Signal Toolkit
DBAN
Darik's Boot and Nuke — Secure Multi-Pass Drive Wiping
What It Does
DBAN is a self-contained bootable tool that securely erases hard drives by overwriting every sector with multiple passes of random data, zeros, or standardized wipe patterns. It ensures that data on a drive is unrecoverable by software-based forensic methods. When you decommission, donate, or repurpose a machine, DBAN is how you guarantee the previous data is gone.
Why You Need It
Deleting files or formatting a drive does not erase the data — it only removes the pointers to it. A free recovery tool can pull that data back in minutes. In enterprise IT and cybersecurity, proper data sanitization is a compliance requirement (NIST 800-88, HIPAA, PCI-DSS). Referenced in:
- SG-31 — Build a Bootable USB Drive (Field Prep)
CompTIA A+ covers data destruction methods and their use cases. Every technician needs to know when to wipe vs. when to physically destroy a drive.
How to Install It
- Download the DBAN ISO from dban.org (or search for "DBAN download" — it was acquired by Blancco but the free ISO is still available from mirror sites).
- Write the ISO to a USB drive using Rufus (rufus.ie). Select the ISO, choose your USB drive, and click Start. Use DD image mode if Rufus asks — DBAN is a raw bootable image, not a standard ISO.
- Boot the target machine from the USB. Press
F12(or your machine's boot key) during POST to access the boot menu. - DBAN loads a text-mode Linux environment. No operating system on the hard drive is involved — DBAN runs entirely from the USB.
How to Use It
1. Quick wipe with autonuke
At the DBAN boot prompt, type autonuke and press Enter. This automatically wipes every detected drive using the DoD Short method (3 passes). Walk away and come back — it runs unattended.
boot: autonuke2. Interactive mode — select specific drives
Press Enter at the boot prompt without typing anything to enter interactive mode. Use arrow keys to navigate the drive list, press Space to select a drive, then M to change the wipe method, and F10 to start.
3. Choose a wipe method
| Method | Passes | Use Case |
|---|---|---|
| Quick Erase | 1 | Non-sensitive drives, fast reuse |
| DoD Short (5220.22-M) | 3 | Standard secure wipe, most common |
| DoD 5220.22-M | 7 | Higher assurance, slower |
| Gutmann | 35 | Maximum paranoia, extremely slow, rarely needed |
| PRNG Stream | Configurable | Random data fill, good balance |
4. Verify completion
When DBAN finishes, it displays a summary screen showing each drive's status as [pass] (successfully wiped) or [fail] (errors encountered). A passing result means every sector was overwritten the specified number of times. Take a photo of this screen for your records — some compliance frameworks require proof of sanitization.
5. When to use DBAN vs. when SSD TRIM suffices
DBAN is designed for traditional spinning hard drives (HDDs). For SSDs, DBAN does not reliably reach all cells because of wear leveling and over-provisioning. For SSDs, use the manufacturer's Secure Erase command (via their utility software) or the ATA SECURITY ERASE UNIT command. Many SSD controllers also support hdparm --security-erase on Linux.
Common Gotchas
hdparm. DBAN is for HDDs only.
autonuke command erases every drive DBAN detects, including the USB drive you booted from (if DBAN can see it) and any external drives. Disconnect drives you want to keep before booting DBAN, or use interactive mode to select specific targets.