Drive Triage: Linux Drive Health, Recovery and Secure Erase

Author: Jason Wolff, STL Net Services · v7.11, September 2026 · Apache License 2.0

Download drive-triage.zip: the tool, the desktop launcher, the deploy script, the DVR converter, LICENSE and NOTICE.

A bench tool for Linux that answers four questions about every drive that comes through the door:

1. What is it, and is it healthy? A SMART report that reads the attributes that matter, not the "PASSED" flag.
2. Is there anything on it? A quick sample, a preview of whose drive it is, and file carving if it's worth recovering.
3. Can it be destroyed properly? Overwrite, ATA Secure Erase or NVMe format, whichever the hardware supports.
4. Can you prove it? A full read of every sector, with a certificate.

It's built for a bench where many drives pass through in a day and a job can run for days. All state is keyed by drive serial number, so it survives unplugging, reboots and sda/sdb renumbering.

This software destroys data irreversibly

It was written and tested against two bench machines and about ten drives. Use --dry-run on any first-of-a-kind drive. It runs every safety check and stops just before the write. There is no warranty.

Install

Debian, Ubuntu or Mint. You need bash 4+, Linux and an account with sudo.

unzip drive-triage.zip && cd drive-triage

sudo apt install smartmontools nwipe gddrescue testdisk tmux \
                 nvme-cli sg3-utils python3 hdparm rsync

sudo install -m0755 drive-triage.sh     /usr/local/bin/drive-triage
sudo install -m0755 drive-triage-launch /usr/local/bin/drive-triage-launch
sudo install -D -m0644 tmux.conf /usr/local/share/drive-triage/tmux.conf

That's the whole install. drive-triage is a single self-contained bash script. Without tmux the launcher falls back to a single-pane menu. Without python3, signature scanning and the preview report degrade gracefully.

To push the tool to a remote bench machine instead, use ./deploy.sh <ssh-key> <user@host> [desktop-user]. It installs the packages, the tool and a double-click Drive Triage desktop launcher (XFCE and Cinnamon). Re-run it to update. Replacing the binary doesn't disturb a background job that's already running.

Using it

Run drive-triage-launch or double-click the launcher. The menu is on the left and a live job monitor is on the right.

 1) /dev/sdb  931.5G HDD WDC WD10EZEX   HEALTHY  RANDOM-FILL  gpt partition table
 2) /dev/sdc  232.9G HDD ST3250318AS    AGED     NEW          blank
 3) /dev/sde   17G   HDD ATLAS V 18     -        BUSY erase   12GiB/17GiB 70% at 52MB/s

Pick a drive to see its options:

LOOK      1) Drive info        full health report, partitions, erasability
          2) Search for data   is there anything here? (quick)
          3) Preview           whose drive, what files, what dates — no storage needed
RECOVER   4) Copy files off it mountable filesystems
          5) Carve lost files  photorec — needs a recovery location
DESTROY   6) Erase             overwrite the whole drive (nwipe, or shred)
          7) Firmware erase    ATA Secure Erase, or NVMe controller erase
CONFIRM   8) Verify clean      full read of every sector, or a quick sample
          9) Record as beyond use
         10) Set status
          u) Unmount           if the desktop auto-mounted it

Health. The report gives a verdict (SOUND, AGED, WATCH, AT RISK or SCRAP) based on attributes 5, 187, 197, 198 and 9. SMART's overall flag says PASSED on drives with hundreds of uncorrectable errors, so it's shown but not trusted. Seagate's attributes 1 and 7 are encoded composites, not error counts, and are ignored. A drive that doesn't answer its probes is reported UNRESPONSIVE: power-cycle it, and don't start a read test.

Erase adapts to the drive. Options come from a capability probe, so the menu never offers something the hardware can't do, and it says why. Overwriting is refused on flash. Firmware erase is marked unavailable when the drive is frozen, lacks ATA security, or sits behind a USB bridge that blocks passthrough. An SSD with no ATA security gets a discard (TRIM) erase instead, which is checked by reading the drive back. A Host Protected Area that hides part of the drive can be unlocked first, so the erase reaches all of it.

Verify clean decides whether a drive can leave the building. It reads every sector and reports:

• the exact non-zero byte count and where it is, as offset, length and non-zero bytes per region
• file signatures and the offset where each was found
• entropy of the non-zero content, which separates a random-fill wipe from carvable files
• identifiable strings, shown on screen so you can tell whose drive it is and never written to the log
• every sector that wouldn't read, isolated to 4KB

A drive that reads back entirely zero is marked VERIFIED. A drive with even one unreadable sector is marked UNREADABLE and is never certified, because what's in those sectors is unknown, and unknown is not clean. The output also states the limit: a read reaches every sector the drive exposes, but not retired blocks or over-provisioned spare area. Only a firmware erase reaches those.

Command line

The menu is a front end over these flags, with the same guards and the same logging.

drive-triage --scan [--json]
drive-triage --health  /dev/sdX
drive-triage --survey  /dev/sdX [--samples N]
drive-triage --validate /dev/sdX
drive-triage --preview /dev/sdX [--samples N]
drive-triage --copy    /dev/sdX --dest PATH [--force-ddrescue]
drive-triage --carve   /dev/sdX --dest PATH
drive-triage --wipe    /dev/sdX --confirm SERIAL [--method M] [--passes N] [--dry-run]
drive-triage --secure-erase /dev/sdX --confirm SERIAL [--enhanced] [--dry-run]
drive-triage --nvme-erase   /dev/sdX --confirm SERIAL [--ses 1|2]
drive-triage --discard      /dev/sdX --confirm SERIAL
drive-triage --tape [/dev/stN]
drive-triage --tape-image /dev/stN --dest PATH
drive-triage --tape-erase /dev/stN --confirm SERIAL
drive-triage --image-extract FILE.img --dest PATH
drive-triage --watch

Safety model

• An erase requires the drive's serial number typed out, not a yes/no. Menu numbers shift when drives are rescanned; serials don't.
• Disks backing /, /boot or swap are re-derived from the live system at enumeration and again just before the write.
• Any disk with a mounted filesystem is refused. Desktop auto-mounts under /media can be unmounted from the menu.
• Overwriting is refused on SSDs, because wear levelling puts old blocks out of reach.
• An erase is refused if the drive has a hidden HPA/DCO area it can't reach.
• After an erase, SMART is re-read. A pending or uncorrectable sector that survived a full write means the drive can't write it, so the drive is marked RECYCLE rather than certified.

Which erase can you prove?

Method	Verifiable by read-back	Notes
ATA SANITIZE BLOCK_ERASE	Yes, reads back zero	Resets the NAND cells
Overwrite (nwipe/shred)	Yes	Can't reach spare blocks on flash, so it's refused on SSDs
ATA SANITIZE CRYPTO_SCRAMBLE	No	Destroys the key; the ciphertext remains and reads as random
ATA SECURITY ERASE	Usually	Missing entirely on some modern SSDs
NVMe FORMAT --ses	1 yes, 2 no	2 is a crypto erase

Crypto erase is accepted as Purge by NIST SP 800-88 and it's sound, but a crypto-erased drive and a drive full of encrypted data look the same to a read. If you need to release a drive with confidence, use the method whose result you can check yourself.

Records

Path	What
/var/log/drive-triage/triage.log	Append-only history of everything
/var/log/drive-triage/certificate-*.txt	Sanitization certificate per erase or verification
/var/lib/drive-triage/drives.tsv	Per-drive state, keyed by serial
/var/lib/drive-triage/jobs/	Background job records and output

Bonus: dvr2mp4

The zip also has dvr-converter/, a separate tool for 2007-era 4-channel DVR drives whose .mp4 files aren't MP4. They're MPEG-4 Part 2 at 352×240 in a proprietary container (every file starts with FF FF 00 01) with no VOL header, which is why players reject them. dvr2mp4 <session-dir> turns each channel into a playable MP4 named after its camera. Requires ffmpeg and python3. Details are in its README.

Status

Tested on real hardware: scanning, health reports, survey and preview, carving, mounting and unmounting, overwrite erase with nwipe and shred, ATA Secure Erase, background jobs and full-read verification.

Lightly tested: tape drives (/dev/stN). The tool can read what is on a cartridge, image it in one pass and long-erase it with a read-back check, but it has only seen one DDS drive.

Never run on real hardware: the NVMe erase path and the SSD erase branches. Use --dry-run first.

Planned: ATA SANITIZE support and SSD-specific SMART thresholds.

License and attribution

Copyright 2026 Jason Wolff, STL Net Services. Licensed under the Apache License 2.0. You may use, modify and redistribute it, including commercially, as long as the copyright and the NOTICE file's attribution survive in every copy or derivative work. The license grants no rights to the author's name or marks.

Built by Jason Wolff with Claude (Anthropic). Neither the tool nor its deployment needs any AI assistance to use, install, modify or maintain.