Creating a custom restore disk to prevent data mining?

Question

I work in commercial telecoms and one part of our business is the leasing of computer equipment to call centers. If the customer for whatever reason gives us the equipment back (non-payment, out of business, downsizing) we lease out these same computers to the next customer.

Making sure the computers are ready to be shipped out again now falls under my responsibility, and I have been made aware that the previous method for resetting them was simply to log on, delete the contents of My Documents, and empty the recycle bin. I know this is in no way secure and what I now want to do is to combine the tasks of removing data properly, resetting the computer to a factory state, and installing a few specific programs into one operation.

Is it possible to create a custom Windows recovery/reset disk that will also install a select few programs AND change a number of settings? Where would I start?

Answer 1

What you describe is the worst possible practice possible apart from just handing it over. From a security standpoint it poses significant risks to both the previous and current parties.

The easiest way to reformat PCs is to use what is called a "golden image" this image is a windows image you:

• keep up to date
• only install the bare minimum of programs necessary

Next what you can do is setup a PXE server. Instead of using DVDs you just upload this disk to a central DHCP server and you hook the machine onto it. You then boot it into PXE mode and it will load the image from the network (if you use gigabit ethernet it can be a lot faster than a common DVD). The benefit of this is that you are basically can install a lot of machines concurrently without having to use DVDs. The nice part is that Windows also offers tools to completely automate this type of deployment including running post install scripts.

There is however a small catch, the disks also would need to be wiped clean before re-installing the windows image. Windows does offer this possibility using their Windows PE environment.

Answer 2

I'd implement either disk replacement, disk circulation, or secure disk wiping, depending on your resources/time constraints.

If possible, I'd take the large datacenter approach, and just remove and replace the disks, ideally destroying those that come out. Given that these will be fairly entry level machines, I'd say it would be easy to incorporate the cost of replacing a hard disk in the cost of lease, but whether your managers will agree with this is their call.

If that proves too much, I'd try to accumulate a surplus of disks, and remove disks, replacing them with securely erased disks in the meantime. You can be clearing off disks not in machines in readiness for the next batch of machines coming in. It's not the ideal, mainly because handling, removing, reinstalling etc on a regular basis will probably reduce the disk life span considerably.

Third option in my mind is to securely erase the disks in place when the machines come back in, which could be achieved with a USB setup to do this to whichever disk wiping standard you choose.

After you've wiped/replaced the drives, you can reinstall your base version of windows, setup however you wanted, probably using the method Lucas mentioned of a PXE server. I've used PXE servers to administrate networks, and it's a very satisfying way of performing reinstalls.

Answer 3

In addition to Lucas's answer above, you might want to start with prying the various EEPROMs off the motherboard, and reflash them with the latest firmware downloaded and verified from the manufacturers' website before soldering them back.

These steps would make sure there is no persistent malicious firmware present in the box before it is shipped to the next customer.

also, don't forget to dispose any existing SSD using fire or chemical methods since a data wipe might still fail depending on how the manufacturer implemented wear leveling on a particular SSD.

Heasman, J. 2007. Implementing and Detecting a PCI Rootkit

Sacco, AL, Ortega, A. 2009. Persistent BIOS Infection