Can I safely re-use an old, possibly compromised, hard drive?

Question

I have a 1TB Seagate hard drive (old-style spinning disc :) ). I want to repurpose it if I can do so safely.

It was as originally the primary system drive on a Win7 laptop. It may well have been compromised by viruses, etc.

I wish to use it as the boot drive for a new Debian installation on an old laptop. I'll use encryption, strong passphrases, etc. The laptop will host a full Bitcoin Core client, amongst other things.

My initial plan is to simply remove the existing partitions then using dd to write over the entire /dev/sdx device. Then I would let the Debian installed build it back up.

Will this protect me from any evil stuff that may be on the drive?

Is there something more I should do to clear the MBR, etc?

Answer 1

It's unlikely that the hard drive itself was ever compromised, just the OS installed on the hard drive, which means it should be fine to format it and re-use it.

Simply doing a single pass with dd should be enough, no need to remove existing partitions as dd would overwrite the partition table anyway. Really, I don't see how there'd be much danger in just creating a new partition table without even wiping the data.

Note that it is possible for a hard drive's firmware to be compromised (a quick google will turn up plenty of stuff about the NSA), but as far as I know, if you're using full disk encryption (eg LUKS) the unencrypted data will never be sent to the drive, so data theft shouldn't be a big concern there (although that assumes you encrypt /boot as well, if malicious firmware can modify your kernel you're hosed).

Answer 2

There are two different answers, depending on who you are.

1. If you are a company or commercial organization, you should have a security policy that says to shred all retired drives and buy a new one. Salvaging old drives is deceptively expensive. The cost of cleaning it up, plus the risk of anything bad happening as a result of missing some vital cleanup step far outweighs the cost of a replacement drive. As a benefit, the time savings realized by the performance increase resulting from running an SSD to replace the spinny disk, plus the electrical savings, plus the service life of the drive you've already used up, all of these factors add up to way more than offset the cost of the new drive.

2. If you are a home user, re-read #1 above and see if it makes sense to take a chance on the old drive. You're not saving any money if the old drive causes you an expensive problem. Otherwise, you can try to salvage the drive using a wiping tool like DBAN.

Answer 3

Depending on how serious the compromise was, if it was compromised at all simply partitioning it might not do the trick. I would do a complete wipe if possible, if not, I would just get a new drive. Or if you are dead set on using it, using DBAN (Dariks Boot And Nuke) and wipe it a couple of times to be sure that all of the information has been thoroughly written over.