FADE (Forensic And Data Erasure) Utility

A Bash utility designed to securely sanitize block devices on Linux for use in computer forensics. FADE identifies the physical architecture of the target drive and applies the most appropriate, forensically sound erasure method, complete with cryptographic verification and detailed log generation.

🚀 Features

• Architecture-Aware Wiping:
  • NVMe Drives: Utilizes nvme-cli for hardware-level Secure Erase.
  • SATA SSDs: Utilizes hdparm for ATA Secure Erase, including BIOS freeze-state detection.
  • External Enclosures: Utilizes sg_format to bypass USB-to-SATA bridge chip translation issues via SCSI Fast Formats.
  • Mechanical HDDs & Flash: Utilizes dc3dd for standard software-based cryptographic overwrites.
• Cryptographic Zero-Fill Verification: When a hardware erase is performed, FADE calculates a parallel SHA-256 hash in the background and reads the empty drive into /dev/null to mathematically prove the drive's hash matches the expected output for a zero-filled drive of its size.
• Host System Safety: Includes a mount-check gatekeeper that refuses to sanitize any drive currently in use by the OS.
• Auto-Dependency Resolution: Detects missing tools and offers automatic installation via apt (Debian/Ubuntu optimized).
• Comprehensive Disclosure Logging: Stitches device details, host toolchain versions (for forensic disclosure), hardware-erase output, verification hashes, and raw dc3dd readouts into a single, clean forensic text file.

🛠️ Prerequisites

This script requires root privileges to interact with raw block devices. It is optimized for Debian/Ubuntu/Kali distributions.

The following packages are required (the script will offer to install them automatically if missing):

• dc3dd
• hdparm
• nvme-cli
• sg3-utils (for sg_format)
• fdisk

💻 Installation & Usage

1. Make the script executable:

   chmod +x fade

2. Move it to your PATH (optional but recommended):

   sudo mv fade /usr/local/bin/

3. Run the utility as root:

   sudo fade

4. Follow the interactive prompts:

• Select your target drive (e.g., sdb or /dev/nvme0n1).
• Select the physical architecture of the drive.
• Provide the absolute path for your log file (e.g., /home/user/Desktop/wipe.log). Do not use ~.
• Type YES to confirm the irreversible data wipe.

⚙️ CLI Flags

FADE supports several built-in flags for documentation and version control:

• fade -h or --help : Displays the help menu, description, and usage instructions.
• fade -v or --version : Displays the current FADE version.
• fade -c or --changelog : Displays the version history and feature updates.

⚠️ Troubleshooting

"SATA drive is FROZEN by the system BIOS" Modern motherboards often lock SATA SSDs at boot to prevent malicious password locking. If you encounter this warning:

1. Abort the script (Ctrl+C or type 'abort').
2. Put the computer to sleep (Suspend-to-RAM) manually.
3. Wake the computer back up (this bypasses the BIOS lock).
4. Re-run FADE.

"Hardware erase failed" If nvme, hdparm, or sg_format fail, FADE will gracefully catch the error, print the raw output to your terminal, and offer an interactive prompt to fall back to a standard dc3dd software wipe.

🛡️ Disclaimer

THIS UTILITY WILL PERMANENTLY DESTROY DATA. The operations performed by FADE are completely irreversible. Always verify your target block device using lsblk before typing YES to proceed.