Skip to main content
esfa101
esfa101
New Member
March 16, 2016
Solved

How to wipe personal data, but still have a usable device?

  • March 16, 2016
  • 2 replies
  • 21167 views

We have two old devices: Fortigate 111C and FortiAnalyzer 100B. They are currently offline (as they have been replaced by other models). We are going to try sell them via auction (being a public organization we have such rules). But we need to safely remove our data and yet have it still usable, so it is worth a purchase for someone. I have read about Factory reset command, but i'm not sure it will wipe all the data. Is it only resetting a configuration? Should i still wipe the logs and other stuff somehow? I have also read in the forums about running format on FortiAnalyzer to get rid of logs, but won't it render the device unusable after that?

 

With personal computers we are just wiping out HDDs securely as installing OS is a trivial task. Probably not so trivial with Fortigate. Or is it possible to completely wipe its memory and then install fresh FortiOS?

Best answer by AndreaSoliva

Hi

 

one hint more.....if you point to low level format you can use based on 5.2 as 5.4 following command:

 

# execute erase-disk

 

This will overwrite the disk block 3 X with rubish so that the data available whatever it is "based on normale status" will gone! After that you can stage from scratch the device again over Bios by TFTP formating the boot device and staging by new FortiOS image.

 

hope this helps

 

have fun

 

Andrea

2 replies

Itguy
Itguy
New Member
March 17, 2016

Factory Reset will wipe all data. It's reset back to core default setup values and the logs/drive/memory are totally cleaned. I've wiped hundreds, if not thousands of Fortigate devices.

ede_pfau
SuperUser
ede_pfau
SuperUser
March 18, 2016

I'd like to get hold of a FortiAnalyzer 'cleaned' by a factoryreset only

You will have to format the log disks of course.

 

For both FGT and FAZ, the internal flash disk holds configuration data, perhaps revisions, and the firmware. So if you additionally format the boot device as well (via CLI during boot) you'd have to reload a firmware via TFTP to make the device useable for the common eBayer.

esfa101
esfa101Author
New Member
April 13, 2016

So. I have done factory reset on both devices. I don't really want to format them and make unusable (have no desire to reinstall it myself). I wonder what is left after the reset. Is it only logs? I think it probably is not critical if those logs contain who browsed where, etc. But passwords, users and settings should be gone?

craigusza
craigusza
New Member
April 19, 2016

Hi esfa101,

 

Config is stored on the boot partitions and the logs are stored either as a partition on the same flash or separate. 

There is also the shared data partition for IPS and AV.

 

You can check beforehand from the CLI with

execute disk list     -     Shows disks & partitions.

http://docs-legacy.fortinet.com/fgt/handbook/40mr2/cli_html/wwhelp/wwhimpl/common/html/wwhelp.htm?context=FortiOS_CLI&file=execute.25.12.html

diagnose sys flash list     -     Shows boot partitions.

 

Best way to clear it all off is as follows.

 

From GUI under [System].[Dashboard].[Status] in the [System information] dialog click [Revisions] in the system configuration line.  Clear any revision backups.

 

From CLI

execute formatlogdisk Formats the Log disks and reboots.

 

execute factoryreset Restores to factory settings on current firmware version and reboots. http://kb.fortinet.com/kb/documentLink.do?externalID=FD37052   diagnose sys flash format Formats shared data partition(IPS/AV) and reboots   Lastly interrupt the boot sequence and TFTP a clean firmware version to both the default and backup partitions. http://kb.fortinet.com/kb/viewContent.do?externalId=10338   I have seen units stop booting during some of these commands before but in all cases I managed to recover with TFTP of clean firmware.  Use at own risk though.   I'm fairly certain there is overlap between these commands that is removing the same thing but prefer to be safe.   Regards, Craig
Terms & ConditionsAccessibility statement