nwipe Tutorial: Secure Data Destruction with an Open-Source Tool

1. What Is nwipe?#

nwipe[1] is an open-source command-line tool designed to securely and thoroughly erase data from hard drives, including HDDs and SSDs. It is a fork and modern successor to the earlier well-known tool DBAN (Darik’s Boot and Nuke).

Its core purpose is to overwrite data multiple times with random or specified patterns before storage media is retired, resold, or recycled, ensuring that the original data cannot be recovered by software or hardware and protecting privacy and security.

2. Key Features of nwipe#

1. Free and open source: The code is public and transparent. Anyone can audit, modify, and redistribute it, making the tool trustworthy.

2. Multiple erasure standards: It includes internationally recognized algorithms for different security requirements, including:

   • DoD 5220.22-M: U.S. Department of Defense standard (3 or 7 passes)
   • Gutmann: The classic method proposed by Peter Gutmann (35 passes; very thorough for older technology, but potentially excessive for modern drives such as SSDs)
   • PRNG Stream: Multiple overwrites using a pseudorandom-number generator (the number of passes is configurable)
   • Verify Only: A fast mode that checks whether every disk sector is readable without erasing data, useful for detecting bad sectors

3. Independent of the installed OS: nwipe is commonly included in Live Linux distributions such as Parted Magic and SystemRescue, or can be placed on a bootable USB drive. It runs independently of the operating system on the disk, allowing the system disk itself to be erased without file-lock or permission issues.

4. Automation and batch processing: Command-line parameters enable scripted, automated batch erasure, making it suitable for data centers and large disk inventories.

5. Detailed logs: Later versions generate logs containing the serial number, model, erasure method, start and end times, and final verification result (PASS/FAIL), which is important for auditing and compliance.

6. Broad hardware compatibility: It supports storage devices connected through SATA, SAS, PCIe/NVMe, and USB.

3. Install nwipe (Skip to Section 4 if Already Installed)#

Installation#

1. Boot into an operating system. Any Linux distribution will work. To erase an entire device, I recommend systemrescue[1], a Live OS for Linux system recovery that includes many tools, including nwipe.

2. Install nwipe.

This method may not install the latest version and may not support PDF reports (PDF reports require nwipe version >= 0.35).

• Package-manager installation 👇

1
# Ubuntu, Debian, etc.
2
apt-get update -y
3
apt-get install nwipe -y
4

5
# CentOS, OpenEuler, Rocky Linux, etc.
6
yum update -y
7
yum install install nwipe -y
8

9
# Linux distributions supported by dnf
10
dnf update -y
11
dnf install install nwipe -y

• Build from source 👇

1
wget https://github.com/martijnvanbrummelen/nwipe/archive/refs/tags/v0.38.tar.gz
2
tar -xzf v0.38.tar.gz
3
cd nwipe-0.38/
4
./autogen.sh
5
./configure
6
make
7
sudo make install

3. Verify the installation. If nwipe --version returns a version, the installation succeeded. For example:

1
root@ubuntu:~# nwipe --version
2
nwipe version 0.38
3
root@ubuntu:~#

4. Destroy Data on a Retired Drive with nwipe#

Here I use a VMware virtual machine running Ubuntu Server.

1. Run sudo nwipe to open the nwipe interface. Its GUI-like interface makes data erasure much easier.
2. Select the storage medium to erase. Use the arrow keys to navigate and Space to select; selected devices display “wipe”.

   

3. Press M to select the erasure standard. Use the arrow keys to navigate and Enter to confirm. (See 2. Key Features of nwipe for standards, and “Data Destruction: An Overview of Technologies and Standards” for differences.)

   

4. Press V to choose the verification method. The default verifies the final pass; you can disable verification to improve speed.

   

5. Press s to start overwriting. Because this is risky and irreversible, a safety check requires you to press Shift+S or uppercase S before the operation begins.

   

6. When erasure is complete, press CTRL+C to exit nwipe. The report is generated in the current directory (supported only in newer versions).

   

   

7. Finally, copy the PDF file out manually.

   

🔗 Related links:

[1] nwipe Project Repository: https://github.com/martijnvanbrummelen/nwipe

[2] systemrescue Official Website: https://www.system-rescue.org/