How to Use Nwipe: Securely Erase a Hard Drive Before You Sell or Recycle It

CodexFuse Team · 2026-11-06T12:46:17.376Z · 22 min read min read

How to Use Nwipe: Securely Erase a Hard Drive Before You Sell or Recycle It

Learning how to use Nwipe is the safest way to hand a hard drive to someone else. Nwipe is a free, open-source disk eraser for Linux that overwrites every sector of a drive so the old data cannot be recovered with ordinary recovery software.

To use Nwipe, boot the ShredOS live USB, pick the drive in the text interface, choose a wipe method, and start the wipe. The tool runs pass by pass, verifies the final pass, and writes a three-page PDF certificate when it finishes.

All facts in this guide are as of November 2026, and version numbers move fast, so treat the release details as a snapshot. CodexFuse offers no drive-wipe tool, so this guide teaches the open-source tool itself, step by step, with every flag and version taken from the official man page and release notes.

How Do You Use Nwipe?

Nwipe is a command-line disk eraser that securely overwrites a whole block device, and this nwipe tutorial walks you from a blank USB stick to a finished wipe. You run it in one of two ways: boot ShredOS, a small live Linux distribution that starts Nwipe automatically, or install Nwipe on a Linux system you already run. Either way, the workflow is the same: pick the drive, pick a method, start the wipe, and keep the PDF certificate as proof.

People usually reach for Nwipe when a machine is being retired, and if that machine is a rented server, our VPS hosting guide explains what a VPS is and how its storage differs from a drive you own. The retired-server case is the most common one: a drive that leaves your hands should leave with nothing readable on it. That is the whole job Nwipe exists to do, and it does it with a text interface that fits on any screen.

Nwipe began as a fork of the dwipe engine from Darik's Boot and Nuke, rebuilt so it could run on any Linux distribution with modern hardware support. The project is maintained by Martijn van Brummelen and Nick Law, it carries the GNU General Public License version 2.0, and its repository holds 1,246 stars and 129 forks. The current release is version 0.43, published on 2 October 2026, which makes it 35 days old on 6 November 2026.

Why Deleting Files Does Not Erase Your Drive

Deleting a file only removes its directory entry and marks its space as free, and the bytes stay on the platter until something overwrites them. Formatting a drive is no stronger: a quick format rebuilds the file system structures and leaves the old data sitting underneath. Anyone with free recovery software can read files off a deleted or formatted drive in minutes, which is why you should securely erase hard drive contents before the drive changes hands.

To erase disk permanently, you must overwrite every sector with new data, and that is exactly what Nwipe does. Each wipe method writes one or more passes of patterns across the whole device, and the verification step then reads the disk back to confirm the overwrite landed. A single pass of random data already defeats ordinary recovery, and the stronger methods exist for stricter policies, not for stronger physics.

The distinction matters most for the drive you are about to sell. A buyer who runs recovery software on a merely deleted drive will find your documents, photos, browser profiles, and saved passwords.

A buyer who runs the same software on a properly wiped drive finds nothing but the wipe pattern. That is the difference between deleting and erasing, and it is the only distinction in this guide that you cannot afford to get wrong.

Back Up First: Save What You Want to Keep

Wiping is irreversible, so when you wipe hard drive before selling it, copy anything you want to keep first. Photos, documents, browser bookmarks, SSH keys, and license files all live on the drive you are about to erase, and no wipe method has an undo button. Make the backup, open it on another machine, and confirm the files actually open before you touch Nwipe.

Our rsync beginner guide shows how to copy a home directory to another disk or machine with one command. Rsync is the right tool here because it copies only what changed, shows you what it did, and can resume an interrupted copy. Copy the data, verify the copy, and only then boot the wipe media.

Do not skip the verification step, because a backup you never opened is a hope, not a backup. Open a few files from the copy, check that the photo folders have the file counts you expect, and confirm your most important document opens cleanly. Once the wipe starts, the originals are gone, and the only copy that matters is the one you already checked.

Get Nwipe: ShredOS or a Linux Install

You can run Nwipe two ways, and the right one depends on whether the drive you want to wipe holds the operating system you are running. ShredOS is the route for wiping a machine's own internal drive, because it boots from a USB stick and leaves every internal disk free to erase. Installing Nwipe on a running Linux system is the route for wiping a second drive while the system keeps running.

The latest ShredOS release is v2025.11_32_x86-64_0.43.1, published on 11 October 2026, which makes it 26 days old on 6 November 2026. It is built on Buildroot 2025.11 with Linux kernel 6.18.0 and bundles Nwipe 0.43.1. Download the image from the ShredOS project's GitHub releases page, then write it to a USB stick with Rufus on Windows or the dd command on Linux or macOS.

On Linux, the write command is sudo dd if=shredos.img of=/dev/sdX bs=4M status=progress conv=fsync, where /dev/sdX is the whole USB device, not a partition. Check the device name with lsblk first, because writing the image to the wrong device destroys whatever was on it. On Windows, open Rufus, select the ISO file, pick a GPT partition scheme for a modern machine, and press Start.

If you already run Linux and only need to wipe a spare drive, install Nwipe from your distribution's repositories instead. On Debian or Ubuntu, run sudo apt install nwipe, and on Fedora or Red Hat Enterprise Linux, run sudo dnf install nwipe. Do not assume the repository version is the newest one: Debian trixie ships Nwipe 0.38, so a distro install can lag several releases behind the ShredOS image.

The install commands below assume a normal Linux shell, and if you are more comfortable with containers than with a bare Linux install, our Docker beginner guide teaches the shell habits this guide relies on. Our Ubuntu beginner guide covers the distribution most readers will install Nwipe on.

Boot ShredOS and Open Nwipe in 7 Steps

Only erase drives you own or are authorised to erase, and double-check the device name with lsblk before you start, because wiping is irreversible. The ShredOS path takes about ten minutes of setup and then runs unattended, so treat the seven steps below as a checklist rather than a race.

1. Download the latest ShredOS image from the project's GitHub releases page and verify its checksum.
2. Write the image to a USB stick with Rufus on Windows or dd on Linux or macOS.
3. Plug the USB stick into the target machine, restart it, and open the boot menu to boot from USB.
4. If the machine refuses to boot, disable Secure Boot in the BIOS or UEFI settings, then try again.
5. Wait a minute or two for ShredOS to load, and Nwipe opens its text interface automatically.
6. Use the arrow keys to highlight the target drive and press Space to select it.
7. Press M to choose a wipe method, then press Shift+S to start the wipe.

ShredOS lists every detected drive when it loads, and the interface shows the device path, model, and size for each one. Read the size column before you select anything, because two drives of the same model look identical until you check their capacities. Pressing Alt-F1 returns to the Nwipe interface and Alt-F2 opens a shell, which is where you run lsblk if you want a second opinion on which device is which.

ShredOS works best with Secure Boot disabled, so switch it off before you boot and switch it back on when the wipe is done. The distribution supports BIOS and UEFI machines, Intel-based Macs, and both 32-bit and 64-bit builds. Its standard image is interactive, which means it never starts erasing disks on its own when it boots.

Choose a Wipe Method: Which One Fits Your Drive?

The wipe method decides what Nwipe writes to each sector and how many passes it makes. Nwipe ships twelve methods, and the choice is simpler than the list looks: most drives need the default or the three-pass DoD Short, and the exotic methods exist for compliance paperwork, not for extra safety on a home drive.

For most hard drives, one overwrite pass is enough: summaries of NIST SP 800-88 Rev. 2 note that the standard retired the old multi-pass mandates, and Gutmann's 35 passes are a legacy method for obsolete drive encodings, not a modern requirement. A 35-pass Gutmann wipe writes 35 times as much data as a single pass of the same drive, and a seven-pass DoD full wipe writes seven times as much, so the extra passes cost real hours for no measurable gain on a modern hard drive.

The version you run decides the default method, so check it before you trust a tutorial. In Nwipe 0.43, the man page lists the default method as prng, a single pass of random data.

In the older 0.38 builds that Debian and Ubuntu ship, the default is dodshort, the three-pass DoD short method. Both defaults are sensible, and the difference is a version detail, not a disagreement about safety.

Pick the method in the interface by pressing M, or pass it on the command line with -m or --method, as in sudo nwipe --method=zero --verify=last /dev/sdX. The --rounds option repeats the whole method, so --rounds=2 with dodshort runs six passes in total. One round is the default, and one round is what most wipes need.

Choose a PRNG: The Randomness Behind the Wipe

When a wipe method needs random data, Nwipe gets it from a pseudorandom number generator, and the choice of generator affects speed more than safety. The default setting is auto, which benchmarks every available generator at startup and picks the fastest one for your hardware. You can leave it alone and still get a correct wipe.

All generators are seeded from the Linux getrandom system call, so the random stream starts from real operating-system entropy. If you are curious which generator is fastest on your machine, run nwipe --prng-benchmark, which performs a RAM-only throughput test and prints a sorted leaderboard in megabytes per second without wiping anything. The --prng-bench-seconds option controls how many seconds each generator gets during the benchmark, and the default is one second.

Set a generator explicitly with -p or --prng, as in sudo nwipe --prng=chacha20 /dev/sdX. The manual option disables auto-selection and uses the built-in default choice instead, which is a CPU-based heuristic with no benchmarking. For a one-off wipe before a sale, the auto default is the right call, and the manual options exist for repeatable lab setups and slow hardware.

Start the Wipe: Keys, Progress, and Verification

Once the drive and method are set, press F10 in the interactive interface to begin. Nwipe shows a progress bar per drive, the current pass, the throughput, and the estimated time remaining, and it keeps wiping until every pass and the verification step are done. The interface also shows drive temperature and SMART data when the supporting tools are installed.

Verification is on by default, and it is the step that turns an overwrite into a wipe you can trust. The --verify option takes three values: off skips verification, last verifies only the final pass, and all verifies every pass. Last is the default, and it is the right balance: it catches a drive that silently failed to write, without doubling the runtime the way verifying every pass would.

Two flags control how Nwipe talks to the disk, and both have sensible defaults. The --io-mode option picks auto, cached, or direct I/O, and auto is the default.

The --sync option controls how often Nwipe calls fdatasync during cached I/O, with a default of 100000 blocks, which works out to roughly every 50 to 400 megabytes. Setting --sync=0 waits until the end of the pass before syncing, which the man page does not advise, because an error may only appear at the very end and make the tool look frozen.

A wipe takes as long as the drive and the method demand, and no honest guide can give you a single number. Passes multiply the work, the drive's write speed sets the floor, and a large drive with a multi-pass method is an overnight job. One user reported that DoD Short, the three-pass method, took 12 hours on a 2 TB hard drive, and that experience is typical enough to plan around: start the wipe in the evening and collect the certificate in the morning.

Wipe Many Drives at Once With Nwipe Autonuke

Nwipe autonuke is the batch mode, and it exists for the afternoon when a whole shelf of retired drives needs wiping. Run sudo nwipe --autonuke and Nwipe starts wiping every detected drive immediately, with no confirmation prompt and no interface to click through. Add device paths to limit the batch, as in sudo nwipe --autonuke /dev/sdX /dev/sdY, and only those drives are wiped.

Autonuke with no device arguments wipes every detected drive immediately, with no confirmation prompt, so treat it as a loaded command and not a casual one. Exclude a drive you want to keep with --exclude, which takes up to ten comma-separated devices, as in sudo nwipe --autonuke --exclude=/dev/sdc,/dev/sdd. USB drives are included by default, so add --nousb when the boot stick itself must survive the batch.

Two companion flags make batch wiping practical. The --autopoweroff flag powers the machine off one minute after the wipe finishes, and you can cancel the shutdown with sudo shutdown -c during that minute. The --nogui flag runs autonuke without any interface, and it can only be used together with autonuke; the --nowait behaviour comes along automatically, and you can watch progress by sending the SIGUSR1 signal to log the current wipe statistics.

Batch mode is also how a small team decommissions a rack of machines, and if you are retiring whole machines from a cluster, our Kubernetes beginner guide covers the orchestration side while Nwipe handles the disks. The --force flag deserves a warning of its own: it lets Nwipe wipe devices the system considers in use, such as mounted drives, and it is disabled by default for good reason. Never combine --force with --autonuke unless you have already checked every mounted device twice.

The Nwipe PDF Certificate: Proof the Drive Is Clean

When a wipe finishes, Nwipe writes a PDF certificate that records what was erased, how, and when. The certificate comes in two forms: a single-drive PDF for one disk, and a system-focused PDF that covers a whole machine. The document is three pages long, carries SMART data from the drive, and in version 0.43 it adds a speed-profile page with a temperature graph plus expanded SMART data from smartctl -x, including total bytes written and read, power cycles, and self-test logs.

The certificate is the reason many people choose Nwipe over a bare dd command. A buyer, an auditor, or an IT asset-disposal team can read the method, the pass count, the verification result, and the drive serial number from one document. Keep it with the sales receipt or the disposal record, and the drive's history is closed in a way a verbal promise never is.

Control the output with the -P or --PDFreportpath option, which takes the directory for the reports and defaults to the current directory. Pass noPDF as the directory to disable PDF output entirely.

The --pdftag option adds a field that identifies the host computer, and --pdfduplex inserts intentionally blank pages between sections for double-sided printing. The -q or --quiet option anonymises serial numbers in the interface and logs, which is useful when the certificate will be shared and the serial numbers should not travel with it.

The certificate is only as complete as the tools installed alongside Nwipe. The smartmontools and hdparm packages are mandatory if you want the full SMART data in the certificate, and hdparm is required at runtime.

The dmidecode and coreutils packages are optional but strongly recommended, and version 0.42 added support for a user-supplied logo.jpg on the certificates. If your certificate comes out thin, the missing package is the usual cause.

SSDs and NVMe Drives: The One Big Exception

Everything above assumes a spinning hard drive, and solid-state drives break the assumption. Software overwriting cannot guarantee erasure on an SSD, because wear levelling and over-provisioning leave data in cells the operating system cannot reach. The drive's controller decides where each write lands, and it may write your overwrite pattern to entirely different physical cells while the original data sits intact in spare blocks.

NIST SP 800-88 Rev. 2, published on 26 September 2025, states the position plainly: multi-pass overwrites on overprovisioned SSDs give very little confidentiality protection, and the standard points to sanitise commands or cryptographic erase for its Purge level. A 2011 study from UC San Diego measured the problem directly: after common sanitisation methods, between 4 percent and 75 percent of a file's contents remained on the SATA SSDs tested. The study is old hardware, but the mechanism it measured is still how flash controllers work.

Nwipe 0.43 answers the problem inside the tool itself, with native support for hardware-level Sanitise commands. The Hardware Sanitize feature offers three modes: Block Erase, which tells the controller to erase all blocks on the flash media; Cryptographic Erase, which deletes the media encryption key on self-encrypting drives; and Sanitize Overwrite, which tells the drive to overwrite all addressable and non-addressable areas.

Hardware Sanitize is GUI-only in v0.43, and it cannot be batched with autonuke, so each drive must be sanitised by hand through the interface. The release does not support the older ATA Secure Erase firmware commands, and the next release, 0.44, is planned to integrate Sanitize as a regular wipe method.

Hardware Sanitize covers SATA SSDs and hard drives made after 2012 and NVMe SSDs made after 2017, while enterprise SAS support is planned and untested. The project's own guidance is to sanitise the device first and then follow up with at least one full regular PRNG wipe, both from the GUI.

If the drive cannot be sanitised at all, use the drive vendor's firmware tool, and if that is unavailable, physical destruction is the honest answer. Never sell an SSD on the strength of a multi-pass overwrite alone.

Nwipe vs DBAN: The Retired Predecessor

Nwipe is the maintained replacement for Darik's Boot and Nuke, and the comparison is short because one side stopped moving. DBAN's last release, version 2.3.0, came out on 4 June 2015, and development has ended. That was 4,173 days ago, and the project's official website now markets a commercial eraser instead.

DBAN was built for the hard drives of its era, and it shows its age on modern hardware. It cannot wipe SSDs, because it has no ATA Secure Erase or NVMe Sanitize support, and overwriting does not reach all NAND cells.

It has no software updates, no hardware support for new controllers, and no certificate of erasure. Its last release predates NVMe drives becoming common, and every year since has widened the gap.

Nwipe is the dban alternative that carries the DBAN dwipe engine forward with modern hardware support, parallel multi-drive wiping, a maintained codebase, and the PDF certificate. The numbers below are the arithmetic behind this guide, computed from the verified dates and pass counts in the sources, and they show how far the two projects have drifted apart.

from datetime import date
today = date(2026, 11, 6)
dban_last = date(2015, 6, 4)       # DBAN 2.3.0
nwipe_v043 = date(2026, 10, 2)     # Nwipe v0.43
shredos_latest = date(2026, 10, 11)
repo_created = date(2013, 9, 6)
first_release = date(2014, 10, 20)  # Nwipe v0.17
print("DBAN last release to today (days):", (today - dban_last).days)
print("Nwipe v0.43 age (days):", (today - nwipe_v043).days)
print("ShredOS latest release age (days):", (today - shredos_latest).days)
print("Nwipe repo age (days):", (today - repo_created).days)
print("First release v0.17 age (days):", (today - first_release).days)
print("Gutmann writes vs one pass:", 35, "x")
print("DoD full writes vs one pass:", 7, "x")
print("DoD short writes vs one pass:", 3, "x")
print("Gutmann passes vs DoD short:", round(35 / 3, 1), "x")
print("GitHub stars per fork:", round(1246 / 129, 1))
# DBAN last release to today (days): 4173
# Nwipe v0.43 age (days): 35
# ShredOS latest release age (days): 26
# Nwipe repo age (days): 4809
# First release v0.17 age (days): 4400
# Gutmann writes vs one pass: 35 x
# DoD full writes vs one pass: 7 x
# DoD short writes vs one pass: 3 x
# Gutmann passes vs DoD short: 11.7 x
# GitHub stars per fork: 9.7

The choice for a drive you are selling today is therefore simple: use Nwipe, and use a current version of it. A DBAN tutorial from 2015 still circulates in search results, and it will still boot on old hardware, but it wipes with a dead tool that cannot handle the drive in a modern laptop. ShredOS with Nwipe 0.43 is the maintained path, and it is the one this guide teaches.

Sources

Nwipe on GitHub, martijnvanbrummelen/nwipe, 1,246 stars, 129 forks, GPL-2.0, created 6 September 2013, github.com/martijnvanbrummelen/nwipe.

Nwipe man page, version 0.43, October 2026, mankier.com/8/nwipe.

Nwipe CHANGELOG, version 0.43 release notes, Hardware Sanitize and PDF temperature graph, raw.githubusercontent.com/martijnvanbrummelen/nwipe/master/CHANGELOG.md.

Nwipe, Wikipedia, stable release v0.43, 2 October 2026, first release v0.17, 20 October 2014, en.wikipedia.org/wiki/Nwipe.

Darik's Boot and Nuke, Wikipedia, version 2.3.0, 4 June 2015, development ended, en.wikipedia.org/wiki/Darik%27s_Boot_and_Nuke.

XDA Developers, DBAN is a relic for HDD wiping, and ShredOS is the only software you should use, 14 March 2026, xda-developers.com/dban-is-a-relic-for-hdd-wiping-shredos-is-the-software-you-should-use.

The Linux Vault, How to Implement Secure Data Wiping in Linux, thelinuxvault.net/linux-io-storage-management/how-to-implement-secure-data-wiping-in-linux.

sekin.in, 5 Free Programs to Completely Wipe a Hard Drive, sekin.in/5-free-programs-to-completely-wipe-a-hard-drive.

FOSS Linux, How to Securely Wipe USB Drive and SD Card on Ubuntu, fosslinux.com/35430/how-to-secure-wipe-usb-drive-sd-card-on-ubuntu.

Safeguard, Deep Clean and Secure Delete on Linux, NIST SP 800-88 Rev. 2, safeguard.sh/resources/blog/deep-clean-and-secure-delete-on-linux.

ShredOS release v2025.11_32_x86-64_0.43.1, published 11 October 2026, Buildroot 2025.11, kernel 6.18.0, newreleases.io/project/github/PartialVolume/shredos.x86_64/release/v2025.11_32_x86-64_0.43.1.

DeepWiki, Nwipe command-line reference, deepwiki.com/martijnvanbrummelen/nwipe/2.2-command-line-reference.

ITAMG, NIST 800-88 Media Sanitization Guidelines, Rev. 2 published 26 September 2025, itamg.com/itad-guides/nist-800-88-media-sanitization-guidelines.

Frequently Asked Questions

Can I use Nwipe on an SSD?

Yes, but use the right mode for the drive: Nwipe 0.43 adds a Hardware Sanitize menu in the GUI with Block Erase, Cryptographic Erase, and Sanitize Overwrite, and those commands reach the flash cells that overwriting cannot. Sanitise first, then follow up with one regular PRNG wipe from the same interface.

How long does Nwipe take to wipe a drive?

There is no fixed figure, because the time depends on the drive's size and write speed, the method, and the pass count. One user reported that DoD Short took 12 hours on a 2 TB hard drive, so plan an overnight run for a large drive with a multi-pass method and collect the certificate in the morning.

Is Nwipe free?

Yes, Nwipe is free and open-source software under the GNU General Public License version 2.0, and ShredOS is free as well. There is no paid tier, no trial, and no account, and the source code is public on GitHub.

Does Nwipe work on NVMe drives?

Yes, Nwipe accepts NVMe device paths such as /dev/nvme0n1 alongside SATA paths such as /dev/sda. Hardware Sanitize supports NVMe drives made after 2017, and a regular overwrite wipe works on any NVMe drive the system can see.

What is the difference between Nwipe and DBAN?

Nwipe is the maintained fork of DBAN's dwipe engine, rebuilt to run on any Linux distribution with modern hardware support. DBAN's last release came in 2015 and its development has ended, while Nwipe is actively maintained, wipes drives in parallel, supports NVMe and hardware sanitise commands, and writes a PDF certificate for every wipe.