Windows上でディスク上のデータ消去 (wipe - Forensic Acquisition Utilities)

• Windows上で、ハードディスク/リムーバブルメディア等のデータを消去する場合は、以下ツールを使用する。

• Forensic Acquisition Utilities
• 32bit版(FAU.x86)と64bit版(FAU.x64)があるので、環境に応じて適宜使用すること。

• 「e:」ドライブに割り当てられたリムーバブルメディアを完全にゼロ消去する
  • -w オプションで埋める文字列を指定
    • FF ･･･ 16進数FF
    • 00 ･･･ ゼロ
    • RND ･･･ ランダム
  • 参考情報：USBメモリ(2GB)の消去時間 約5分

> wipe \\.\e: -w 00

USAGE:
        wipe [OPTIONS] [drive]
        wipe [OPTIONS] [file]
        wipe [OPTIONS] [directory]

                [drive] refers to a logical volume or physical drive, or a tape
                        device.
                [file]  refers to a file or shell link on a mounted drive.
                [directory]     refers to a directory or mount point.

        OPTIONS:
                -?      Displays this help message.
                -b      Sets the block size (default=1MiB bytes).
                -l  [LANGUAGE] Set the program locale to LANG.
                -v      Verifies the data written to the file
                                (ignored for tape devices).
                -p [PARTITION] Specifies a tape partition to erase
                                (0 specifies the current partition,
                                1 specifies the first partition, etc.).
                -w      [PATTERN] Wipe using a the specified pattern.
                        FF  Wipe using hex FF,
                        00  Wipe with zeros,
                        RND Wipe using random bytes.

        EXAMPLE:
                wipe \\.\PhysicalDrive1
                wipe \\.\D:
                wipe C:\mypath\*.exe
                wipe c:\mypath\afile.*
                wipe -p 1 \\.\Tape0
                wipe \\.\Tape0  (wipes current tape partition)

        Notes: Tapes are wiped by sending the tape drive a command to erase
        the volume unless the tape drive does not support this command.  If
        the drive does not\nsupport this command,  wipe will attempt to erase
        the volume in the same manner as for disk files.

        Use wildcards ('*', '?') to indicate multiple files to wipe.

        Report errors to <gmgarner@erols.com>