WipeDrive Enterprise Manual
Contents
1. Password The password for the user account provided above Once successfully connected to the database you will see the main UI appear that shows all of the logging operations that have been performed as well as their results You are able to view which logs are connected to which drives as well as which computer hardware was used when wiping said drive LE WipeDrive Enterprise Audit C WineDrive ENTERPRISE AUDIT DATABASE Start Time Success Errors Dirty Sectors Disk 8 26 2010 8 47 02 AM Standard Overwrite False 0 0 8 26 2010 8 49 54 AM Verify True jo 8 26 2010 8 51 15 AM Verify False 0 0 612012342989 15 02 GB Wipe 612012342989 15 02 GB Quick Verify 612012342989 15 02 GB Verify 8 26 2010 8 51 36 AM Verify False o Jo 612012342989 15 02 GB Quick Verify Start 8 51 AM Verify Pattern Verify Date 08 26 2010 End 8 51 AM Duration 00 00 09 Number of Passes 1 Number of Errors 0 Number of Dirty Sectors 0 HPA Present False HPA Removed False Secure Erase Passes 0 Custom Computer Id e WHITE CANYON S OFTWARE www whitecanyon com enterprise contact us 801 224 8900 38 WipeDrive 7 0 User Manual Oct 2012 Addendum 2 Wipe Process TUI Text User Interface Step 1 Insert WipeDrive into the CD ROM drive and restart the computer The computer will then display the booting options Please select WipeDrive text mode2. and press Enter S WIPEDRIVE 7 a Step 2 WipeDrive will now load Step 3 The WipeDrive TUI Main Menu will now appear If you wish to change the log format or destination please type 6 WipeDrive by default logs to a removable USB Drive in a txt format For more details on logging please see Addendum 2 Logging Options Step 4 At the WipeDrive TUI Menu please key down to whichever option corresponds to the drive you would like to securely erase and press Spacebar to select Press Enter to continue S OFTWARE t WHITE CANYON www whitecanyon com enterprise contact us 801 22 WipeDrive 7 0 User Manual Oct 2012 Step 5 The overwrite pattern can be changed on thisscreen Key to the method you wish to use to erase the hard drive and press Spacebar to select WhiteCanyon recommends either the Standard Overwrite or the DoD 5220 22 M Overwrite Pattern Please see page 32 for more details on wipe patterns Press Enter to continue Step 6 WipeDrive will warn that this process is irreversible Press Enter to continue Step 7 WipeDrive will now begin wiping the hard drive Warning If you cancel the wipe before completion there may still be recoverable data left on the drive Step 8 When the process is completed WipeDrive will display the Wiping Results screen and save the log file if applicable Press Enter to return to TUI Menu S OFTWARE
3. ay 4 ad WipeDrive Enterprise User Guide Software Version 7 0 October 2012 WHITE CANYON EN TE RR RK LS E WipeDrive 7 0 User Manual Oct 2012 Table of Contents IMPORTANT PLEASE READ CAREEULLW sees se oge Bee ie ee Go ee oe ki Oe Ge ed ek ee oe ee es ge 4 General NOUN AU OM EE 4 YVIDE DIVE e del EE 4 8 EES RA IE RE H ssc ee 4 KA Fe F eege 5 EI ee ge EC KR GE 5 CUTE ES ge ee EE 5 Byes re Ueto ar AE EE 5 RUNING WipeDrive nde NEE 6 Wiping remote computers via WipeDrive ESE sss sese ee eee 7 8 ER RE RE EE O EE 7 Required for Remote Desktop Connection eee e eee ee eee eee 7 Remote Desktop Connection Walkthrough sss sees e eee ee eee eee eee 8 Wipe eDrive Boot Via CD EE 13 ENEE 13 System Requirements see eee eee eee eee eee eee 12 OE sad EE ORE EE OO EE N EE EO EE OE ET EE EE 13 Wipe Process Viod E AT EO EE N EO N RR N N nee 14 Baier Etes AE N EI nn GE ee Ge ENE Ee Ee ee Ee ee 16 WipeDrive Boot Via EXE EE 19 SCD ABIE cT EE 20 Wipe Process Via E 21 WVIDEDIIVE Bool Via E Esp EEEE A RAN ES 23 ENEE 23 BY SCOT RC EFF IG inl EE EE OE Bag oi OE T EE N ET KO 23 Case BI EL EE N EE OE RE TR OE ME OO EO ER DE 23 WIDE POCE S Via EE aa EG E ee Oe ee GR ae Re Be eer ee ee ee Ee EG Ge 24 EE 27 Wade dii ok io OE RE N REKE EE EE HOE EE 28 SEIT ra el FUS OPIO EE EE N 28 Extensible Markup Language XML Log File Option 29 Comma Delimited ES Log File OPLIG EE OE ee AE EE Ee GE Ed ER RE MERE ER AE ED te 31 PDF tos FIC TIO
4. 801 224 8900 S OFTWARE 31 WipeDrive 7 0 User Manual Oct 2012 o Number of USB ports o Number of USB2 ports o Hardware Test Results o Motherboard Test o Processor Test o Memory Test o Display Test o Keyboard Test e Computer Information o Computer Vendor o Computer Model o Computer Serial e Hard Drive Security Features o HPA Detected o HPA Removed o DCO Detected o DCO Removed o Secure Erase Passes o Secure Erase Enhanced Passes o User Number o Username eS d t WHITE CANYON www whitecanyon com enterprise contact us 801 224 8900 S OFTWARE 32 WipeDrive 7 0 User Manual Oct 2012 PDF Log File Option WipeDrive includes the option to log a report in PDF format which can be saved to any destination option This report includes the following details e Hardware Information o Computer Vendor o Computer Model o Computer Serial o Motherboard Vendor o Motherboard Model o Processor o RAM o NIC o Which includes Vendor and Mac Address o DVD Writer o Drivel s o Which includes Vendor Product Serial and Size o Display Adapter o Multimedia Adapter o USB Ports e Hardware Tests Pass Fail o Motherboard o Processor o Memory e Wipe Information o Software Version o Target Drive o Wipe Method o Action Result o Time o Duration ee WHITE CANYON www whitecanyon com enterprise contact us 801 224 8900 S OFTWARE 33 WipeDrive 7 0 User Manual Oct 2012 o Vendor o Drive Model o
5. etc Details such as the drive size serial number and manufacturer will be displayed in the drive selection menu to help identify individual drives e While wiping a hard drive on a laptop it is recommended that it remain plugged in to a power source as the wiping process can take an extended amount of time Factors such as hard drive size and wiping methods determine this amount of time WipeDrive Enterprise OVERVIEW When a Windows or Linux system saves a file it does two things it creates an entry for the file in the Master File Table which functions as a sort of table of contents for the drive and it saves the file data itself onto sectors of the hard drive If a file is deleted using the Recycle Bin the file is not actually deleted The file s entry in the Master File Table is deleted but the data itself still remains intact on the hard drive while the space that it occupies is marked for use letting the system know that the space is available for new files to be written to Unless new data is written to the space held by the deleted file the original file still exists on the drive in its original state Any number of file recovery programs can easily look through the drive and find remnants of the file s entry in the Master File Table and put the file back together making it as if it was never deleted in the first place The only way to truly delete a file is to overwrite it with other information The primary purpo
6. se L N n www whitecanyon com enterprise WipeDrive 7 0 User Manual Oct 2012 Addendum 3 Command Line Parameters Apart from both the TUI and GUI WipeDrive can be run from the command line using the following optional parameters below In order to access the command line simply press ESC anytime within the TUI When at the command prompt typing wipedrive with no parameters will start the standard TUI driven WipeDrive program Command Line Usage Example setup wipedrive wipe level 1 disk 0 log directory removable log file types x This particular command tells WipeDrive to perform a Standard Overwrite on the first hard drive and to record an XML log to an attached USB drive Here is a list of each wipe method and its corresponding character Wipe Level Name List 1 Single Overwrite RECOMMENDED Recommended for most security needs Note Overwriting data once will make it impossible for anyone to recover your data using any software program 2 DoD 5220 22 M 3 Pass 3 DoD 5220 22 M 7 Pass 4 HMG IS5 Baseline 5 HMG IS5 Enhanced 6 Canadian OPS I 7 US Army AR380 19 8 US Air Force 5020 9 German VSITR a NAVSO P 5239 26 b NCSC TG 025 c Russian GOST P50739 95 d Australian ASCI 33 XO PD e Australian ASCI 33 X1 P PD f Canadian CSEC ITSG 06 g Air Force 8580 Z Custom Overwrite pattern t WHITE CANYON www whitecanyon com enterprise contact us 8
7. 29 11 0d c2 Drive 1 Product VMware Virtual S Serial None found Size 42 95 GB Display Adapter Vendor Unavailable Product Unavailable Multimedia Adapter Vendor Unavailable Product Unavailable USB Ports 4 USB2 Ports 0 Hardware Tests Motherboard Pass Processor Pass Memory Pass Display Pass Keyboard Pass Wipe Information Target Drive 1 Manufacturer None found Drive Model VMware Virtual S Drive Serial None found Drive Size 42 95 Time Friday 24 Sep 2010 at 13 17 19 Action Result Canceled User name N A Computer ID N A Custom field N A Duration 00 00 37 Wipe Method Standard Overwrite Dirty Sectors 0 Drive Errors Detected 0 HPA found No HPA removed No Secure Erase Passses 0 Note Our hardware tests only test basic functionality For a more thorough check you will need to use specialized testing software The XML log file contains the following information if applicable 1 Hardware Information o Computer Vendor o Computer Model o Computer Serial Number o Motherboard Vendor o Motherboard Model o Processor o RAM o NIC e WHITE CANYON S OFTWARE www whitecanyon com enterprise contact us 801 224 8900 WipeDrive 7 0 User Manual Oct 2012 o Hard Drive o Display Adapter o Multimedia Adapter o Number of USB ports o Number of USB2 ports 2 Hardware Tests o Motherboard o Processor o Memory o Display o Keyboard 3 Wipe Information o Number
8. Client machine If running more than 20 Clients WipeDrive will start on the 21st Client as soon as the first wipe completes ES l d t WHITE GANYON www whitecanyon com enterprise contact us 801 224 8900 S O F T W A R E i 22 WipeDrive 7 0 User Manual Oct 2012 WipeDrive Boot Via EXE OVERVIEW Running WipeDrive via EXE is normally a good choice when then number of computers to be wiped is large and the systems are spread out over multiple locations The EXE build is a scripted build of WipeDrive that can be run over a network on any x86 system to which you have administrative rights The system will wipe remotely and send a log file for confirmation when the process is complete SYSTEM REQUIREMENTS e Computer running Windows 98 NT 2000 2003 XP Vista and 7 e 256 MB Free Hard Drive Space e 128 MB RAM SETUP DIAGRAM Administrator system WipeDrive Executable Application Client Computers OO Hard amp Drives A d WHITE CANYON www whitecanyon com enterprise contact us 801 224 8900 SOFTWARE 23 WipeDrive 7 0 User Manual Oct 2012 Wipe Process Via EXE Step 1 Place WipeDrive on to the Client s desktop Please double click and run WipeDrive Step 2 Windows will now ask if you would like to run this program Please select Yes Step 3 WipeDrive may ask for an activation code please entered the provided code given you once the purchase was made Most Enterprise licenses wi
9. Computer ID The user will be prompted to enter a username prior to the wiping process Custom Fields A user can add up to 10 custom log fields Each field can be selected to prompt the User either before or after the wiping process to enter a value or enter the default value at this screen eS d t WHITE CANYON www whitecanyon com enterprise contact us 801 224 8900 S OFTWARE l WipeDrive 7 0 User Manual Oct 2012 WipeDrive Boot Via PXE Overview Running WipeDrive via PXE is normally a good choice when then number of computers to be wiped is large Because the server controls the process it is not necessary to attach monitors mice or keyboards to workstations The progress for each individual system is displayed on the server the only requirement is that the boot priority for the system be set to Network Boot Although there is not a cap on the number of systems that can be run at once we recommend doing no more than 100 simultaneously on each server System Requirements Computer designated to be the server will not be wiped with at least the following hardware e Pentium lll class processor or better e 1GBRAM e CD ROM drive e Network card One or more machines referred to as the clients with at least the following hardware e Pentium class processor or better e 64MB RAM e Network card e Network switches and cabling to configure all of the machines server and clients to be in the
10. Drive Serial o Drive Size o Dirty Sectors o Drive Errors Detected o DCO Found o DCO Removed o HPA Found o HPA Removed o Secure Erase Passes ee d t WHITE GANYON www whitecanyon com enterprise contact us 801 224 8900 S O F T W A R E 34 WipeDrive 7 0 User Manual Oct 2012 Audit Log Destination Options USB DRIVE OPTION Any log file type can be sent to a USB drive connected to the wipe machine Please Note The USB drive must be formatted and connected prior to booting into WipeDrive LOCAL FILE SYSTEM OPTION WipeDrive Enterprise will write any of the log file types to a local location on the current machine This option requires the user to designate the file system location within the Linux kernal NETWORK FILE SYSTEM OPTION WipeDrive Enterprise will write any of the log file types to a location on the local network This log option requires a network connection for the PC and permission to access the designated folder It also needs the following information 1 Protocol Samba rsync SSH FTP 2 Server Name 3 User Name 4 Password 5 Path Email Option WipeDrive Enterprise will send any of the log file types to a specific email address This log location requires the following information 1 Server Name 2 From 3 To 4 CC 5 SMTP Username 6 SMPT Password d t WHITE CANYON www whitecanyon com enterprise contact us 801 224 8900 SOFTWARE 35 WipeDrive 7 0 User Manual Oct 2012
11. EXE see page 22 Normally the best method when many computers are on the same network This option allows systems to be wiped remotely Computers t WHITE CANYON www whitecanyon com enterprise contact us 801 224 8900 S OFTWARE 6 WipeDrive 7 0 User Manual Oct 2012 Wiping remote computers via WipeDrive EXE OVERVIEW This method is best if wanting to securely wipe a computer not readily accessible Using the WipeDrive application you can wipe computer remotely one of two ways through Remote Desktop Connection or through PsExec This walkthrough will cover both Before proceeding with this option please note the required criteria necessary for this to work REQUIRED FOR REMOTE DESKTOP CONNECTION e Computer Name e User e User Password a password MUST exist Microsoft provides a thorough FAQ sheet about using this program at the following location http windows microsoft com en US windows vista Remote Desktop Connection frequently asked questions Required for PSExec e PsExec http technet microsoft com en us sysinternals bb897553 aspx e Grant permissions through Regedit See PSExec setup page 10 e Computer Name e User e User Password a password MUST exist t WHITE CANYON www whitecanyon com enterprise contact us 801 224 8900 S OFTWARE 7 WipeDrive 7 0 User Manual Oct 2012 REMOTE DESKTOP CONNECTION WALKTHROUGH Before using this option make sure the client computer either alre
12. MySQL MS SQL Audit Logging Option WipeDrive Enterprise introduces support for logging audit information to a SQL database This will allow aggregation of all log details into a single database with reporting and query tools The SQL database viewing utility herein known as the Audit Tool is used to view the audit logs created by WipeDrive when used in conjunction with a SQL database The tool is very simple to use and provides an easy interface for management to use for audit purposes System Requirements w Sign In Query Tool ioj xj e Windows XP Vista 7 32 64 bit compatible DE Type MySQL D e NET Framework 3 5 Host localhost To connect to the database you will need to provide the following Database details test Username 1 Host The IP address or DNS hostname of the server hosting test the database 2 Database The name of the WipeDrive database Cancel 3 Username The user account with credentials allowing it to view the WipeDrive database 4 Password The password for the user account provided above Once successfully connected to the database you will see the main UI appear that shows all of the logging operations that have been performed as well as their results You are able to view which logs are connected to which drives as well as which computer hardware was used when wiping said drive TE Weier egen Audit Databas hree IUA ae WipeDrive ones lis ENTERPRISE AUDIT DATABASE
13. OS Austraian CSD CD DD US Army ARSE 1E Secureirase 1 1 HESA HAP 14 1 C H N WIPEDRIVE 7 CAUTION All data is abouli io be pimaneniiy TETE from he seker bed drive s Step 6 WipeDrive will Compisicly and securely erase Ibe contents of thee hard drive s Sher bed Pras Cant Gecke if you do not wand in erase your hard dries Press chemi Decke io copy the euquived mes to your hand drive WipeDrive will now verify that you wish to securely overwrite the hard drive s Select Next to continue Step 7 N WIPEDRIVE 7 EN AT Required WipeDrive files are now being copied to your hard drive Before beginning the wiping process WipeDrive will first install the required files Step 8 H In order to overwrite the entire hard drive WipeDrive runs WIPEDRIVE 7 outside of Windows within a Linux kernel For this to happen the raecopyng nas completes computer must restart and boot into the WipeDrive program Press the Restart button bow 1o restart your computer and begin He wiping Click Restart to begin this process d t WHITE GANYON www whitecanyon com enterprise contact us 801 224 8900 S OFTWARE 25 WipeDrive 7 0 User Manual Oct 2012 Step 9 Once the computer restarts you will see a Boot Manager window Make sure to select WipeDrive Enterprise otherwise the computer will boot back into Windows Press Enter to continue Step 10 C WIPED RIVE 7 B N Wi
14. be inserted and booted on each system SYSTEM REQUIREMENTS e All versions of DOS Windows 3 x 9x NT 2000 XP Vista 7 OS 2 PC based e Linux Unix and Intel based Mac systems e Any type of hard drive IDE SCSI SATA SSD e CD ROM Drive e 64 MB RAM BIOS SETTINGS To run WipeDrive Enterprise via CD insert the disk into the computer and check that the BIOS is set to first boot from the CD drive To change the boot sequence access the BIOS of the computer during the initial start up of the system When the computer first turns on restarts a screen will flash with options to enter either Setup or Boot as well as a key to press for each corresponding option See table below for known BIOS keys based on system manufacturer The key must be pressed quickly otherwise the computer will continue with its usual booting routine BIOS Key Acer F1 F2 CTRL ALT ESC Compaq F10 Dell F2 DEL eMachine DEL F2 Gateway LE HP F1 F2 ESC IBM F1 Lenovo Fig E Apple Hold down Option Micron F1 F2 or DEL Sony F2 F3 Toshiba ESC F1 NOTE If your particular computer or manufacturer is not displayed the BIOS keys are normally either DEL or F2 eS e t WHITE CANYON www whitecanyon com enterprise contact us 801 224 8900 S OFTWARE 13 WipeDrive 7 0 User Manual Oct 2012 Wipe Process via CD Step 1 Insert WipeDrive into the CD ROM drive and restart the computer The computer will then
15. display the booting options Please select WipeDrive and press Enter L t WIPEDRIVE 7 ENT EMPRTSE D EE Step 2 E WIPEDRIVE 7 WipeDrive will now load the necessary drivers Step 3 The WipeDrive Main Menu will now appear If you wish to change the log format or destination please select Settings WipeDrive by default logs to a removable USB drive in a txt format For more details on logging please see Addendum 2 Logging Options Step 6 At the WipeDrive Main Menu please select WipeDrive s to securely erase your hard drive ee d t WHITE GANYON www whitecanyon com enterprise contact us 801 224 8900 S O0 F T W A R E 14 WipeDrive 7 0 User Manual Oct 2012 Step 7 C WIPED RIVE 7 WipeDrive will now display all attached hard drives Please select Ee the drives you wish to securely erase EE PL E Select an overarite pattern The overwrite pattern can be changed on this screen pee WhiteCanyon recommends either the Standard Overwrite or the DoD 5220 22 M Overwrite Pattern Please see page 32 for more details on wipe patterns Select Next to continue Step 8 C t WIPEDRIVE 7 WipeDrive will warn that this process is irreversible Select Wipe cunow 3 If sou Inter ro only wipe a fee filet or folders do HOT oie WipeDrive Iritaad to CO nti n U eC S visit weww whitecanyon com bo order Serurele sn If you proceed ALL data on the selected drive s will be dest
16. multiple methods in which a log file may be saved Please reference the following instructions on how to take advantage of these options All authentication data to external servers is sent in plain text WipeDrive should be used in a trusted internal network if protecting the authentication data to the third party servers is a priority Windows Share WIES 7 This feature allows the user to save the log file to a shared network of files The following information is required Ja Yon ont Pedro Lomein ae Se ke es te TL thes has Nn we rom rien iren fw Mer oy sw e Host e Username Hee over mest Demp aal e Password une Koes K OR e Domain e Path optional eS d t WHITE CANYON www whitecanyon com enterprise contact us 801 224 8900 S OFTWARE 16 WipeDrive 7 0 User Manual Oct 2012 FTP The FTP option allows the user to save the log file to an FTP server This requires the following information e Host e Username e Password e Path optional Removable By default WipeDrive will try to log to a removable USB drive In order to ensure the logging process is a success make sure a USB drive is plugged into the computer running WipeDrive Email WipeDrive also allows the user to send the log file to a specific email The user must enter the following information e Host e Username e Password e From sending email e To receiving email e CC e Subject Note T
17. se E 33 se t WHITE CANYON www whitecanyon com enterprise contact us 801 224 8900 S OFTWARE 3 WipeDrive 7 0 User Manual Oct 2012 Auat o Destination ee L e CN 35 n DVS OD e EE 35 Local File System ODEON E 35 Network File Systemi OD de EE 35 yn ES ed ep EE OE EE OE OE EE EE EE sauces 35 MySOLAMS SOL Audit Logging Opti EE OE EE 36 EERSTEN 37 SOL Database Viewer Audit Tool sis eene Es ERG ee Ee eg Ee Ee 37 Addendum 2 Wipe Process TUI Text User Interface 39 Addendum 3 Command Line Parametere 41 Wiping and Verifying sesse ses ER GE Ee Ge ee ge ee Ge eb Ge oe ee de og ee Ge 42 Ee ala 42 Ee eaha ie a E 42 Logging enn ae oe ee ER oe eo AR DE EO Be N ee ee ER ee ie ee RE N oe Ee Ge ge ER EE 43 Logging to SQL se 43 Addendum 4 Drive Verification EE 43 C WHITE CANYON www whitecanyon com enterprise contact us 801 224 8900 65 OF T WARE 3 WipeDrive 7 0 User Manual Oct 2012 IMPORTANT PLEASE READ CAREFULLY Thank you for choosing WipeDrive Enterprise Before running WipeDrive please make sure that any files folders and any other information you wish to preserve is backed up on another media device CD DVD EXT HD WipeDrive will securely delete all information on the hard drive s the information will NOT be recoverable by any means including forensic recovery tools General Information e WipeDrive Enterprise will not be able to access the drive s previously allocated drive letter c d
18. us 801 224 8900 S OFTWARE g WipeDrive 7 0 User Manual Oct 2012 Step 4 leda ene You may see this authentication required window appear This messe oi warning is just a precaution in the event you are logging into a Certificate name 6 Eal Name in the certificate from the remote computer malicious computer Wipedrive To access the remote computer click Yes to authorize a SE l The following errors were encountered while validating the remote connection computer s certificate A The cettificate is not from a trusted certifying authority Do you want to connect despite these certificate emors E Dont ask me again for connections to this computer Se Ge Step 5 After authorizing a connection your screen will change to the desktop of the client computer From here you can manipulate the computer and run the WipeDrive Wizard Navigate to the location of WipeDrive and launch the wizard See page 26 for a walkthrough on using the WipeDrive executable E 7 t WHITE CANYON www whitecanyon com enterprise contact us 801 224 8900 4 D O F T W A R E 9 WipeDrive 7 0 User Manual Oct 2012 Remote wiping via PsExec Walkthrough Before beginning this process understand the options for this method are limited at this time There are plans to increase the customizability of using PsExec but for now this program will run WipeDrive with the following settings Wipe ALL drive Wipe method Department of
19. 01 224 8900 S OFTWARE 41 WipeDrive 7 0 User Manual Oct 2012 Here is a list of Commonly used command parameters WIPING AND VERIFYING wipe level Sets the default wipe level and disables the option for the user to choose a wipe level through the interface Values 1 9 and a e disk Sets the selected disk to wipe Use 1 to wipe all drives do verify Performs a full verification pass LOGGING log directory Path where log files will be saved log file types Log file s format r regular d delimited x xml q sq username User value if no value is provided you will be prompted to enter one computer id Computer ID value if no value is provided you will be prompted to enter one custom field Custom field if no value is provided you will be prompted to enter one LOGGING TO FTP ftp server FTP server name ftp user FTP username ftp password FTP password ftp directory Directory on the FTP server where the log files Should be saved t WHITE CANYON www whitecanyon com enterprise contact us 801 224 8900 S OFTWARE 42 WipeDrive 7 0 User Manual Oct 2012 LOGGING TO EMAIL mail server Email server to use to email logs mail from Name of person email is from note root will be the sender mail to Email address of log s recipient mail cc Additional address to email logs Mail password Password of SMTP user only specify if required by email s
20. Defense 3 Pass There are a few things that must happen prior to using this software for your remote wiping needs e Download and extract PsExec from the following location http technet microsoft com en us sysinternals bb897553 aspx e Extract the files to a known location e PsExec needs permissions to access the client computer and make changes This will require that you edit the Regedit on the client computer e Access client computer and open Regedit e Navigate to the following location HKEY_LOCAL_MACHINE Software Microsoft Windows CurrentVersion Policies Sy stem e Once in this folder add the following by right clicking selecting New and then choosing DWORD 32 bit Value e Give it the name LocalAccountTokenFilterPolicy e Right click LocalAccountTokenFilterPolicy and select Modify to set the value to 1 Click OK e Close Regedit e Upload the WipeDrive wizard onto the client machine unless you plan to copy the file over from the host computer to the client using PsExec Once these steps are complete you can begin using PsExec the following walkthrough will demonstrate how to do this Step 1 Run the command prompt on the host machine Do this by clicking Start and typing cmd into the Search programs and files field then press Enter B CA Window pyrtemnd Perd ene Lei crosoft Windows lersion RN i CA 2007 Hi oF Corpor To run the program navigate to where the PsExec files ar
21. E gemet CB ger gree Ire mp d ZPO ed Er EE MIE Y to reg Cet Compete eg een ege oo gt e ker Woe MET Log pes and eben Cuchom Log Ten Donge Server Alerts Wipe Settings p feet Arer LRR Lise chei buna beaver oo Rd por DUE or cara Center EG EER Deg E de H st ic Bai RT lt C Hoe DEE ee T T EA Wa ra d er Feb Perd a wde Dik Ee ledir b L hruba oud be reet ba mior Er vak EC eters www whitecanyon com enterprise contact us 801 224 8900 21 WipeDrive 7 0 User Manual Oct 2012 Step 5 EKTERRAISE vre apra kA TERT au Wap d WIPEORIVE 7 Halia Li We Westen peg pa ad dit Krr Log Miskin Drais Se An The Dongle Server menu allows the user to select activation options These options include Cloud Account activation using an activation dongle on the PXE server and or using the activation dongle on the client machines Le WA Dee EER Ces Act Set La cet Lebe Lg aor dor eS Rare at Lhd dA a Next click the Alerts tab Step 6 C WIPEDRIVE 7 di La rie BHA Ea LES ey Pot AN Me Ae eS C 6 TOL LER dN tee Per en cos pou N i The Alerts menu allows the User to select alert methods for when coe ect enn te the wipe completes on the Client machines Click Accept to save the options Step 7 Restart each Client machine The Client machines will boot into WipeDrive over the Network and begin the wipe The Server will display the wipe progress on each
22. Lg red paa Computers Start Tone Patten Success roet Durty Sectere Dick Type Verify o SS Pottera Very 612012 LY Date 08 26 2010 Start 65 AM End amp 51 AM Duration 000009 Mes Dek t Number of Passes 1 Number of Errore Member of Dirty Sectors 0 MPA Present faite HPA Removed Folie Secure Erase Paws 7 Custom Computer id Total keme A t WHITE CANYON www whitecanyon com enterprise contact us 801 224 8900 S OFTWARE 36 WipeDrive 7 0 User Manual Oct 2012 Addendum 1 Setting Up SQL Logging System Requirements Server e MySQL Server 5 0 or newer e MS SQL Server 2008 or newer e Any operating system that supports a MySQL MS SQL installation System Requirements Workstation Client e Windows XP Vista or 7 e NET Framework 2 0 or newer Preparation Before the database can be initialized you will need to create a new blank database This step must be performed by hand For security purposes it is also highly recommended to create a new user who only has access to this database Please consult the MySQL MS SQL documentation or your systems administrator if you need assistance creating the database or new user Initialization Once the database has been created launch the WipeDrive Database Initializer A screenshot of the user interface EF WipeDrive Database Initializer LD x Initializes database to revision 11 Please fill in all provided fields 1 Database Name The name of the newly
23. ady has the WipeDrive executable program or has access to it via a download or network If you are unable to place the WipeDrive wizard from your location onto the client computer refer to the PsExec remote wiping option Step 1 K Remote Desktop Connection Remote Desktop The Remote Desktop Connection program is included in LY Connection the Windows program so no install is necessary It can be found under Start All Programs Accessories Running N aa computer fobsikam com the program will reveal the following window EE EER The computer name field is blank Enter a full remote computer name nd Step 2 K Remote Desktop Connection Next enter the Computer name of the machine you wish to access as well as the user Remote Desktop Connection If it doesn t ask for a user at this point just enter the Computer name and click Connect Computer Wipedrive Username None specified You will be asked for credentials when you connect Step 3 Options Once the program connects to the machine it will require you enter the login credentials Enter your credentials These credentials will be used to connect to Wipedrive This will not work if the computer you are attempting to access isn t password protected there must be a password Domain E Remember my credentials Once the User name and Password are entered click OK ee a WHITE CANYON www whitecanyon com enterprise contact
24. created database 2 Host The machine hosting the SQL database This can be either an IP address or a DNS hostname 3 Username The name of a SQL user that has sufficient privileges to create tables in the database you just created 4 Password The password for above username Click the Populate Database button to complete initialization of the database If there are any errors during the initialization process the program will display a message box with debugging information Once complete the server is configured for use with WipeDrive Enterprise SQL Database Viewer Audit Tool The SQL database viewing utility herein known as the Audit Tool is used to view the audit logs created by WipeDrive when used in conjunction with a SQL database The tool is very simple to use and provides an easy interface for management to use for audit purposes e t WHITE CANYON www whitecanyon com enterprise contact us 801 224 8900 S OFTWARE 37 WipeDrive 7 0 User Manual Oct 2012 System Requirements e Windows XP Vista 7 32 64 bit compatible e NET Framework 3 5 Basic Operation To connect to the database you will need to provide the following details Host The IP address or DNS hostname of the server hosting the SQL database Database The name of the WipeDrive database Username The user account with credentials allowing it to view the WipeDrive database E Ais DBType mysa H w Sign In Query Tool
25. ds for Wipe Type For now the only available WipeDrive option be passed through PsExec is the wipe type which is DoD If all parameters are valid and PsExec can find the location of WipeDrive the following screen will appear As you can see PsExec found the WipeDrive Wizard and began installing the necessary tools to remotely run the software At this point the client machine will reboot into WipeDrive and begin wiping ALL drives using the Department of Defense 3 Pass wipe method eS t WHITE CANYON www whitecanyon com enterprise contact us 801 224 8900 So E T WARE WipeDrive 7 0 User Manual Oct 2012 Part 2 Using PsExec to copy and run WipeDrive onto client computer e First place a copy of the WipeDrive wizard into the same folder where psexec exe is located This is critical in order for the program to find and copy the application e Here is a screen shot of how to properly setup the parameters in order to copy the WipeDrive wizard from the host machine to the client C Windows system32 cmd exe Co Users eptimnus Prime Downloads gt psexec Test u Test p Test h f c Wizard6 EXE remote cli wt dod Just as before here is an explanation of the parameters required to copy the WipeDrive application to the client computer and then run it e Psexec Run following parameters through PsExec e Test Name of client computer e u Username of account on client computer e pD Password of user account o
26. e located In this screen shot the PsExec files are downloaded and extracted within the Downloads folder Press Enter to start t WHITE CANYON www whitecanyon com enterprise contact us 601 224 8900 So E T WARE WipeDrive 7 0 User Manual Oct 2012 Step 2 This step is split into two parts running WipeDrive from the WipeDrive application already on the client computer and using PsExec to copy the WipeDrive executable to the client machine and then running it Part 1 Running WipeDrive from the executable already located on the client e This screen shot shows an example of how to use PsExec to run WipeDrive from an executable that already exists on the client EN CAWindows system32 cmd C Users Septimus Prime Downloads psexec Test u Test p Test h ci 5HWHizard exe al remote cli wt dod The following is an explanation of each command being passed to PsExec e Psexec runs the program e Test This is the name of the client machine e u Username of account on client computer e p Password of user account on client computer e h This command is required for clients running Windows Vista or higher e C Wizard exe This is the location of the WipeDrive executable In this example the program is located on the root of the C drive e remote Allows you to remotely start the program e cli must have so program knows to run in console form e wt dod WT stan
27. erver mail subject Subject for email LOGGING TO SQL DATABASE db host Hostname of machine serving the database db name Name of the WipeDrive logging database db username Database username db password Database password For a more complete list contact our support team Addendum 4 Drive Verification Drive verification is done as part of a specific wipe pattern i e DoD 5220 22 M or as a stand alone function When drive verification is performed the disk is checked to certify that the drive is in one of three States 1 The drive contains all binary O s 2 The drive contains all binary 1 s 3 The drive contains a repeated value i e all a s 4 The drive contains random data If the drive is in one of the three states the verification will pass if not the process will fail Note WipeDrive uses a random pattern where a random character is generated followed immediately by its bitwise compliment In this way it is possible to determine that the drive has been overwritten by random data by the WipeDrive program e t WHITE CANYON www whitecanyon com enterprise contact us 801 224 8900 S OFTWARE 43
28. he sending party will be labeled as root Custom Log Fields The Custom Log Fields tab under Settings allows the user to add additional information to the log file Information such as the Computer ID a Username as well as any other custom information the user wishes include in the file C WHITE CANYON S OFTWARE C WIPEDRIVE 7 Loy Tas esd Desire Gre Fesch Log Destination 5 Keen La Siet 16 jiha Ha by ia reg RAK TY Bei Ne pF Pe raii tine erre Baard Bek gl A t WIPEDRIVE 7 H EE EER Lop pos and Omar VEER Log Types tele Log Destination M tee wt fe renns the how me tere Lexa Mem et Log Destination Me w Ma tr eet e Dee tr sam p zo une ete Aerm Ce WiPEDgIVE leg pe ons Etek e Loy Metre Soe vm con chats up to ZZ Cutten g Bdot He LE pve Gach Agd Cutter nome ans vata or you geg Ara Ser www whitecanyon com enterprise contact us 801 224 8900 17 WipeDrive 7 0 User Manual Oct 2012 Computer ID C WIPEDRIVE 7 This feature allows the user to give the computer being wiped a KEE specific identification label WipeDrive will prompt the user to ack wier Ka rey Meats enter the Computer ID after the warning page prior to the SE EES EE EE E tm gee ae o hay wire der Car ad Be Dare t A initiation of the wiping process Username The username feature works the same way as the
29. ipeDrive uses the SecureErase command as part of its DoD approved wipe process to ensure the removal of remapped drive sectors DETAILED AUDIT LOGGING Documenting the secure data destruction process is requirement for most Government agencies companies involved in health care and the financial sector WipeDrive creates an audit log documenting every necessary detail to comply with all major regulations including DoD 5220 22 M HIPAA SOX and others e t WHITE CANYON www whitecanyon com enterprise contact us 801 224 8900 S OFTWARE 5 WipeDrive 7 0 User Manual Oct 2012 Running WipeDrive Enterprise Because organizations can be large or small centralized or with thousands of locations WipeDrive Enterprise has multiple implementation options Each option has its strengths all are available to you under your license agreement WipeDrive Enterprise can be implemented and run in three different ways For specific instructions and details please see the corresponding section The three options are Booting from the CD see page 3 Target System Normally the best method when wiping a small number of systems WipeDrive Designated Enterprise Server PXE Software N Via PXE network booting see page 15 Normally the best method when many computers are brought to a central location Network Switch Li A SD Client Computers Hard Drives Administrator System WipeDrive Executable Application Via
30. ites with single end verification e US AFSSI 8580 e German VSITR Seven overwrites e NAVSO P 5239 26 Three overwrites with verification e NCSC TG 025 Three overwrites with verification e Russian GOST P50739 95 One overwrite e Australian DSD ACSI 33 XO PD Three overwrites with two verifications e SecureErase 1 overwrite with verify or NNSA NAP 15 1 C e Custom Overwrite User defined overwrite pattern ee a WHITE CANYON www whitecanyon com enterprise contact us 801 224 8900 S OFTWARE 7 WipeDrive 7 0 User Manual Oct 2012 Log Format Types PLAIN TEXT LOG FILE OPTION WipeDrive by default uses a plain text file format which can be saved to any destination option A sample plain text log file is shown below WipeDrive PRO 6 0 gt gt Drive 1 Manufacturer None found Model VMware Virtual 5 Serial None found Size 42 95 GB Current user Computer ID custom Field Operation Overwrite disk Wipe Type Standard Overwrite Date amp time operation was started Friday 24 Sep 2010 at 12 44 41 Date amp time operation was completed Friday 24 Sep 2010 at 12 55 42 Total elapsed time HH MM SS 00 11 01 Operation result Canceled by user Total disk sector read write errors 0 Total dirty or unreadable disk sectors 0 HPA present No HPA removed No Secure Erase passes 0 The text file records the following 1 Drive information o MANUFACTURER o SERIAL NUMBER o DRIVE SIZE 2 Se
31. ll skip this step In order to move forward a valid activation code is required After the code is entered the Next button will activate Click Next to proceed to the next screen C WHITE CANYON S OFTWARE 7 x mm i WipeDrive i Enterprise Sei User Account Control Do you want to allow the following program to make changes to this computer dy Program name WipeDrive Wizard KS 4 Verified publisher WhiteCanyon Software Inc File origin Hard drive on this computer v Show details Change when these notifications appear WIPEDRIVE 7 Thank you for ehnasing WipeDrive Please enter pour activation code below and click lt et gt to begin WIPEDRIVE 7 Thank you for choosing WipeDrive Please enter pour activation code below and click lt e to begin www whitecanyon com enterprise contact us 801 224 8900 24 WipeDrive 7 0 User Manual Oct 2012 Step 4 S4 WIPEDRIVE 7 Click on the drop down list to select which drive to wipe There are only two options when selection hard drives to be wiped All Drives or a single individual drive After selecting a drive click Next to continue Step 5 C WIPEDRIVE 7 Bat th Py of we At the Wipe Selection menu select the required wipe and select 7 ad E Standard Overwrite recommended US Air Force 5020 7 U Dot 3220 22 M4 1 iere German VSTA Next R DM 2220 ZIM 3 were HSD Pusat IG 55 Daiei MESC TG 025 Canin
32. n client computer e bh This command is required for clients running Windows Vista or higher e f Replaces any previous copies of the application with one being uploaded e c Wizard exe The copy command followed by the file to be copied and ran on the client machine Only works if file is found in same location as PsExec e remote Allows you to remotely start the program e cli must have so program knows to run in console form e wt dod WT stands for Wipe Type For now the only available WipeDrive option be passed through PsExec is the wipe type which is DoD If all parameters are valid and PsExec GE Ls can find the location of WipeDrive the HHT H H 7 PsExec v1 98 Execute processes remotely following screen will appear Copyright lt C gt 2001 2010 Mark Russinovich Sus ysinternals www sysinternals com WipeDrive Wizard ei 5 ress displayed s displayed As you can see PsExec copied the WipeDrive Wizard and began installing the necessary tools to remotely run the software At this point the client machine will reboot into WipeDrive and being wiping ALL drives using the Department of Defense 3 Pass wipe method t WHITE CANYON www whitecanyon com enterprise contact us 801 224 8900 So E T WARE WipeDrive 7 0 User Manual Oct 2012 WipeDrive Boot Via CD OVERVIEW Running WipeDrive via CD is normally a good choice when then number of computers to be wiped are small as the CD must
33. of Target Drive o Manufacturer of Hard Drive o Drive Model o Drive Serial Number o Hard Drive Size o Time Operation Began o Result of Operation o Username Only applies if Username prompt is selected under Settings o Computer ID Only applies if Computer ID prompt is selected under Settings o Custom Field Only applied if custom fields are created under Settings o Duration o Wipe Method o Dirty Sectors o Drive Errors Detected o HPA Found o HPAremoved o Secure Erase Passes eS WW d t WHITE CANYON www whitecanyon com enterprise contact us 801 224 8900 S OFTWARE 30 WipeDrive 7 0 User Manual Oct 2012 Comma Delimited CSV Log File Option The purpose of the csv file is to allow logs created by WipeDrive Enterprise to be easily imported into a database or spreadsheet The following are details about the operation included in the comma delimited file e Hard Drive Information o Computer ID o Computer ID o Date amp Time o Drive Number o Drive Model o Drive Serial o Drive Size e Operation Results o Action Result o Action Duration o Action Start Time o Action End Time o Username o Action o Number of Wipes o Detected Drive Errors o Dirty Sectors e Hardware Information o Motherboard Vendor o Motherboard Product o CPU Will include all CPUs present o RAM o NIC o Optical Drive o Hard Drive s o Video Card o Multimedia Card t WHITE CANYON www whitecanyon com enterprise contact us
34. pe Progress At this point WipeDrive will immediately begin wiping the drive s selected during setup o a o sen i This screen will provide some useful information such as Time Remaining and if any disk errors are detected Step 11 C WIPEDRIVE 7 After WipeDrive finishes it will display a screen stating whether L or not the hard drive was successfully overwritten E Dreg eh ferial Hwg 646 hong found S ear Tea bag 02 07 o This concludes the WipeDrive process you can now click either Reboot to restart the computer and reinstall an operating system Or choose Shut Down to turn the computer off t WHITE CANYON www whitecanyon com enterprise contact us 801 224 8900 So E T W ARE 26 WipeDrive 7 0 User Manual Oct 2012 Overwrite Patterns WipeDrive Enterprise provides specific overwrite patterns in compliance with various government agencies The supported overwrite patterns are listed and described in detail below e Standard Single Pass One overwrite 0 s e DoD 5220 22 M Three overwrites with one verification O s 1 s Random e HMG IS5 Baseline One overwrite with verification 0 s e HMG IS5 Enhanced Three overwrites with verification O s 1 s Random e Canadian OPS Il Seven overwrites with verification e Canadian CSEC ITSG 06 Three overwrites with single end verification e US Army AR380 19 Three overwrites with single end verification e US AFSSI 5020 Three overwr
35. royed OTE DO KOT prer off your machine while wiping E in progress Dive w Hy Batter Sandeid gwerer 89 YW amr a ed Fire gl 5 1P B ete ege vuan gt Zeg Hoes thet Coni mai 1 of 1 We ai data ron sekerked drag Gms Er zx Step 9 C WIPEDRIVE 7 WipeDrive will now begin wiping the hard drive EES GE GS ES me 16 r rosa EE s Warning If you cancel the wipe before completion there may still be recoverable data left on the drive Step 10 When the process is completed WipeDrive will display the Wiping wana oa ras overwrite vecommenset Results screen and save the log file if applicable Click Reboot or Shut Down to exit WipeDrive ee d t WHITE GANYON www whitecanyon com enterprise contact us 801 224 8900 S OFTWARE 15 WipeDrive 7 0 User Manual Oct 2012 Configuration Settings Log Types S Ct WIPEDRIvE 7 WipeDrive offers a variety of different log type formats Within the Settings menu under the Log Types and Destinations tab simply select in which format s you would like the logs to be created Log Destination E See og imn je Irk bs kon Pa mee oe The Database format requires additional information in order to properly create the file iulian TER gt Err Serie K K These details include e Server Type MySQL or MS SQL e Host EE e Username ce e Password SS e Database credentials e Port Instance Log Destination For user convenience WipeDrive has
36. same network t WHITE CANYON www whitecanyon com enterprise contact us 801 224 8900 S OFTWARE 19 WipeDrive 7 0 User Manual Oct 2012 SETUP DIAGRAM WipeDrive Designated Enterprise Server PXE Software N Network Switch Client Computers Hard Des S 9 o d t WHITE CANYON www whitecanyon com enterprise contact us 801 224 8900 S OFTWARE 20 WipeDrive 7 0 User Manual Oct 2012 Wipe Process Via PXE Step 1 Insert the WipeDrive PXE CD into the CD ROM drive and restart the Server Please Note The Server must have at least 1 GB of RAM The computer will then display the WipeDrive Client Screen To edit the type of wipe please select Change Client Settings Step 2 WipeDrive will now list the Wipe Settings that can be adjusted Please select the necessary options then select the Log Types and Destinations tab Step 3 The Log Types and Log Destinations menu will allow the User to adjust these settings Select the necessary options and select the Custom Log Fields tab Step 4 The Custom Log Fields menu will allow the User to include specific fields in the Log File WipeDrive will prompt for these fields prior to running the deletion Please select the Dongle Server tab C WHITE CANYON S OFTWARE C WIPEDRIVE 7 EET C i WIPEORIVE 7 AE Wee MEME Leg pes and Seat r Luten Log Ten Dese Server Alerts Wipe Settings ROT
37. se of WipeDrive is to securely overwrite all data to make any type of data recovery impossible and document the process to comply with all applicable corporate and government regulations ss t WHITE GANYON www whitecanyon com enterprise contact us 801 224 8900 S o E T WARE A WipeDrive 7 0 User Manual Oct 2012 Key Features SECURE REMOVAL OF HPA AND DCO A host protected area sometimes referred to as hidden protected area is an area of a hard drive that is not normally visible to an operating system A Device configuration overlay DCO is a hidden area on many of today s hard disk drives HDDs Usually when information is stored in either the DCO or host protected area HPA it is not accessible by the BIOS OS or the user As part of the wipe process WipeDrive securely removes and overwrites all data contained in HPAs and DCO s SECUREERASE OPTION A modern hard drive comes with many spare sectors When a sector is found to be bad by the firmware of a disk controller the disk controller remaps the logical sector to a different physical sector The ANSI T 13 committee which oversees the ATA also known as IDE interface specification and the ANSI T 10 committee which governs the SCSI interface specification have incorporated into their standards a command feature known as Secure Erase SE It completely erases all reallocated disk sectors sectors that the drive no longer uses because they have hard errors in them W
38. ttings o User Only applies when username prompting is selected in Settings o Computer ID Only applies when Computer ID prompting is selected in Settings o Custom Field Only applied when custom fields are created in Setttings 3 Wiping Method o Operation Either overwrite or verify o Wipe Type 4 Dates and Time o Date amp Time operation started o Date amp Time operation finished o Total elapsed time o Result of operation 5 Hard Drive Results o Disk sector read write errors o Dirty Unreadable disk sectors o HPA Detected o HPA Erased o Secure Erase Utilized ee a WHITE CANYON www whitecanyon com enterprise contact us 801 224 8900 S OFTWARE WipeDrive 7 0 User Manual Oct 2012 Extensible Markup Language XML Log File Option WipeDrive Enterprise can create an XML log file which is a one page certificate detailing the system hardware and wipe process The log file type can be changed under Settings A sample XML file is shown below Hardware Information Computer Vendor VMware Inc Computer Model VMware Virtual Platform Computer Serial VMware 56 4d d7 f5 d4 6a d2 12 0f e3 Od 4d 68 11 Od c2 Motherboard Vendor Intel Corporation Motherboard Model 440BX Desktop Reference Platform Processor Intel R Core TM 2 CPU 6400 2 13GHz Speed 2133MHz Cores 1 L1 Cache 16KiB L2 Cache Unavailable RAM 1GiB Memory banks 15 NIC Vendor Unavailable Product Unavailable MAC Address 00 0c
Download Pdf Manuals
Related Search