147 lines
6.4 KiB
Markdown
Executable File
147 lines
6.4 KiB
Markdown
Executable File
# scuttle
|
|
|
|
**A data sanitization framework for block devices and filesystems — written in Rust.**
|
|
|
|
Scuttle is a from-scratch Rust implementation of the data sanitization
|
|
principles pioneered by DBAN and nwipe, which inspired this project. It provides block-device wiping,
|
|
free-space-only wiping, firmware-level secure erase, SMART health monitoring,
|
|
TPM-bound crypto erase, and cryptographically signed audit certificates.
|
|
|
|
## What scuttle does
|
|
|
|
Scuttle securely erases storage media using one of ten wipe methods, eleven
|
|
modern profiles, or a policy engine that selects the method based on device
|
|
type. After wiping, scuttle produces an audit certificate in one of six
|
|
formats (JSON, PDF, XML, CSV, HTML, YAML) with optional Ed25519 digital
|
|
signatures.
|
|
|
|
## Key features
|
|
|
|
- **12 PRNG providers**: ChaCha20, AES-256-CTR, ISAAC-64, BLAKE3-XOF,
|
|
XChaCha20, SHAKE128, SHAKE256, Salsa20, MT19937, XOROSHIRO-256,
|
|
SplitMix64, Lagged Fibonacci. Each ships with KAT self-tests.
|
|
- **4 hash providers**: SHA-256, SHA-512, BLAKE2b-512, BLAKE3-256.
|
|
- **20 profiles**: 9 legacy (zero, one, random, DoD, Gutmann, RCMP, HMG,
|
|
Schneier, BMB) + 11 modern (Quick Clear, Modern Random, NIST Clear,
|
|
NIST Purge, Enterprise, Paranoid, Research, Forensic, Government, Air
|
|
Gap, Custom).
|
|
- **Policy engine**: selects the wipe method based on device media class
|
|
(HDD, SSD, NVMe, PMEM, eMMC, virtual) and operator intent (QuickClear,
|
|
NistPurge, Paranoid, etc.).
|
|
- **Firmware erase**: ATA Secure Erase (standard + Enhanced), NVMe Sanitize
|
|
(Block/Crypto/Overwrite) with status polling, NVMe Format NVM, SCSI
|
|
Sanitize, SCSI Format Unit, TRIM (BLKDISCARD), FITRIM, HPA/DCO detect
|
|
and disable.
|
|
- **Free-space-only mode**: fills filesystem free space with temp files
|
|
containing the wipe pattern, then deletes them. User data is untouched.
|
|
- **SMART data**: reads health, temperature, wear-level, error count, and
|
|
NVMe health log via `smartctl --json`.
|
|
- **TPM erasing**: seals AES keys to TPM PCRs, then erases the key to make
|
|
encrypted data permanently unrecoverable.
|
|
- **Verification**: static-pattern verify, PRNG-stream verify, whole-device
|
|
hash, spot verification (N% of blocks), block verification, statistical
|
|
verification (Shannon entropy, chi-square, byte frequency).
|
|
- **Audit certificates**: JSON (canonical, deterministic), PDF (A4
|
|
single-page), XML, CSV, HTML (self-contained), YAML. Optional Ed25519
|
|
signing with key fingerprint binding.
|
|
- **Merkle tree**: SHA-256 Merkle tree over per-block hashes for
|
|
third-party verifiability.
|
|
- **Job scheduler**: sequential, parallel (thread pool), priority, and
|
|
groups modes for multi-device wipes.
|
|
- **Batch mode**: YAML or JSON spec file for automated multi-device wipes.
|
|
- **JSON API**: Unix-domain-socket server for programmatic control.
|
|
- **TUI**: interactive terminal UI with device list, detail pane, and
|
|
command palette.
|
|
- **Security hardening**: secure memory (zeroize on drop), constant-time
|
|
comparison (subtle), startup KAT self-tests, continuous RNG health
|
|
checks (NIST SP 800-90B), FIPS mode flag.
|
|
- **Legacy compatibility**: accepts all legacy nwipe CLI flags with
|
|
deprecation warnings. Invoking via a `nwipe` symlink enables legacy
|
|
compatibility mode automatically.
|
|
- **SBOM**: CycloneDX 1.4 Software Bill of Materials generation.
|
|
|
|
## Build
|
|
|
|
```bash
|
|
cargo build --workspace --release
|
|
```
|
|
|
|
The binary is at `target/release/scuttle`. For legacy compatibility, create
|
|
a symlink: `ln -s scuttle target/release/nwipe`.
|
|
|
|
## Quick start
|
|
|
|
See [quickstart.md](quickstart.md) for detailed examples.
|
|
|
|
```bash
|
|
# List block devices
|
|
scuttle list
|
|
|
|
# Wipe a loopback file
|
|
scuttle wipe /tmp/test.bin --method dod --certificate json
|
|
|
|
# Wipe with a modern profile (policy-driven)
|
|
scuttle wipe /dev/sdX --profile paranoid --certificate all \
|
|
--i-know-this-destroys-data
|
|
|
|
# Wipe free space only (user data untouched)
|
|
scuttle wipe /mnt/data --freespace-only --method zero
|
|
|
|
# Read SMART data
|
|
scuttle smart /dev/sda
|
|
|
|
# Run startup self-tests
|
|
scuttle selftest
|
|
|
|
# Generate a CycloneDX SBOM
|
|
scuttle sbom > scuttle-sbom.json
|
|
```
|
|
|
|
## Project layout
|
|
|
|
```
|
|
scuttle/
|
|
├── crates/
|
|
│ ├── scuttle-hash/ SHA-256, SHA-512, BLAKE2b-512, BLAKE3-256
|
|
│ ├── scuttle-prng/ 12 PRNG providers with KAT self-tests
|
|
│ ├── scuttle-devices/ Block device discovery via sysfs
|
|
│ ├── scuttle-media/ NIST 800-88 media classification
|
|
│ ├── scuttle-methods/ 10 legacy wipe methods
|
|
│ ├── scuttle-verify/ Static, PRNG, spot, block, statistical verify
|
|
│ ├── scuttle-audit/ JSON, XML, CSV, HTML, YAML, Merkle tree
|
|
│ ├── scuttle-profiles/ 20 profiles (9 legacy + 11 modern)
|
|
│ ├── scuttle-pdf/ PDF certificate exporter
|
|
│ ├── scuttle-freespace/ Free-space-only file-fill wipe
|
|
│ ├── scuttle-policy/ Policy engine (media class → wipe plan)
|
|
│ ├── scuttle-benchmark/ PRNG and hash throughput benchmarks
|
|
│ ├── scuttle-firmware/ ATA SE, NVMe Sanitize, SCSI, TRIM, HPA/DCO
|
|
│ ├── scuttle-signing/ Ed25519 audit record signing
|
|
│ ├── scuttle-smart/ SMART data via smartctl
|
|
│ ├── scuttle-tpm/ TPM 2.0 key seal/erase
|
|
│ ├── scuttle-scheduler/ Sequential, parallel, priority, groups
|
|
│ ├── scuttle-tui/ Interactive terminal UI
|
|
│ ├── scuttle-batch/ YAML/JSON batch spec parser
|
|
│ ├── scuttle-jsonapi/ Unix-socket JSON API server
|
|
│ ├── scuttle-security/ Secure memory, constant-time, KAT, RNG health
|
|
│ ├── scuttle-conformance/ NIST 800-88 reports, SBOM, API stability
|
|
│ ├── scuttle-core/ Wipe engine + lifecycle
|
|
│ └── scuttle-cli/ CLI binary (scuttle)
|
|
├── profiles/ 20 profile TOML files
|
|
├── docs/
|
|
│ └── MANIFEST.md Architectural reference
|
|
├── LICENSE GPLv2 full text
|
|
└── Cargo.toml Workspace manifest
|
|
```
|
|
|
|
## License
|
|
|
|
GPL-2.0-or-later. See [LICENSE](LICENSE) for the full text.
|
|
|
|
## Acknowledgements
|
|
|
|
Scuttle was inspired by the work of Darik Horn (DBAN), Martijn van Brummelen
|
|
(nwipe), Andy Beverley (nwipe), Bob Jenkins (ISAAC), Makoto Matsumoto and
|
|
Takuji Nishimura (Mersenne Twister), and Fabian Druschke (XOROSHIRO-256,
|
|
ALFG). The nwipe and DBAN projects informed legacy method patterns, PRNG semantics,
|
|
and the PDF certificate layout. All Rust code is original.
|