ディスクの完全消去/ヒントとテクニック
メインの記事はディスクの完全消去を見てください。
この記事では素早く消去することができる特殊なユーティリティを使用する消去方法について説明します。
目次
単体ファイルの消去
Wiping of a single file consists of two basic and one advanced anti-forensic time consumed method that can be done only with specialized tools, the last one method will not be covered in this article.
- 削除する前にランダムなデータで上書きしたり、同じサイズの別のファイルで内容を置き換える。
- 特殊なツールを使ってファイルシステムに保存されているファイルとメタデータを消去する。
- Search the whole disk for the deleted left-over parts of the file and wipe them too without making any changes to other files and their traces.
一般的な Linux ユーティリティを使うことでサイズを変更することなくファイルを上書きすることができます:
shred -x fileを実行すると file ファイルの中身が擬似乱数のデータに置き換わります。ファイルサイズは変わりません (-x)。-uオプションを使うと上書きした後に file が削除されます。
- With
mkfsyou can convert file into the filesystem that will alter everything in it, mount and fill in with any other content for a better overwriting.
- The
ddwill create a file with preset size and content of your chose, if destination file name exist then it will become overwritten. Withddcommand you can replace the whole file or only a part in it with another content by combiningskipandseekoptions. You need to know size of the file to avoid expand of the file, to do it can usedu -b file_name | cut -f1orstat -c "%s" file_name. It is mandatory to useiflag=fullblockoption to make it work correct with the file.
- Replace content in a file with a single symbol to avoid size changing you can do with perl utility.
メタデータを消去したい場合、パーティションをファイルで一杯にすることでファイルに関する古いエントリを新しいエントリでファイルシステムに置き換えさせることができます。あるいは特殊なユーティリティを使用する方法もあります。下の空き領域の消去セクションを見てください。
It is up to you how to combine all of Linux file creation and conversion tools to prevent recovery of files and/or mislead recovery tools and them who uses it by rewriting with random or replace with predefined content.
例:
ファイルの中身を全て . に置き換える Perl コマンド:
$ perl -p -i -e 's\[^*]\.\g' file_name
dd:
$ source_content | dd bs=size_in_bytes count=1 iflag=fullblock of=destination_file seek=0
Or by using stdout redirection that works a slightly faster for creation but you will not be able to use seek option for skipping some parts in the destination:
$ source_content | dd bs=size_in_bytes count=1 iflag=fullblock > destination_file
参照:
- convert charset in text files
- Advanced Bash-Scripting Guide - describes more advanced ways about how to create files from a bash script
- sed alternatives - a perl example that works better than sed for replacing content in a file
対象の上書き
マウントされているパーティションを消去しない
注意して消去するデバイスを選択してください。間違えるとシステムを破損してしまう恐れがあります。危険を避けるために、消去ツールをラッピングするスクリプトを使うことができます。例:
if [[ -e "$1" && -b "$1" ]];then
NOT_safe="$(lsblk -o "NAME,MOUNTPOINT" ${1//[0-9]/} | grep -e / -e '\]')";
if [[ -z "$NOT_safe" ]];then
# Here you can use any of your favourite wiping tools
# to wipe destination passed on command line and stored in variable "$1"
#
else
echo 'Not allowed to destroy if any of the partitions is mounted: '"$NOT_safe"
fi
fi
dd - 高度な例
以下のコマンドは OpenSSL によるランダムなシードの AES 暗号を使ってドライブやパーティションをランダム化します (pv で進捗メーターが表示されます):
# openssl enc -aes-256-ctr -pass pass:"$(dd if=/dev/urandom bs=128 count=1 2>/dev/null | base64)" -nosalt </dev/zero \
| pv -bartpes <DISK_SIZE> | dd bs=64K of=/dev/sd"X"
where the (optional) total disk size in bytes (DISK_SIZE) may be obtained via:
# blockdev --getsize64 /dev/sd"X"
250059350016
The command above creates a 128 byte encryption key seeded from /dev/urandom. AES-256 in CTR mode is used to encrypt /dev/zero's output with the urandom key. Utilizing the cipher instead of a pseudorandom source results in very high write speeds and the result is a device filled with AES ciphertext.
The block size is set to 64K above as it is usually faster than the default 512 bytes, and yields nearly optimal transfer rates across a range of hardware: [1] and the references therein.
Dm-crypt/ドライブの準備#dm-crypt で空のディスクまたはパーティションを消去に同じような方法が載っています。
テンプレートファイルを使う
Instead of zeros you can use a bunch of files you want to be found or partition prints made by mkfs formatted files but you should mount and fill it up with content or with any other repeated output from utilities of your choice.
One way is to wipe until device ends, but this type of redirection is not recommended because you have to use stop keys to break the while loop when errors about device end will show up:
$ while [ 1 -lt 2 ];do cat file1-to-use.as-template file2-to-use.as-template /tmp/templatefiles/* ;done > /dev/sd"XY"
With dd you can safely wipe repetitively without out-of-space-errors, if size to be wiped is set up correctly with options. By using dd inside the while loop for stdout you will be able to chose which part of the file you want to restore by combining the skip and seek options with random or fixed values e.g. restore only partition start or end from a file, related are head(1) and tail(1) commands for output of the file parts to stdout.
while [ 2 -gt 1 ]; do if [ -z "$(pidof dd)" ];then break ; fi; cat file1-to-use.as-template file2-to-use.as-template /tmp/templatefiles/* ; done | dd of=/dev/sd"XY" seek=start_sector bs=sector_size count=sectors_to_wipe
参照:
- sector size - file creation and sector sizes
空き領域の消去
空き領域は複数の方法で消去できます:
- パーティションやデバイスではなくファイルに出力をリダイレクト。
- Create multiple file copies by using e.g.
cpcommand in loops with random file names or destination directories until no free space will be left.
- Use an utility that creates encrypted files with random password and file names.
- Use a specialized program for the free space wiping such as wipefreespaceAUR.
Some of the file compression utilities use to have many types of the compression methods, file types and can even split file into volumes of the preset size upon creation. By using all options at random and into the loop you will be able to fill the whole free space up with a useless encrypted data that will overwrite everything else that was deleted. Just do not forget to remove created files and run it many times to ensure that even forensic specialists will get harder to restore very sensitive data on it.
7zip
Password="$(dd if=/dev/urandom bs=128 count=1)"
DestinationFile="$((${RANDOM/0/1}$(date "+%s")/${RANDOM/0/1}))"
7z a -t7z -mhe=on -p"${Password}" -mx=0 -v1m ${DestinationFile} source
使用しているオプションの説明は 7z(1) を参照してください。
The source can be a predefined file with random data or a device, e.g. /dev/urandom or another block device or partition on it, e.g. /dev/sd"XY", with data you are not afraid to be found then even deleted files on it will be compressed to the destination.
timeout コマンドを利用して複数のファイルを作成
The timeout command with randomized waiting time used it in a loop will break the command that will leave a file with random size. This is a slow method but is one of the possible alternatives. You can also use an array with predefined file names before the random part of it.
AA=${RANDOM/0/1};
timeout $((AA/100)) cat /dev/urandom > filename${RANDOM}.tmp;
参照:
- limits for the file creation on the different file systems.
- meta-data in the filesystem may keep information about file after it was deleted.
- forensic software uses meta-data to recovery and what need to do for wiping of the meta-data.