Active@ KILLDISK for DOS Copyright (c) 1999-2003 LSoft Technologies Inc. USERS MANUAL 1. PRODUCT OVERVIEW 1.1. Deleting Confidential Data 1.2. Advanced Data Recovery Systems 1.3. High Standards 2. SYSTEM REQUIREMENTS 3. OPERATING PROCEDURES 3.1. Prepare bootable floppy disk (startup disk). 3.2. Run Active@ KILLDISK (Interactive mode) 3.2.1. Start data erasing on the particular HDD or partition 3.2.2. Erasing Progress 3.2.3. Erasing Report 3.3 Configuration Options 3.3.1. Erase methods 3.3.2. Number of Passes 3.3.3. Verification 3.3.5. Ignore Errors 3.3.6. Clear Log File before Start 3.3.7. Skip Confirmation 3.4. Run Active@ KILLDISK (Command Line mode) 3.4.1. Parameters description 3.4.2. Start Active@ KILLDISK with parameters 4. COMMON QUESTIONS 1. PRODUCT OVERVIEW 1.1. Deleting Confidential Data Modern methods of data encryption are deterring unwanted network attackers from extracting sensitive data from stored database files. Unfortunately, attackers wishing to retrieve confidential data are becoming more resourceful by looking into places where data might be stored temporarily. A hard drive on a local network node, for example, can be a prime target for such a search. One avenue of attack is the recovery of supposedly-erased data from a discarded hard disk drive. When deleting confidential data from hard drives or removable floppies, it is important to extract all traces of the data so that recovery is not possible. Most official guidelines around disposing of confidential magnetic data do not take into account the depth of todays recording densities. The Windows DELETE command merely changes the file name so that the operating system will not look for the file. The situation with NTFS is similar. Removal of confidential personal information or company trade secrets in the past might have used the FORMAT command or the DOS FDISK command. Ordinarily, using these procedures gives users a sense of confidence that the data has been completely removed. When using the FORMAT command, Windows displays a message like this: Important: Formatting a disk removes all information from the disk. The FORMAT utility actually creates new FAT and ROOT tables, leaving all previous data on the disk untouched. Moreover, an image of the replaced FAT and ROOT tables are stored, so that the UNFORMAT command can be used to restore them. FDISK merely cleans the Partition Table (located in the drive's first sector) and does not touch anything else. 1.2. Advanced Data Recovery Systems Advances in data recovery have been made such that data can be reclaimed in many cases from hard drives that have been wiped and disassembled. Security agencies use advanced applications to find cybercrime-related evidence. Also there are established industrial spy agencies adopting sophisticated channel coding techniques such as Partial Response Maximum Likelihood (PRML), a technique used to reconstruct the data on magnetic disks. Other methods include the use of magnetic force microscopy and recovery of data based on patterns in erase bands. Although there are very sophisticated data recovery systems available at a high price, data can easily be restored with the help of an off-the-shelf data recovery utility like Active@ File Recovery (www.file-recovery.net) or Active@ UNERASER (www.uneraser.com), making your erased confidential data quite accessible. Using Active@ KILLDISK, our powerful and compact utility, all data on your hard drive or removable floppy drive can be destroyed without the possibility of future recovery. After using Active@ KILLDISK, disposal, recycling, selling or donating your storage device can be done with peace of mind. 1.3. High Standards Active@ KILLDISK has several methods for data destruction that conform to US Department of Defense clearing and sanitizing standard DoD 5220.22-M, German VSITR, Russian GOST p50739-95. More sophisticated methods like Gutmann's or User Defined methods are available as well. You can be sure that once you wipe a disk with Active@ KILLDISK, sensitive information is destroyed forever. Active@ KILLDISK is a quality security application that destroys data permanently from any computer that can be started using a DOS floppy disk. Access to the drive's data is made on the physical level via the Basic Input-Output Subsystem (BIOS), bypassing the operating systems logical drive structure organization. Regardless of the operating system, file systems or type of machine, this utility can destroy all data on all storage devices. Thus it does not matter operating systems and file systems located on the machine, it can be DOS, Windows 95/98/ME, Windows NT/2000/XP, Linux, Unix for PC. 2. SYSTEM REQUIREMENTS To be able to use Active@ KILLDISK you require: - AT compatible CPU with 386 or greater processor - 4Mb of RAM - 1.44 Mb floppy diskette drive - Bootable Floppy disk containing MS-DOS 6.0+,or startup disk for Windows 95/98 - HDD of type IDE/ATA/SCSI attached to be erased. 3. OPERATING PROCEDURES 3.1. Prepare bootable floppy disk (startup disk). If you do not have bootable floppy, you can prepare such disk from MS-DOS, Windows 95/98 the following ways: - If you boot in MS-DOS or in Command Prompt mode of Windows 95/98, insert blank floppy and type: FORMAT A: /S and follow the instructions on a screen. - If you boot in Windows 95/98, go to the "Control Panel" then "Add/Remove Programs", then switch to tab "Startup Disk" and click button "Startup Disk..." Copy Active@ KILLDISK (KILLDISK.EXE) to the bootable floppy disk Alternatively you can use ours "Bootable Floppy Creator" that allows you to create bootable floppy with DEMO version of Active@ KILLDISK pre-installed. Look in the Downloads section at product's web site: www.killdisk.com 3.2. Run Active@ KILLDISK (Interactive mode) - Boot from the bootable floppy in DOS mode - Run Active@ KILLDISK by typing in command line: KILLDISK.EXE You will see the list of detected hard disk drives and partitions. When you move cursor through them, you'll see their system information. 3.2.1 Start data erasing on the particular HDD or partition - Using arrows select hard disk drive or partition you want to erase at the left side. Configuration dialog appears. - Using arrows and [F10] key choose configuration options (see Configuration Options section) or leave defaults and press F10 to continue - To confirm the erasing action, please type: ERASE-ALL-DATA Erasing process will start. 3.2.2. Erasing Progress See the progress and stop the operation if you want to. - Wait until operation is complete or - Stop an operation at any time by pressing [ESC] After operation is completed successfully you'll see erasing report. If there are any errors, for example due to bad clusters, you'll see them on the screen and will be able to continue or cancel the operation. 3.2.3. Erasing Report After erasing operation is complete, report is displayed. It contains target drive, timing, erase method, etc. related to the erasing session. If there were some errors, for example bad clusters, you'll see this information here. Use arrows to scroll window. Example of the Erasing Report: ------------- Erase Session ----------------------- Active@ KILLDISK started at: Thu Feb 20 11:56:51 2003 Target: Floppy (00h) 1.40MB Erase method: US DoD 5220.22-M Passes:3 Verification:40% (completed successfully) Time taken: 00:01:26 Total number of erased device(s), partition(s): 1 The report is automatically saved to KILLDISK.LOG file located at the same folder where you started Active@ KILLDISK from. 3.3 Configuration Options: 3.3.1. Erase methods Erase method allows to define security level or cleaning standard for the following erase operation. It is one of: - One pass zeros: 1 pass, quick, low security - One pass random: 1 pass, quick, low security - US DoD 5220.22-M: 3 passes, slow, high security - German VSITR: 7 passes, slow, high security - Russian GOST p50739-95: 5 passes, slow, high security - Gutmann: 35 passes, very slow, highest security - User Defined: You can specify number of passes (random) 1 to 99 3.3.2. Number of Passes For all erasing methods except User Defined this number is fixed and cannot be changed (see above). For User Defined method you can change number of passes. Each overwriting pass will be performed with a buffer containing random characters. 3.3.3. Verification After erasing is complete you can direct software to perform verification of the surface on the drive to be sure that the last overwriting pass was performed properly and data residing on drive now match data written by KILLDISK. Verification is a long process. You can turn off the verification, or turn it on and specify percentage of the surface to be verified. 3.3.4. Retry Attempts If error happens while data reading/writing onto the drive (it could happen, for example, due to the physical damage of drive's surface), Active@ KILLDISK tries to perform the operation again and again, and you can specify number of retries to be performed. If drive is not completely damaged, sometimes after several retries it is possible to read/write sector. 3.3.5. Ignore Errors If this option is turned on, you'll not see error messages while data erasing/verification is in progress. All errors have been ignored, however all i...
mr.bump