How to wipe personal data, but still have a usable device?

[esfa101]

We have two old devices: Fortigate 111C and FortiAnalyzer 100B. They are currently offline (as they have been replaced by other models). We are going to try sell them via auction (being a public organization we have such rules). But we need to safely remove our data and yet have it still usable, so it is worth a purchase for someone. I have read about Factory reset command, but i'm not sure it will wipe all the data. Is it only resetting a configuration? Should i still wipe the logs and other stuff somehow? I have also read in the forums about running format on FortiAnalyzer to get rid of logs, but won't it render the device unusable after that?

With personal computers we are just wiping out HDDs securely as installing OS is a trivial task. Probably not so trivial with Fortigate. Or is it possible to completely wipe its memory and then install fresh FortiOS?

[AndreaSoliva · Accepted solution]

Hi

one hint more.....if you point to low level format you can use based on 5.2 as 5.4 following command:

# execute erase-disk

This will overwrite the disk block 3 X with rubish so that the data available whatever it is "based on normale status" will gone! After that you can stage from scratch the device again over Bios by TFTP formating the boot device and staging by new FortiOS image.

hope this helps

have fun

Andrea

[AndreaSoliva · Accepted solution]

Hi

For FAZ use following:

# execute erase-disk flash <erase-times>

Overwrite the flash (boot device) with random data a specified number of times. When you run this command,

you will be prompted to confirm the request. Executing this command will overwrite all information on the FortiAnalyzer system’s flash drive. The FortiAnalyzer system will no longer be able to boot up.

# execute format <disk | disk-ext3 | disk-ext4> <RAID level> deep-erase <erase-times>

deep-erase --> Overwrite the hard disk with random data. Selecting this option will take

longer than a standard format.

The CLI of FAZ is your friend :) Search for "erase"

hope this helps

have fun

Andrea

[Itguy]

Factory Reset will wipe all data. It's reset back to core default setup values and the logs/drive/memory are totally cleaned. I've wiped hundreds, if not thousands of Fortigate devices.

[ede_pfau]

I'd like to get hold of a FortiAnalyzer 'cleaned' by a factoryreset only

You will have to format the log disks of course.

For both FGT and FAZ, the internal flash disk holds configuration data, perhaps revisions, and the firmware. So if you additionally format the boot device as well (via CLI during boot) you'd have to reload a firmware via TFTP to make the device useable for the common eBayer.

[esfa101]

So. I have done factory reset on both devices. I don't really want to format them and make unusable (have no desire to reinstall it myself). I wonder what is left after the reset. Is it only logs? I think it probably is not critical if those logs contain who browsed where, etc. But passwords, users and settings should be gone?

[AndreaSoliva · Accepted solution]

Hi

one hint more.....if you point to low level format you can use based on 5.2 as 5.4 following command:

# execute erase-disk

This will overwrite the disk block 3 X with rubish so that the data available whatever it is "based on normale status" will gone! After that you can stage from scratch the device again over Bios by TFTP formating the boot device and staging by new FortiOS image.

hope this helps

have fun

Andrea

[esfa101]

When i run this command it shows:

boot

HDD1

Should i only delete HDD1 (which i suppose contains logs, other data)? Boot probably only contains a boot image?

[AndreaSoliva]

Hi

boot for bootdevice and HDD for atual disk. I would recommend to use HDD. If you reboot after and you install again from scratch a FortiOS use "format boot device" within the bios and after "transfer by TFTP".

hope this helps

have fun

Andrea

[esfa101]

What about the FortiAnalyzer? exec erase-disk is not working on it.

[AndreaSoliva · Accepted solution]

Hi

For FAZ use following:

# execute erase-disk flash <erase-times>

Overwrite the flash (boot device) with random data a specified number of times. When you run this command,

you will be prompted to confirm the request. Executing this command will overwrite all information on the FortiAnalyzer system’s flash drive. The FortiAnalyzer system will no longer be able to boot up.

# execute format <disk | disk-ext3 | disk-ext4> <RAID level> deep-erase <erase-times>

deep-erase --> Overwrite the hard disk with random data. Selecting this option will take

longer than a standard format.

The CLI of FAZ is your friend :) Search for "erase"

hope this helps

have fun

Andrea

[emnoc]