ShredOS Usage

Wipe SSDs (NVMe & SATA) and HDDs with ShredOS

Prerequisites:

• USB-Stick (1GB+)
•  BIOS+UEFI USB / minimum 2GB RAM / writable

Step 1: Preparations

1. Download and flash the ShredOS Image to a USB-Stick with a program like rufus.
2. Expand the shredos partition with a partition manager (or linux tools like fatresize etc.)
3. Copy the following files to /etc/nwipe/ onto the stick:
   1. nwipe.conf
   2. nwipe_customers.csv
4. Edit the following bootloader entries as shown below
5. 1. boot/grub/grub.cfg
   2. EFI/BOOT/grub.cfg

menuentry "ShredOS" {
    linux /boot/bzImage console=tty3 loglevel=3
}

to:

menuentry "ShredOS" {
    linux /boot/bzImage console=tty3 loglevel=3 shredos_exclude_boot_disc="yes" loadkeys=de
}

Then save both files and eject the stick.

Step 2: Booting

Make sure the computer/cerver you're using only has disks connected that you want to wipe.

1. Insert the stick and boot to bios
2. Check the boot order and change it if necessary
3. (if using hardware RAID-Card) Enable HBA-Mode (IT-Mode) in the controller settings 
   and remove existing raid config from the disks
4. boot the computer until you see the blue nwipe screen

Step 3: Wiping disks

HDDs

1.  nwipe will ask you to configure the business and customer data. Change or accept with [a].
2. Use the arrow keys to navigate the drive list and press [Space] to select the disks you want to wipe.
3. Press [m] to choose the wipe method. 
4. (Optional) Press [p] to change the PRNG, [r] for rounds, or [d] to toggle forward/reverse/scatter wipe mode.
5. Press [Shift+S] to start wiping.
6. Wait until all selected disks show a successful status. Do not remove the USB stick or power off the machine during the wipe.

Our default settings for SATA/SAS HDDs:

Method: HMG IS5 enhanced
Rounds: 1 (with method actually 4 incl. zero fill)
Blanking: Yes
Direction: forward

Useful shortcuts:

• [c] - open config settings
• [m] - wipe method
• [f] - toggle interface scaling (useful on high-resolution displays)
• [Ctrl+C] - quit nwipe

SATA and NVMe SSDs (Secure Erase)

For SSDs, prefer a firmware-level secure erase over overwriting every block. This is faster and avoids unnecessary wear. Use the shell on a second virtual terminal while nwipe is running.

Make sure you have selected the correct device before issuing erase commands. Most of these commands do not ask for further confirmation.

1. Press [Alt+F2] to open a shell.
2. List disks on the system:

   fdisk -l

SATA SSDs:

1. Check that the drive is not frozen:

   hdparm -I /dev/sdX | grep frozen

2. If frozen, put the system to sleep and wake it again (repeat until not frozen):

   echo -n mem > /sys/power/state

3. If supported, sanitize the disk (preferred):

   hdparm --sanitize-status /dev/sdX
   hdparm --yes-i-know-what-i-am-doing --sanitize-block-erase /dev/sdX

4. Otherwise use ATA Security Erase:

   hdparm --user-master u --security-set-pass p /dev/sdX security_password="p"
   hdparm --user-master u --security-erase p /dev/sdX security_password="p"

5. Verify the disk is erased:

   dd if=/dev/sdX bs=8192 status=progress | hexdump

NVMe SSDs:

1. List NVMe devices:

   nvme list

2. If supported, sanitize the disk (preferred):Use -a 2 for Block Erase, -a 3 for Overwrite, -a 4 for Crypto Erase.
   
3. Otherwise use NVMe format:

   nvme format /dev/nvmeX -n 0xffffffff -ses=2

   Use -ses=2 for Crypto Erase if supported, otherwise -ses=1 for User Data Erase.
   
4. Verify the disk is erased:

   dd if=/dev/nvmeX bs=8192 status=progress | hexdump

Switch back to nwipe with [Alt+F1].

Step 4: Reports

When wiping is complete, nwipe writes PDF certificates and log files to the USB stick (if PDF_Enable is enabled in nwipe.conf).

1. The following files are created on the stick:
   1. nwipe_report_YYYY-MM-DD-*.pdf (per-disk wipe certificate)
   2. nwipe_system_report_YYYY-MM-DD-*.pdf (system summary)
   3. nwipe_log_*.txt (detailed wipe log)
2. Review the PDF reports and copy them to your records before reusing the stick.

Step 5: Shutdown

1. Press [Ctrl+C] to exit nwipe if you are still in the menu.
2. Power off the machine and remove the USB stick.
3. If disks reported errors during the deletion progress, mark them and/or physically destroy before disposing