Notes: Secure Drive Wiping One-Liners

Personal reference notes; see dd and shred for the fuller writeups. This page is the condensed cheat-sheet version.

badblocks (surface scan + basic overwrite)¶

badblocks -c 10240 -wsvt random /dev/<drive>

-w is destructive (write-mode test), -s shows progress, -v verbose, -t random uses a random test pattern. If the drive was part of a RAID array, stop the array first:

mdadm --stop /dev/md0

dd — three levels¶

Reasonably secure (single zero-pass; defeats casual recovery, not forensic-lab recovery):

dd if=/dev/zero of=/dev/<drive> bs=1M status=progress

More secure (single random-data pass):

dd if=/dev/urandom of=/dev/<drive> bs=1M status=progress

DoD-style multi-pass (7 random-data passes — largely symbolic on modern drives; see note below):

for n in $(seq 7); do dd if=/dev/urandom of=/dev/<drive> bs=1M status=progress conv=notrunc; done

Check progress on an already-running dd without status=progress: kill -USR1 <pid> (from ps -ef | grep dd) prints current throughput to the terminal it's running in.

shred (single files)¶

shred file.txt              # overwrite in place, leaves the (now-garbage) file behind
shred -u file.txt           # overwrite and then delete it
shred -n 3 -z -u file.txt   # 3 random passes, final zero-pass, then delete

A note on modern drives¶

Multi-pass overwriting (the "DoD method") was designed against older MFM/RLL and early magnetic drive technology; NIST SP 800-88 and most current guidance treat a single full-drive overwrite as sufficient for modern magnetic media, and note that overwriting is not reliable at all on SSDs due to wear-leveling and over-provisioned flash blocks the OS can't address directly. For SSDs and NVMe drives, prefer blkdiscard (TRIM-based) or, better, the drive's own ATA Secure Erase / NVMe Format-with-secure-erase command — see storage and hdparm — or physical destruction for the highest-sensitivity cases. shred's own man page carries this same caveat about journaling filesystems, RAID, and SSDs: it cannot guarantee overwrite reaches every physical location the data was ever written to.