DASE Disk Auditor and Secure Eraser

Name: DASE - Disk Auditor and Secure Eraser
Author: Tiago Mateus

DASE is a bootable UEFI application for inspecting and securely erasing disks. It runs directly on the machine's firmware, with no operating system underneath, and picks the erase method from the drive type: a full overwrite for hard drives, and the drive's own sanitize command for NVMe SSDs.

Download Source on GitHub

Erasing is permanent. Before you confirm a wipe, check the model and serial number of each selected disk with listatainfo or nvmeinfo.

Erase methods

DASE reads each disk's transport and media type, then chooses one method per disk.

Drive	Method
Hard drive	Every block is overwritten with zeros.
NVMe SSD	NVMe Sanitize. If the drive does not support it, NVMe Format with User Data Erase. Single-namespace drives only.
SATA SSD	Not supported yet.
Boot disk, RAID volume, read-only or unknown media	Always refused. RAID: Refused unless RAID is set to IT/Passthrough mode.

After every wipe, DASE reads the whole disk back to verify it.

SSDs are deliberately not overwritten. The controller remaps blocks internally, so writes from the host never reach all of the flash, and a full overwrite only adds wear. Sanitize runs inside the drive and also reaches storage the host cannot address.

Usage

Boot the machine from the DASE USB drive and you get a DASE> prompt. Disks are numbered disk0, disk1, and so on. A typical session:

DASE> listdisks
DASE> nvmeinfo
DASE> checkwipe
DASE> wipe -d3 -d4
DASE> wipe -x
Type  I confirm  to proceed, or anything else to cancel:
> I confirm

listdisks marks the disk DASE booted from, and checkwipe shows which disks can be erased and how. The selection made with wipe -d is kept between commands, and each selected disk is checked again just before anything is written. Typing anything other than I confirm cancels the wipe.

Commands

Commands are case-sensitive.

Command	Description
`listdisks`	List all disks and mark the one DASE booted from.
`listparts X`	List the partitions on disk X.
`listdisksinfo`	Show each disk's controller, transport and size.
`listatainfo`	Show model, serial number and media type of SATA and IDE disks.
`nvmeinfo`	Show model, serial number, namespaces and supported erase commands of NVMe disks.
`checkwipe [X]`	Show whether each disk, or disk X, can be wiped, and how.
`wipe [flags]`	Select disks, then wipe and verify them.
`fat32test`	Mount the FAT32 volume on disk0 and print its file tree.
`clear`	Clear the screen.
`help`	Show the command reference.
`exit`	Power off the machine.

wipe flags

Flag	Effect
`-dX`	Select disk X.
`-rdX`	Deselect disk X.
`-a`	Select every disk that can be wiped.
`-l`	Show the current selection. Running `wipe` with no flags does the same.
`-c`	Clear the selection.
`-x`	Wipe the selected disks, after you type `I confirm`.
`-s`	With `-x`, wipe one disk at a time.

-d and -rd cannot be combined with other flags, for safety reasons.

Install & Boot

From a release

Download the .img.xz image and SHA256SUMS from the latest release.
Run sha256sum dase-*.img.xz (on macOS, shasum -a 256 dase-*.img.xz) and check that the result matches the line in SHA256SUMS, so the image is valid.
Write the image to a USB drive with Rufus or balenaEtcher. This erases the USB drive.
Boot the target machine from the USB drive in UEFI mode. DASE is not signed yet, so Secure Boot has to be turned off.

From source

The build runs in Docker.

git clone https://github.com/TiagoMateus05/DASE.git
cd DASE
./build.sh

The resulting dase.img can be written to a USB drive with dd if=dase.img of=/dev/sdX bs=4M status=progress (Linux) or sudo dd if=dase.img of=/dev/rdiskX bs=4m (macOS). This erases the USB drive.

An easier way is to use a tool such as Rufus or balenaEtcher.

Limitations

Only hard drives and NVMe SSDs can be erased.
Only x86_64 machines with UEFI firmware are supported.
NVMe drives with more than one namespace are refused.
Verification reads the entire disk, so it takes a long time on large drives.

Roadmap

SATA SSD support
A text-based interface
Read support for NTFS, ext4 and exFAT, to inspect a disk before erasing it
PDF reports of audits and wipes
Secure Boot support
Erase procedures that fully meet NIST SP 800-88 and IEEE 2883

Motivation

Free disk wipers such as DBAN were written for hard drives and are no longer maintained. Most tools that handle SSDs correctly are commercial, or are built on a full Linux distribution. DASE is meant to be a small, free alternative that boots straight from firmware and treats each kind of drive correctly. It aims for two main goals: to be a safe, open-source, bootable disk wiper, and allow driven developers to learn and contribute to UEFI programming.

Contributing

DASE is a spare-time project by me, Tiago Mateus, as an MSc student. Contributions are always welcome, specially from people who have experience or want to learn about UEFI programming. The code is written in C and uses the GNU-EFI library. Ready to build docker and scripts are included in the repository. Bug reports, results from testing on real hardware, and pull requests are welcome on GitHub. If you want to learn GNU-EFI programming, you are welcome to join.