Documentation

1. Quick start

New to tScrub? Start with the Getting started guide — account → licence → boot → report → certificate.

1. Boot the tScrub appliance image from USB or PXE and run it.
2. Enter a 5-digit Chain of Custody ID (COCID) when prompted.
3. tScrub discovers every drive and maps it to its strongest wipe capability.
4. Watch live progress; each drive ends with a status (COMPLETED, FROZEN, BLOCKED, or FAILED).
5. Collect the report files, which are written to the report directory.

2. System requirements

• x86-64 machine with USB or PXE boot
• 1 GB RAM (erasure runs in parallel)
• Dependencies are bundled in the appliance image: nvme-cli, hdparm, nwipe (SCSI), smartctl (SMART), lftp (upload), openssl (signing)
• Drives must not be in use by the host OS

3. Download the appliance

tScrub ships ready to boot — there is nothing to compile. Download the appliance from the Download page (no account needed), then sign in and issue your licence from the Licences page:

• The appliance ISO — a hybrid ISO that boots on BIOS and UEFI, with sedutil-cli, curl, lftp and the report tooling built in.
• A .lic file — every appliance needs one (the free tier is included).

tScrub is a single self-contained script embedded in the image (at /usr/bin/tscrub.sh). Security teams can extract it from the ISO to audit it line by line.

4. Run a sanitisation job

tscrub                      # full run (wipes all supported drives)
tscrub --dry-run            # discover and classify, wipe nothing
tscrub --output /mnt/usb    # write the report to /mnt/usb
tscrub --dry-run --simulate-running-eta=10   # simulated run with live progress

tScrub prompts for a COCID, then wipes all supported drives in parallel. Frozen, locked, or blocked drives are flagged rather than marked clean.

Boot the appliance from USB

The appliance download is a hybrid ISO (boots on both BIOS and UEFI, ~150 MB). Always verify its SHA-256 against the .sha256 file published next to it before writing it to a stick.

Secure Boot supported: the appliance boots with UEFI Secure Boot on, via a signed shim + MOK chain. On the first boot on a machine, shim opens MokManager — choose Enroll MOK → Continue → Yes, then reboot. After that it boots normally. (You can also simply disable Secure Boot or enable CSM/Legacy boot.)

diskutil list                          # identify your stick, e.g. /dev/disk2
diskutil unmountDisk /dev/disk2
sudo dd if=<downloaded-iso> of=/dev/rdisk2 bs=4m && sync

lsblk                                   # identify the stick, e.g. /dev/sdX
sudo dd if=<downloaded-iso> of=/dev/sdX bs=4M status=progress && sync
# equivalent: sudo cp <downloaded-iso> /dev/sdX && sync

Boot over the network (PXE)

The appliance kernel is self-contained (its initramfs is embedded, gzip-compressed, inside bzImage), so PXE needs only the kernel file plus a standard DHCP → TFTP → iPXE chain. This is the same two-stage HTTP-boot pattern used to netboot ShredOS (see the tadvaas/pxe reference setup).

• DHCP — set next-server and boot filename: undionly.kpxe (legacy BIOS) or ipxe.efi / snp.efi (UEFI; use snp.efi if an HP or multi-NIC system picks the wrong adapter).
• TFTP (tftpd-hpa) — serves the iPXE firmware only.
• HTTP (nginx) — serves bzImage (extracted from the ISO).

#!ipxe
:tscrub
dhcp
kernel ${base-url}/tscrub/bzImage console=tty3 loglevel=3
tscrub_api_token=YOUR-64-HEX-TOKEN
boot

There is no initrd line — the initramfs is inside bzImage. Append any tScrub kernel parameters (report destination, licence) directly to the kernel line. The licence can be served over the LAN too: tscrub_license_url=http://pxe-host/tscrub/license.key.

Getting the kernel (bzImage)

bzImage is inside the appliance ISO at /boot/bzImage (shown as /BOOT/BZIMAGE in some listings). Extract it on any OS, then put it on your HTTP server.

# mount the ISO, then copy the kernel out
hdiutil attach <downloaded-iso>
cp /Volumes/TSCRUB/boot/bzImage ./bzImage
hdiutil detach /Volumes/TSCRUB

# or extract without mounting (bsdtar ships with macOS)
bsdtar -xOf <downloaded-iso> boot/bzImage > bzImage

# from the ISO, without mounting (note the ";1" Rock Ridge version suffix)
isoinfo -x /BOOT/BZIMAGE.;1 -i <downloaded-iso> > bzImage

# or mount it and copy
mkdir -p /mnt/iso && mount -o loop,ro <downloaded-iso> /mnt/iso
cp /mnt/iso/boot/bzImage /srv/pxe/tscrub/bzImage
umount /mnt/iso

Place bzImage on your HTTP server (e.g. nginx /srv/pxe/tscrub/bzImage) and point ${base-url} at it in boot.ipxe.

Report destinations (USB · FTP · dashboard)

Where the report lands is chosen at boot time, on the kernel command line (the same place for every boot method). You can combine them — tScrub writes locally first, then uploads.

Preconfigure with a tscrub.conf file

You don't have to edit GRUB or the kernel command line — drop a tscrub.conf on the stick (next to your .lic) and tScrub reads it at boot:

tscrub_api_token=YOUR-64-HEX-TOKEN
tscrub_cocid=12345
tscrub_license_url=http://192.168.1.10/license.key
tscrub_output=ftp:backup.example.com:incoming/tscrub:itad:s3cret

Keys mirror the kernel parameters: tscrub_api_token pushes reports to your dashboard, tscrub_cocid enables unattended runs (no prompt), tscrub_license_url fetches the licence over the LAN, and tscrub_output points reports at a local path or an ftp: / sftp: server. Command-line flags always take precedence. Editing the GRUB entry on the stick also works when the boot partition is writable (Rufus ISO mode or Ventoy), but tscrub.conf works however you wrote the stick.

Full details and examples are in section 5, Getting reports off the appliance.

5. The report

Each job produces a CSV report plus a JSON manifest; a signature sidecar is written whenever OpenSSL is available (always, on the appliance image):

tScrub_48213_20260912T103000Z.csv    # human-readable report (one row per drive)
tScrub_48213_20260912T103000Z.json   # manifest (SHA-256, public key, drive summary)
tScrub_48213_20260912T103000Z.sig    # base64 Ed25519 signature (vendor key on paid, appliance key on free)

The CSV columns are: COCID, Timestamp, Model, Serial, Size, Bus, Type, Device, Class, Certification, Method, FinalStatus, SMART, TempC, PowerOnHours, PowerCycles, ReallocSectors, PctUsed, AvailSpare, TBW_TB, SMARTPOST, TempCPost, PowerOnHoursPost, System, SystemSerial, BaseboardSerial, CPU, GPU, RAM — the machine's make, serials, processors, graphics, and memory are repeated on every drive row.

Getting reports off the appliance

At the end of a run tScrub writes the report files locally, then optionally uploads them. Everything is configured at boot time on the kernel command line (PXE, GRUB, or the appliance boot entry) — not inside the script.

Where the report is written — tScrub saves to the same volume it found your .lic on (with dd/Etcher that's the TSCRUB-USB partition; with Rufus ISO mode it's the single writable partition), then falls back to a FAT/exFAT scan, then RAM. Reports are grouped under reports/<COCID>/, and the partition is synced and unmounted before reboot so nothing is lost on power-off. Override the location with tscrub_output=:

tscrub_output=/mnt/usb

Layout on the stick:

reports/
└── 11111/
    ├── tScrub_11111_20260922T161328Z.csv
    ├── tScrub_11111_20260922T161328Z.json
    └── tScrub_11111_20260922T161328Z.csv.sig

Push to the dashboard (network) — send the report straight to your tScrub account. The token comes from the Licences page of your dashboard. The appliance image ships curl and a CA-certificate bundle, so this works out of the box:

tscrub_api_token=YOUR-64-HEX-TOKEN

Upload via FTP or SFTP — upload the report files to an FTP or SFTP server. Both run over lftp, which is built into the appliance image:

tscrub_output=ftp:host:path:user:password
# e.g. tscrub_output=ftp:backup.example.com:incoming/tscrub:itad:s3cret
# SFTP (encrypted):
tscrub_output=sftp:backup.example.com:incoming/tscrub:itad:s3cret

ftp or sftp is the protocol. host is the server, path is the remote directory (relative to the user's home, no leading slash), then the username and password.

The password must not contain spaces, and credentials are visible in the boot configuration — use a dedicated upload account.

6. Verify a report

Anyone can verify that a report is unchanged and, where licensed, attributable:

tscrub verify tScrub_48213_20260912T103000Z.csv
SHA-256: 4614d837...
Manifest: OK
Signature: VALID

You can pass a public key explicitly: tscrub verify report.csv public-key.pem. A tampered report fails with MISMATCH or INVALID. A report with no signature (no OpenSSL available) shows Signature: none (checksum only).

The official tScrub vendor public key fingerprint (for audit reference):

be81586c42b5fb2451f7691782c08376c2038d277e79710ff45294409b476c02

7. Certificate of Destruction

Turn one or more tScrub reports into a single, printable Certificate of Destruction. Upload the .csv files (and, if you have them, the matching .json and .csv.sig sidecars) on the dashboard Reports page, then select the Chain of Custody ID on the Certificates page to generate a consolidated certificate.

What happens when you upload

1. Each .csv is hashed (SHA-256) and, when a manifest is present, checked against its recorded checksum.
2. Where a report is signed, the Ed25519 signature is verified against the key embedded in the manifest.
3. Drives from every report with the same COCID are merged into a single certificate, sorted by wipe time.
4. A tamper-evident PDF is generated with a unique Certificate ID, a device annex (Annex A), a pre/post-wipe SMART annex (Annex B, when the report includes it), and a verification QR code. Signed (paid) certificates also carry a digital signature.

Verifying a certificate online

Each certificate carries a unique Certificate ID (COD-…). Scanning the QR code — or visiting tscrub.com/verify?cert=COD-… — looks up the issuance record and confirms:

• the Certificate ID, Chain of Custody ID, and sanitisation window;
• device, method, and run counts;
• the integrity and signature status recorded at issuance;
• a SHA-256 hash of the PDF itself, so the document can be checked for alteration since issue.

8. Licensing

Licences are self-serve: sign in at tscrub.com and issue one from the Licences page of your dashboard. You'll receive a .lic JSON file. Free licences carry no report key, so the appliance self-signs reports with its own generated key (tamper-evident, not attributable); paid licences embed a vendor-signed report key, so the appliance signs reports with that key, the licence verifies against the tScrub vendor key, and uploaded reports are matched back to that key so they are attributable.

Attaching a licence

The appliance looks for a licence on the boot USB first — drop your .lic at the root of the stick (as license.key or any *.lic) and it is picked up automatically. Failing that it falls back to /etc/tscrub/license.key, or you can point at it explicitly with --license:

mkdir -p /etc/tscrub && cp "Acme-ITAD-Ltd-2027-09-12.lic" /etc/tscrub/license.key
tscrub --license /path/to/Acme-ITAD-Ltd-2027-09-12.lic

For appliance / PXE boots, set the licence path on the kernel command line:

tscrub_license=/etc/tscrub/license.key

The licence can also be fetched over the local network instead of a filesystem path. Use --license-url when running directly, or the URL form of the kernel parameter for appliance/PXE boots:

tscrub --license-url http://192.168.1.10/license.key
tscrub_license_url=http://192.168.1.10/license.key

Fetching requires curl or wget on the appliance. Because a .lic contains the private report-signing key, host it on an authenticated or isolated LAN endpoint — not a public URL.

Every appliance requires a valid licence — even the free tier. Without one, tScrub exits with an error.

Vendor public key (published for audit verification):

-----BEGIN PUBLIC KEY-----
MCowBQYDK2VwAyEAbBDdsD4wQh7aoBRe890V8LcTOZNe6n6Cvh0AkrBA4B4=
-----END PUBLIC KEY-----

Fingerprint: be81586c42b5fb2451f7691782c08376c2038d277e79710ff45294409b476c02

Release & key history

Each release is checksummed and signed; the signing key is recorded so older downloads and licences stay verifiable. Reports themselves verify against their own embedded key, so they never depend on this history.

When the vendor key is rotated, the old public key is listed here (never deleted) so licences and releases signed by it remain verifiable.

9. Supported media

10. Kernel parameters & boot configuration

Everything tScrub needs at boot is set on the kernel command line; these parameters are read from /proc/cmdline at startup.

Defaults: the licence is read from the boot USB (a license.key or *.lic at the stick's root), then /etc/tscrub/license.key, unless tscrub_license= / tscrub_license_url= is set; the report is written to the first writable FAT32 partition (the boot stick), then RAM, unless tscrub_output= overrides it.

Where to set them

The kernel command line is supplied by the bootloader, so how you set it depends on how you boot:

• USB (persistent) — the boot partition is a writable FAT32 volume, so after writing the image you can edit /boot/grub/grub.cfg (BIOS) or /EFI/BOOT/grub.cfg (UEFI) on the stick, appending your parameters to the linux line.
• USB (one-off) — edit the entry at boot instead: highlight it, press e, append your parameters after console=tty3 loglevel=3, then press Ctrl+X. This affects that boot only.
• PXE (best for fleets) — put the parameters on the kernel line of your boot.ipxe (see Boot over the network).

Command-line flags

The same settings can be passed as flags when you run tscrub directly (for example on the appliance console). There is also a verify subcommand for checking reports offline.