Tag :: Secure Erase

Prior to 4.32.2F, the “reset system storage secure” CLI command can be used to perform a best-effort storage device wipe of all sensitive data. However, this command has the limitation that it wipes EOS from the storage device, leaving the system “stuck” in Aboot. The “reset system storage secure rollback” command provides the same secure erase functionality, but additionally allows the user to preserve a subset of files on the main flash device by copying them into RAM during the secure erase procedure. The set of files that are preserved is configurable. After a successful wipe, the system will return to EOS after the erase is complete if the EOS SWI image and adequate configuration files are preserved (such as boot-config and startup-config).

A secure erase is generally defined as a command (or set of commands) that deliberately, permanently and irreversibly remove/destroy the data stored on a storage device, rendering that data unrecoverable. This feature securely erases the flash and optional SSD storage device(s) within an Arista switch. Specifically, it will secure erase the storage devices whose partitions mount to /mnt/crash, /mnt/drive, and /mnt/flash (as applicable). Then, it repartitions these storage devices and re-creates the filesystems for each of their partitions. In other words, the partition table of each storage device will be the exact same as before this secure erase procedure (MBR gets destroyed during a secure erase); each partition will have the same filesystem type and partition label, and be mounted to the same mount point with the same options. This makes it possible to boot EOS again; simply install a new boot-config and EOS SWI, then reboot (which can be done through Aboot/fullrecover).