I am looking for a possibility to sanitize large amounts of data on regular hard-drives and SSDs. Instead of overwriting the data several times (on regular hard-drives, which could take days and doesn't "work" on SSDs) I am thinking about using hardware-based FDE and simply performing a cryptographic disc erasure (dropping the encryption key). My main issue is now that, as far as I understand, pre-boot authentication is needed. In my case this is not feasible if the authentication has to be done manually (e.g. disks are used in servers located far away). Is there a well-working, well-adapted possibility to let the BIOS perform the authentication automatically, without any manual input or any other solution? If so, what are the drawbacks? Please note that my only goal is to perform sanitization of data in a cost-effective way.
closed as off-topic by TildalWave, Mark, Eric G, Rory Alsop♦ Nov 16 '14 at 8:46
This question appears to be off-topic. The users who voted to close gave this specific reason:
- "This question does not appear to be about Information security within the scope defined in the help center." – Mark, Eric G, Rory Alsop
Disclaimer, my info is old, I haven't tried this in a while.
If the disks support hardware based FDE or Bulk Data Encryption, and you have an integrated lights out or similar capabiltiy on your server, you can try booting to this utility and executing a secure erase.
(not free for commercial use, etc.)
If I recall, the capabilities are not accessible after boot time by design. This makes it harder for malware to kill your disk, or somebody from being able to steal your key or making it easier to bruteforce your harddrive password.
Check the cababilities of your disks in your manuals. This might not solve your problem, but the site has a lot of information about how this ATA Security Extension stuff works.
Edit: This has a good discussion about why what you're asking to do may be very difficult: