the serial number f each hard drive Hard Drive Size Lists the size f each hard drive Time Operatin Began States the time the wipe r verify began Result f Operatin States the result f the peratin (success, failure, r canceled by user) Username (Only applies if Username prmpt is selected under Settings. ) Lists the username Cmputer ID (Only applies if Cmputer ID prmpt is selected under Settings. ) Lists the cmputer ID Custm Field (Only applied if custm fields are created under Settings. ) Lists the custm fields Duratin States hw lng the peratin lasted Wipe Methd States the verwrite pattern used 46
WipeDrive Enterprise Versin 8, March 31, 2017 Dirty Sectrs Lists the number f dirty sectrs. Dirty sectrs ccur when a hard drive is failing but WipeDrive is still able t read/write t the drive. Drive Errrs Detected Lists the number f drive errrs. Drive errrs ccur when a hard drive is failing and WipeDrive is unable t read/write t the drive. HPA Fund States if a HPA was fund HPA remved States if a HPA was remved Secure Erase Passes Lists the number f Secure Erase passes that ccurred Addendum 5 MD5 Hash T verify the validity and add t the security f files dwnladed frm WhiteCanyn, we have created MD5 Hash cdes which will enable yu t crss-check the dwnlads t ensure they are the legitimate, riginal files. Belw each file dwnlad, yu will see a link that says Shw MD5 Hash. Clicking n that link belw each file dwnlad will display the custm MD5 hash cde fr that file. T crss-check ur file with the MD5 hash, yu will need t use a third-party sftware fr verificatin. One such prgram is WinMD5Free fund at http://www.winmd5.cm/ After dwnlading the utility and extracting the zip file, run the executable. 47
WipeDrive Enterprise Versin 8, March 31, 2017 It will display a screen like shwn belw: Simply drag and drp r brwse t the file yu are checking. It will autmatically scan the file and display the current file MD5 checksum value in the space prvided. Next, cpy the MD5 checksum value frm ur dwnlads page in the bttm bx, then click verify. Yu will get the fllwing message: This message indicates that there is a match, and the file yu dwnladed was frm the riginal surce. 48
WipeDrive Enterprise Versin 8, March 31, 2017 Addendum 6 Optins: Wiping Tab Number f Cnfirmatins: Set the number f times the user shuld be prmpted t cnfirm a wipe peratin prir t starting Allw Secure Erase: If the hard drive being wiped supprts Secure Erase we will use that functin as a replacement fr all zer pass verwrites (this includes zer passes in multiple verwrites, such as the DOD 5220.22-M). T disable that functinality, uncheck this ptin. NOTE: if the wipe pattern specifies secure erase in the pattern this flag is ignred Allw TRIM: If a hard drive/ssd supprts the TRIM cmmand WipeDrive will use it during part f the cleaning prcess. T disable this functinality, uncheck this bx. If yu need t be able t verify a wipe after the fact yu may need t disable this ptin s the last pattern put n the device remains. Run shrt SMART self-test: Run a captive shrt SMART self-test befre beginning wipe, and fail if any self-test has failed. Fail drive n SMART failure: By default, WipeDrive will attempt t erase drives that are cnsidered "bad" based n their SMART verall health status. If the cmpany plicy is t physically destry bad drives, it's a cnsiderable speed imprvement t fail the drives immediately. Disable cancel during peratin: Prevents the user frm cancelling a wipe peratin nce it has started. Stp verificatin if dirty sectr fund: By default, WipeDrive will cntinue attempting t erase drives even if dirty r bad sectrs are fund. If yur cmpany plicies are t physically destry bad drives, it's a cnsiderable speed imprvement t fail thse drives immediately. Use Write Same: Enable use f hard drive cmmand write same. If yur setup is bandwidth limited this may help speed up wiping. Nt all drives supprt this feature r implement it crrectly. Use Slid Randm: Use a randm repeating character in place f a randm pattern (this can help if wiping many drives at a time) 49