Frequently asked questions

Is tScrub NIST 800-88 certified?

tScrub maps its wipe methods to NIST 800-88 Clear, Purge, and Destroy outcomes, but it is not itself a certification. Compliance certification is typically issued by an accredited body for your specific process.

How does tScrub support UK GDPR?

Verifiable erasure with a chain-of-custody report supports the UK GDPR right to erasure, giving you documented evidence that data has been erased.

Is there a standalone download?

No. tScrub ships only inside the bootable appliance image (ISO or bzImage) — there is no separate script or installer to download. Boot the ready-to-go image from USB or PXE on hardware you already own — no vendor hardware required.

Which drive types are supported?

NVMe (crypto, block, and overwrite sanitize plus format), SATA/ATA (enhanced and standard security erase), and SCSI/SAS (firmware sanitise overwrite where supported, otherwise a software overwrite). Before wiping, tScrub removes hidden HPA/DCO areas so the full native capacity is sanitised, and after the wipe it verifies the result by reading back sample sectors. USB-attached drives are erased too, by software overwrite: the report records Bus=USB and never claims a firmware erase or an IEEE 2883 method over a USB bridge, and the appliance's own boot stick is protected and can never be selected as a target.

Do I need an internet connection?

No. tScrub runs fully offline. Copy the report files off the appliance by USB and upload them in the dashboard, or configure an optional FTP/SFTP upload — ideal for air-gapped decommission labs.

What if a drive can't be wiped?

Frozen drives are flagged FROZEN for physical destruction; Block SID-locked drives get a BLOCKED status (recoverable — clear the SID and re-run); anything that fails is recorded NOT SANITISED — so every outcome is documented in the chain of custody.

What if the laptop won't boot at all — can I still erase its drive?

Yes. Pull the drive and erase it on a bench machine under the same Chain of Custody ID, then record on the media item which device it came from. The dashboard refuses a device serial it has never seen and offers to add it to Devices as a declared device in the same step, so a machine that never booted is still named on the certificate. The erase is instrument-verified where it ran, the origin is labelled declared by operator, and the certificate states both the device and the bench that sanitised its media. The full procedure is in the docs.

How long does a wipe take?

It depends on the drive and the method. A crypto erase finishes in seconds, a block erase in minutes, and a firmware sanitise on an old drive can legitimately run for hours (the drive itself reports the time). The console shows the live percentage and a time remaining, computed as it runs. Software overwrite scales with capacity, which is why the firmware erase is used whenever the drive supports one.

What happens if the power is cut mid-wipe?

tScrub writes a durable abort record the moment a run ends without completing: the journal records that the run ended before any certificate was written, with each drive's status and progress, and the note that the drive may be part-erased and must be re-run to be certified. A drive is only ever recorded COMPLETED when its erase actually finished. If an interrupted NVMe sanitize left the controller mid-erase, the next run detects it, waits for it to clear, and then issues its own wipe, so the report only ever claims what that run actually did.

What about servers with RAID arrays?

tScrub detects RAID members (Linux md superblocks, Intel VMD/RST RAID mode, and RAID-capable HBAs) and flags them, but it never deletes a logical drive or breaks an array. Dismantle the array in the controller BIOS, then erase each member drive individually: every drive gets its own row, its own wipe result, and a RAID flag in the report, so the audit trail shows exactly which physical disks were erased.

How do I know the download is genuine?

Every release publishes its SHA-256 checksum next to the download, and the same values are listed in the manifest at /downloads/manifest.json. Verify the checksum before writing the image to a stick; the docs walk through the command.

How do you verify a wipe when a drive has bad sectors or its firmware reports success even though some data may remain?

Before each wipe, tScrub writes a unique per-run sentinel pattern into fixed positions across the drive (first sector, 25%, 50%, 75%, last) and reads those positions back from the media after the erase claims success. A drive whose firmware reported success but left data behind is recorded FAILED, not completed. This has caught a real drive whose PSID revert reported success without actually re-keying the media.

Bad sectors can't fake a pass: a sector that can't be read back is recorded UNREADABLE, never passed, and the report records the drive's reallocated-sector count before and after. Firmware purges erase reallocated sectors as part of the purge, and tScrub removes hidden HPA/DCO areas first. Stronger evidence is available on request: a full read-back of every sector, or a sampled percentage after a software overwrite. Where a crypto erase makes a content read-back meaningless, tScrub records that exemption rather than printing a pass that proves nothing. See Verifying the erase, and hidden areas for the detail.

How do I know the report's drive is the drive I gave you?

tScrub reads the serial from the drive itself, not from a label, and every report row carries that serial, the method, and the result for that physical drive, tied together by the report's hash. The dashboard refuses a serial it has never seen and asks you to record it as a declared device, so a typo cannot become a certificate line. When media is erased on a bench machine instead of its own chassis, the report says so: the origin device is recorded and labelled, and the certificate names both the device and the host that sanitised its media.

Is tScrub only for erasing drives?

No. One boot captures the machine's full hardware profile — display panel, battery health and capacity, CPU spec, memory modules, storage, and firmware — along with Windows Autopilot MDM and BIOS lock status. You get a printable two-page ITAD diagnostics report per machine, plus the chain-of-custody erasure report.

Can tScrub tell me if a laptop is MDM-locked?

Yes. A device's hardware hash is captured when it submits its diagnostics, and you run the Windows Autopilot check from its page in the dashboard for a Locked/Unlocked MDM verdict. It sits alongside BIOS password lock detection — so a locked laptop is flagged before it goes to a buyer, and BIOS unlocks can be dispatched remotely.

What does the diagnostics report show?

A machine summary (system and board serials, BIOS, TPM, Secure Boot, CPU, RAM, display, battery) and a storage inventory (per-drive firmware, sector size, SMART health, self-test result, reallocated sectors). Each device snapshot renders as a printable PDF from the Devices tab.

Do I need a licence to run tScrub?

Yes — every tScrub build requires a licence, even the free tier. Sign in and issue one from your dashboard; free licences are instant.

What's the difference between a free and a paid licence?

Both erase drives the same way. Every report is signed with Ed25519: free licences self-sign with an appliance-generated key (tamper-evident, not attributable), while paid licences embed a vendor-signed report key, so reports are verified against that key and attributable to the licence (the licence itself verifies against the tScrub vendor key). Certificates are available on every tier and every one carries a verification QR code; paid licences add a digitally signed PDF. Every certificate also ships as a signed, machine-readable JSON-LD document (add &format=jsonld to the verification link) so automated auditors can verify it without opening the PDF.

How do I get my reports into the dashboard?

Upload the report files on the Reports page of your dashboard, then generate a Certificate of Destruction from the Certificates page. Per-drive and pre/post-wipe SMART data is shown on the Reports page.