Hacklog Volume 1 Anonymity: it security & Ethical Hacking Handbook

Figure 32: DBAN initial screen
You will find a list of the disks being used in your system, in this case it’s an
ATA  Disk  (although  used  in  a  Virtual  Machine,  it  will  be  fine  for  testing
purposes). On the bottom of the screen, you will find the keyboard shortcuts to
enable the different features (Figure 33).
Figure 33: keyboard shortcuts to navigate DBAN
Always  follow  this  caption  to  move  across  the  program.  Moving  upwards
and downwards, you can choose the partition to be formatted, then press the M
button to select a deletion method (one of the above algorithms). For our testing,
we will choose PRNG Stream selecting it and pressing Space.
The  PRNG  Stream  provides  the  Pseudo  Random  Number  Generator,  an
external  tool  that  only  generates  (pseudo)random  numbers.  Pressing  the  P  key
you  can  choose  between  the  two  algorithms  (each  one  will  include  a
description). The V key allows you to perform a verification and choose how to
run it: I recommend to leave it on Verify Last Pass so you can check the deletion
only  once  the  operation  is  done.  Verification  Off  will  disable  the  verification,
while  Verify  All  Passes  will  verify  at  the  end  of  each  passage  (making  the
process much longer). The R button allows you to specify the number of deletion
cycles. As we mentioned for the PRNG Stream method, in order to have a high
security  deletion,  we’ll  proceed  with  8  steps,  as  we  will  specify  within  the
program (Figure 34).

---

Figure 34: 8-step definition for PRNG Stream shredding
Now that you’re ready, go back to the program Home and click Space. Next
to your partition, you will see [wipe] (Figure 35).
Figure 35: disk wiping confirmation through DBAN
Now  you’re  ready  to  wipe  your  storage.  Press  F10  and  allow  the  deletion
process to end.
File Shredding and SSD – Everything you need to now
If  you  arrived  so  far,  I  guess  you  need  to  have  a  constantly  clean  storage,
always  ready  to  withstand  any  forensic  searching.  You  must  know  that  File
Shredding  methods  are  effective  for  mechanical  disks,  while  they  may  be
ineffective for SSDs.
The reason is that all the variables determining the success or the failure of a
File Shredding operation over a SDD are multiple: in mechanical disks, files are
seemingly  deleted,  but  still  keep  the  occupied  space  to  avoid  any  slowdown  in
the  deletion  process.  When  new  data  is  created,  mechanical  disks  rewrite  the
sectors  flagged  as  “deleted”.  In  SSDs,  when  files  are  deleted,  the  SSD  will
choose  whether  to  write  the  sector  or  not:  such  choice  is  taken  by  an  internal
controller,  which  can  be  controlled  through  a  module  known  as  TRIM
(
https://it.wikipedia.org/wiki/TRIM
),  that  flags  blank  sectors  and  let  the
operating systems reuse them at once. TRIM is enabled by default in the latest
versions  of  all  OSs  and  it  should  ensure  the  immediate  rewriting  of  the  newly
deleted sectors. SSD, then, have an internal logic that uses the TRIM to rewrite a

---

sector almost immediately, thus acting as a pseudo-shredder. Such consideration
also  suggests  that  1  deleting  iteration  (step)  is  enough  for  solid  state  disks.
However, the logic behind file shredding tools poorly fits into SSD architecture,
therefore the only real solution in this scope is the total and complete wipe of the
entire disk (not just a partition) using tools like DBAN and whatnot. Once again,
a single deleting step will suffice. As an alternate solution, you may encrypt the
file you wish to hide: doing this, the file is overwritten on itself. This way, the
old version should become illegible, still maintaining the accessibility to the file,
under a minor compromise. Naturally, you can apply this technique to the whole
disk (please see the disk encryption part).
7.9.1.3 Physical Drive Destruction
This  category  includes  all  the  techniques  you  can  use  to  completely  or
partially  destroy  a  physical  storage  device.  We  must  state  here  that  the
destruction  of  a  hard  disk  –  both  3.5”  and  2.5”  –  is  an  extremely  strenuous
operation. In mechanical hard disks, for example, you will take several minutes
to reach the magnetic media, and such operation ofter requires a huge amount of
effort and time. When it comes to the solid state drives (SSD), the operation may
be easier, however you should exactly know where to “drill” between the metal
place  and  the  surface  where  all  the  data  storing  media  reside,  avoiding  any
possible  risk.  As  you  can  imagine,  destroying  a  drive  must  be  a  quick  task,
something you should be able to perform in seconds. All the following methods
relate to a Hard Disks and require you to know how to disassemble the magnetic
media  (for  mechanical  units)  and  the  flash  memories,  looking  like  many
microSDs soldered over the circuit (for SSDs).
Mechanical Destruction
Applies to: SD units, CDs/DVDs, Mechanical HDDs, SSDs
I  cannot  recommend  using  maces,  tossing  or  whatever  comes  to  your  mind.
Without the proper tools, the disk may stay intact. Alternatively, you can use a
good  nail  gun  and  cripple  the  disk  with  holes:  quite  probably,  nails  will
irreversibly  damage  the  internal  parts;  plugging  the  drive,  however,  will  likely
cause a short circuit.
This  operation  can  be  useful  for  disassembling  the  internal  parts  of
mechanical disks and SSDs and disposing them elsewhere.
In the case of mechanical disks, you can use a robust tool like a smith hammer to

---

smash the disk to the point of bending it, causing its demagnetization.
For  CDs/DVDs,  just  use  some  sanding  paper;  after  a  couple  of  rubs,  the
surface mirror layer should go away like ash.
Demagnetization
Applies to: Mechanical HDDs, SSDs, USB memories, SD units, CDs/DVDs
The  Degausser  method  –  or  demagnetization  –  is  process  that  literally  fries
electronics, sending an electromagnetic pulse (Emp) to the device. You can find
some  professional-grade  tools  (Garner  seems  to  be  particularly  reliable)  or  you
can  build  one  at  home  (just  search  Create  a  Degausser  or  Degausser  DIY).
We’ve  also  successfully  verified  this  method  with  EPROM  memories  using  a
home-made  taser  made  with  an  anti-mosquito  racket  (you  can  find  many
tutorials online), however we cannot recommend you to perform this task unless
you  have  the  right  electronics  skills  (you  may  burn  the  entire  machine!);  such
method,  however,  is  inadvisable  with  mechanical  disks.  In  the  case  of  USB  or
SD storage, you can try with a microwave oven, although this is an incineration
job rather than demagnetization.
Incineration
Applies to: Mechanical HDDs, SSDs, USB memories, SD units, CDs/DVDs
A  word  of  warning  before  we  proceed:  besides  the  danger  of  setting  anything
ablaze,  such  practice  may  be  illegal  in  your  country,  because  disks  contain
metals  that  produce  extremely  dangerous  fumes!  Anyway,  you  need  to  reach
1115°C,  or  Curie’s  Temperature,  resulting  in  the  loss  of  some  ferromagnetic
properties of cobalt (found in some HDDs parts).
You can use:
•an  industrial  blast  furnace,  available  from  companies  in  the  iron  and  steel
industry
•an oxy-acetylene torch, for about 100 $, reaching 3000-3100°C
•other torches, but you should verify their iron melting (1500°C) capability
•termite  –  you  can  make  it  at  home,  but  it’s  extremely  dangerous,  since  it
reaches 2200°C

---

Sinking
Applies to: N/A
The mere “sinking” of a HDD in water won’t physically harm the device. Water
may  damage  the  logical  board  (the  set  of  controllers  and  components  that  are
soldered on the PCB), which is quite easy to replace, however.
The surface layer of mechanical HDDs magnetic disks is built with cobalt alloys
covering glass, aluminum and a ceramic substrate. In this case, water must reach
the  aluminum  in  order  to  cause  an  actual  oxidation  damage  to  the  disk.  If  the
disk is not powered and not writing, then, water alone cannot damage the inner