PDWIPE (Physical Drive WIPE) is a standalone utility to wipe (zero) an entire physical hard drive. PDWIPE is based on the wiping technology found in DRIVESPY. PDWIPE is capable of wiping large hard drives (in excess of 8.4Gb) at amazing speeds! Testing has demonstrated the complete wipe of an 8.4 Gb hard drive in just under 11 minutes!
If requested, PDWIPE will perform a declassification drive wipe in accordance with NAVSO P5239-10. This wiping algorithm exceeds that specified by the DOD 5220.22-M specification for both "clearing" and "purging" of sensitive information on Hard Drives.
PDWIPE provides the option of using a character other than 0x00 when wiping a drive. It also offers the ability to wipe the drive using a random pattern. PDWIPE will optionally record Logical Sector Addresses, and CHS addresses for both Int13 and Int13x geometries at the beginning of sectors as they are wiped. The latter is useful when diagnosing architectural discrepancies when moving a drive between systems or validating imaging utilities.
PDWIPE can be used to systematically process EVERY disk drive in a system such that ALL drives can be wiped from a single program operation. If desired, PDWIPE will generate a report of the wiping activity performed on a system. PDWIPE can also verify that the contents of a specified number of randomly chosen sectors have been wiped. If a wipe verification is requested, PDWIPE will also automatically verify the first and last sector on the drive.
PDWIPE will support any drive which is accessible to your system via Interrupt 13 or the MS/IBM Interrupt 13 Extensions. System BIOS's typically provide this capability for all attached IDE or EIDE devices. In addition, most SCSI adapters offer the ability to support attached devices via Interrupt 13 as well.
Normally, PDWIPE will request confirmation of any operation before the wiping process is initiated. However, command line options have been provided such that the program may be run from within a batch file (without confirmation) to wipe large numbers of hard drives prior to organizational redistribution. This makes it possible to create a simple boot floppy which calls PDWIPE with the appropriate options and then provide it to your technical staff to automatically wipe sensitive data from machines prior to redistribution.
PDWIPE MANUAL
Features
PDWIPE (Physical Drive WIPE) is a utility designed to wipe (eradicate with zero’s) data on physical hard drives. PDWIPE is based on the wiping technology found in the forensic utility DRIVESPY. PDWIPE is capable of wiping large hard drives (in excess of 8.4Gb) at amazing speeds! Testing has demonstrated the complete wipe of an 8.4 Gb hard drive in just under 11 minutes!
PDWIPE will support any drive accessible to your system via Interrupt 13 or the MS/IBM Interrupt 13 Extensions. System BIOS's typically provide this capability for all attached IDE or EIDE devices. In addition, most SCSI adapters offer the ability to support attached devices via Interrupt 13 as well.
Normally, PDWIPE will request confirmation of any operation before the wiping process is initiated. However, command line options have been provided such that the program may be run from within a batch file (without confirmation) to wipe large numbers of hard drives prior to organizational redistribution. This makes it possible to create a simple boot floppy that calls PDWIPE with the appropriate options and then provide it to your technical staff to automatically wipe sensitive data from machines prior to redistribution.
Usage
PDWIPE has three basic modes of operation:
Command Line Interactive: If PDWIPE is executed with no command line arguments it will prompt the user to supply the zero-based number of the physical drive to be wiped as well as the settings for the optional parameters (below). PDWIPE will then display the physical characteristics of the target drive and prompt for confirmation. Once the user provides confirmation, the associated drive will be completely wiped.
Command Line Confirmation: If the zero-based drive number of the physical drive to be wiped is provided on the command line, PDWIPE will display the physical characteristics of the target drive and prompt for confirmation. Once the user provides confirmation, the associated drive will be completely wiped. For example, the command:
PDWIPE 0
Would wipe physical drive zero after displaying the physical architecture of the drive and prompting the user for confirmation.
Batch File Operation: If the user specifies both the zero-based physical drive number on the command line as well as the “/Q” switch (Quiet Mode), PDWIPE will operate immediately without prompting for confirmation. For example, the command:
PDWIPE 0 /Q
Would wipe physical drive zero without prompting for confirmation. This mode was developed specifically to automate the wiping process in the corporate environment. This feature provides the ability to create a floppy that can be used to automate the wiping process simply by using it to boot one or more machines.
Optional Parameters
/C:[val] Normally, PDWIPE will overwrite the physical drive with all zero’s. You may also identify a specific character to be used during the wipe process by using the “/C” switch. The character may be specified using its decimal or hexadecimal value (i.e. “/C:0x1B” or “/C:27”)
/RAND If you would like to overwrite with a pseudo-random pattern, specify the “/RAND” switch. In the interest of speed, the “/RAND” switch will fill the work buffers with random characters and then the work buffers will be used repeatedly to wipe the drive.
/SA The “/SA” switch may be used to record address information into each sector as it is wiped. If this switch is used, the Absolute Logical Sector Address, as well as Cylinder, Head, and Sector address values for both the Int13 and Int13X geometries will be recorded at the beginning of each sector. Recording this address information on a drive can be useful in diagnosing architectural discrepancies when moving a drive between systems or validating imaging utilities.
/DOD The “/DOD” switch directs PDWIPE to perform a declassification drive wipe in accordance with NAVSO P5239-10. This wiping algorithm exceeds that specified by the DOD 5220.22-M specification for both “clearing” and “purging” of sensitive information on Hard Drives. Utilization of this option is very time consuming as it performs a seven pass wipe followed by a single pass verify.
/ALL The “/ALL” switch can be used to direct the program to systematically process each disk drive in a system such that all drives can be wiped from a single program operation. PDWIPE will simply walk the list of drives in the system (starting at Drive “0” and incrementing) until no more drives are found in the system.
/REPORT The “/REPORT” switch can be used to generate a report of the wiping activity performed on a system. Simply specify the filename as part of the “/REPORT” switch as follows “/REPORT:filename”.
/VERIFY The “/VERIFY” switch can be used to verify that the contents of a specified number of randomly chosen sectors have been wiped. Simply specify the number of randomly chosen sectors to check as follows: “/VERIFY:number”. For example, to randomly check 100 sectors on the disk specify “/VERIFY:100”. It should also be noted that if the “/VERIFY” switch is used the first and last sector on the drive will always be checked to ensure the process successfully reached both ends of the drive. Due to the nature of the “/RAND”, “/DOD”, and “/SA” switches, the “/CHECK” switch will not be available if wiping with those options.
/NOINT13X The “/NOINT13X” parameter directs PDWIPE to use only standard Interrupt 13 access mechanisms (CHS) even if the target machine reports that the Interrupt 13 Extensions (LBA) are available. This switch may be useful when working with older equipment that does not fully, or properly, support the Interrupt 13 extensions. Drives up to 8.4 Gb in size may be effectively wiped without the use of the Interrupt 13 extensions. This switch should only be utilized if the target system is having trouble accessing respective hard drives when the utility is run normally.
/AUTO13X The “/AUTO13X” parameter directs PDWIPE to only use the Interrupt 13 Extensions if the target drive is larger than 8.4 GB. Drives up to 8.4 Gb in size may be effectively wiped without the use of the Interrupt 13 extensions. This switch should only be utilized if the target system is having trouble accessing respective hard drives when the utility is run normally. This option is useful if you are using the “/ALL” switch to process all the drives in a system, having problems with BIOS compatibility issues with smaller drives, and want to ensure that drives larger than 8.4 GB are accessed using the Interrupt 13 Extensions.
Initialization File
PDWIPE requires that the PDWIPE.INI initialization file be located in the same directory as the executable. PDWIPE.INI contains critical licensing and registration information which must be validated prior to the execution of PDWIPE. PDWIPE.INI contains registration information unique to the licensee and must not be distributed to other individuals or organizations.
Click Here for the PDWipe User Manual PDF
