meyerast/DECSEraser
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Improved logging, added offline mode, redid registry export

Browse Source
This commit is contained in:
meyerast
2026-04-09 16:06:56 -04:00
parent cbb822c646
commit 8eafb32564
4 changed files with 171 additions and 86 deletions
Download Patch File Download Diff File Expand all files Collapse all files
erase_drive.sh
+92 -46
View File
@@ -2,11 +2,23 @@
#!/usr/bin/env bash
start_time="$(date '+%Y-%m-%d_%H.%M.%S')"
log=/tmp/log_"$start_time".log
log_x=/tmp/log_x_"$start_time".log
logdir=/tmp
log="$logdir"/log_"$start_time".log
log_x="$logdir"/log_x_"$start_time".log
exec 3>&1 1>>"$log_x" 2>&1
set -x
print="false"
offline="false"
while getopts ":p:o" opt; do
case ${opt} in
p ) print="true" ;;
o ) offline="true" ;;
\? ) echo "Invalid option: -$OPTARG" ;;
: ) echo "Option -$OPTARG requires an argument." ;;
esac
done
loginput() {
echo "$*" >&3;
echo "[INPUT] $(date '+%H:%M:%S') $*" >> "$log";
@@ -63,8 +75,11 @@ cleanup () {
pcie_disable
loginfo "Unmounting drives."
exec 1>/dev/null 2>&1
umount "/mnt/reinstallbackups"
umount "/mnt/decs"
if [[ ! $offline = "true" ]];
then
umount "/mnt/reinstallbackups"
umount "/mnt/decs"
fi
}
trap catch_sigint SIGINT
@@ -74,13 +89,13 @@ get_netid () {
netid=
while [[ $netid =~ ^\s*$ ]];
do
loginput "Enter netid: "
loginput "Enter r-account netid: "
read -r netid
logresponse "$netid"
if [[ $netid =~ ^\s*$ ]];
then
logwarn "Your netid cannot be blank."
loginfo "Enter netid: "
loginfo "Enter r-account netid: "
else
local ret_value=$(kinit "$netid"@EGR.MSU.EDU >&3; echo $?)
if [[ ! $ret_value = "0" ]]
@@ -103,16 +118,19 @@ get_ticket () {
logresponse "$ticket_number"
if [[ ! $ticket_number =~ ^\s*$ ]];
then
mkdir -p /mnt/reinstallbackups
if ! mount -t cifs -o user="$netid",sec=krb5i "//reinstallbackups/reinstallbackups" /mnt/reinstallbackups
if [[ ! $offline = "true" ]];
then
logwarn "Failed to mount reinstallbackups, cannot check ticket status."
else
if ! ls /mnt/reinstallbackups | grep -q -E "^$ticket_number"
mkdir -p /mnt/reinstallbackups
if ! mount -t cifs -o user="$netid",sec=krb5i "//reinstallbackups/reinstallbackups" /mnt/reinstallbackups
then
logwarn "Backup does not exist in //reinstallbackups/reinstallbackups/$ticket_number!"
logwarn "Failed to mount reinstallbackups, cannot check ticket status."
else
if ! ls /mnt/reinstallbackups | grep -q -E "^$ticket_number"
then
logwarn "Backup does not exist in //reinstallbackups/reinstallbackups/$ticket_number!"
fi
umount /mnt/reinstallbackups
fi
umount /mnt/reinstallbackups
fi
else
ticket_number="UNKNWN"
@@ -125,18 +143,18 @@ mount_remote () {
mkdir -p /mnt/decs
if mount -t cifs -o user="$netid",sec=krb5i "//decs/decs/support/dban_logs" /mnt/decs
then
dirname=
if [[ ! $ticket_number =~ ^\s*$ ]];
then
dirname="UNKNWN-$start_time"
mkdir -p /mnt/decs/UNKNWN-"$start_time"
logdir=/mnt/decs/UNKNWN-"$start_time"
else
dirname="$ticket_number"
mkdir -p /mnt/decs/"$ticket_number"
logdir=/mnt/decs/"$ticket_number"
fi
mkdir -p /mnt/decs/"$dirname"
cp "$log" /mnt/decs/"$dirname"/log_"$ticket_number"_"$start_time".log
cp "$log_x" /mnt/decs/"$dirname"/log_x_"$ticket_number"_"$start_time".log
log=/mnt/decs/"$dirname"/log_"$ticket_number"_"$start_time".log
log_x=/mnt/decs/"$dirname"/log_x_"$ticket_number"_"$start_time".log
cp "$log" "$logdir"/log_"$ticket_number"_"$start_time".log
cp "$log_x" "$logdir"/log_x_"$ticket_number"_"$start_time".log
log="$logdir"/log_"$ticket_number"_"$start_time".log
log_x="$logdir"/log_x_"$ticket_number"_"$start_time".log
exec 1>>"$log_x" 2>&1
set -x
else
@@ -169,7 +187,7 @@ get_eraselevel () {
get_devicetype () {
devicetype=
loginfo "What is the device type? (0 = HDD_SATA, 1 = SSD_NVME, 2 = SSD_SATA):"
loginput "What is the device type? (0 = HDD_SATA, 1 = SSD_NVME, 2 = SSD_SATA):"
loginfo "Type 'help' for an explanation of each type."
read -r devicetype
logresponse "$devicetype"
@@ -212,11 +230,11 @@ get_device () {
loginfo ""
if [[ $devicetype = "HDD_SATA" ]] || [[ $devicetype = "SSD_SATA" ]];
then
loginfo "$(lsblk | grep -E '^NAME|^sd')"
loginfo "$(lsblk -o NAME,SIZE,MODEL,VENDOR,ROTA | grep -E '^NAME|sda')"
elif [[ $devicetype = "SSD_NVME" ]];
then
pcie_enable
loginfo "$(lsblk | grep -E '^NAME|^nvme')"
loginfo "$(lsblk -o NAME,SIZE,MODEL,VENDOR,ROTA | grep -E '^NAME|nvme')"
fi
loginfo ""
loginput "Which is the device from this list? (Type 'help' for help.)"
@@ -254,8 +272,22 @@ get_device () {
fi
fi
if [ -e "/dev/$device" ]; then
loginfo "Picking device /dev/$device."
if [ -e /dev/"$device" ];
then
if [[ $devicetype = "HDD_SATA" ]] || [[ $devicetype = "SSD_SATA" ]];
then
if [[ $devicetype = "HDD_SATA" ]] && [[ $(cat /sys/block/"$device"/queue/rotational) = "0" ]];
then
logwarn "Device was specified to be a SATA HDD, but a SATA SSD device was chosen."
device=
elif [[ $devicetype = "SSD_SATA" ]] && [[ $(cat /sys/block/"$device"/queue/rotational) = "1" ]];
then
logwarn "Device was specified to be a SATA SSD, but a SATA HDD device was chosen."
device=
else
loginfo "Picking device /dev/$device."
fi
fi
else
logwarn "/dev/$device does not exist, please ensure you are typing the device name correctly."
device=
@@ -265,7 +297,7 @@ get_device () {
make_infolog () {
loginfo "Reading drive to create a log."
infolog=/mnt/decs/"$dirname"/info_"$ticket_number"_"$start_time".log
infolog="$logdir"/info_"$ticket_number"_"$start_time".log
{
echo "DETAILS"
echo "Start Time: $start_time"
@@ -341,7 +373,7 @@ make_infolog () {
mkdir -p /mnt/"$ticket_number"
if mount -t "$fstype" /dev/"$device""$i" /mnt/"$ticket_number"
then
if find /tmp/"$ticket_number"-maxdepth 4 -ipath "*System32/config" -not -ipath "*Windows.old*" | grep "."
if find /mnt/"$ticket_number"-maxdepth 4 -ipath "*System32/config" -not -ipath "*Windows.old*" | grep "."
then
loginfo "Windows install detected on $device$i."
echo "Windows install detected on $device$i." >> "$infolog"
@@ -349,22 +381,27 @@ make_infolog () {
winpath=$(find /mnt/"$ticket_number" -maxdepth 4 -ipath "*System32/config" -not -ipath "*Windows.old*")
cp "$winpath/SOFTWARE" /tmp/"$ticket_number"/SOFTWARE
cp "$winpath/SYSTEM" /tmp/"$ticket_number"/SYSTEM
CurrentVersion=$(hivexregedit --export --unsafe-printable-strings --max-depth 1 --prefix \\HKEY_LOCAL_MACHINE\\SOFTWARE /tmp/"$ticket_number"/SOFTWARE '\Microsoft\Windows NT\CurrentVersion')
ComputerName=$(hivexregedit --export --unsafe-printable-strings --max-depth 1 --prefix \\HKEY_LOCAL_MACHINE\\SYSTEM /tmp/"$ticket_number"/SYSTEM '\ControlSet001\Control\ComputerName\ComputerName')
Parameters=$(hivexregedit --export --unsafe-printable-strings --max-depth 1 --prefix \\HKEY_LOCAL_MACHINE\\SYSTEM /tmp/"$ticket_number"/SYSTEM '\ControlSet001\Services\Tcpip\Parameters')
LogonUI=$(hivexregedit --export --unsafe-printable-strings --max-depth 1 --prefix \\HKEY_LOCAL_MACHINE\\SOFTWARE /tmp/"$ticket_number"/SOFTWARE '\Microsoft\Windows\CurrentVersion\Authentication\LogonUI')
ProfileList=$(hivexregedit --export --unsafe-printable-strings --max-depth 2 --prefix \\HKEY_LOCAL_MACHINE\\SOFTWARE /tmp/"$ticket_number"/SOFTWARE '\Microsoft\Windows NT\CurrentVersion\ProfileList')
{
echo "WINDOWS DETAILS"
hivexregedit --export --unsafe-printable-strings --max-depth 1 --prefix \\HKEY_LOCAL_MACHINE\\SOFTWARE /tmp/"$ticket_number"/SOFTWARE '\Microsoft\Windows NT\CurrentVersion'
echo ""
echo "HOSTNAME"
hivexregedit --export --unsafe-printable-strings --max-depth 1 --prefix \\HKEY_LOCAL_MACHINE\\SYSTEM /tmp/"$ticket_number"/SYSTEM '\ControlSet001\Control\ComputerName\ComputerName'
echo "$ComputerName" | grep -E '"ComputerName"=str\(1\):".+"' | sed -E 's/"ComputerName"=str\(1\):"(.+)"/Host Name: \1/'
echo "$CurrentVersion" | grep -E '"DisplayVersion"=str\(1\):".+"' | sed -E 's/"DisplayVersion"=str\(1\):"(.+)"/Windows Version: \1/'
echo "$CurrentVersion" | grep -E '"CurrentBuild"=str\(1\):".+"' | sed -E 's/"CurrentBuild"=str\(1\):"(.+)"/Current Build: \1/'
echo "$CurrentVersion" | grep -E '"EditionID"=str\(1\):".+"' | sed -E 's/"EditionID"=str\(1\):"(.+)"/Windows Edition: \1/'
echo "$CurrentVersion" | grep -E '"ProductName"=str\(1\):".+"' | sed -E 's/"ProductName"=str\(1\):"(.+)"/Product Name: \1/'
echo "$CurrentVersion" | grep -E '"RegisteredOrganization"=str\(1\):".+"' | sed -E 's/"RegisteredOrganization"=str\(1\):"(.+)"/Registered Organization: \1/'
echo "$CurrentVersion" | grep -E '"RegisteredOwner"=str\(1\):".+"' | sed -E 's/"RegisteredOwner"=str\(1\):"(.+)"/Registered Owner: \1/'
echo "$Parameters" | grep -E '"Domain"=str\(1\):".+"' | sed -E 's/"Domain"=str\(1\):"(.+)"/Domain: \1/'
echo "$LogonUI" | grep -E '"LastLoggedOnUser"=str\(1\):".+"' | sed -E 's/"LastLoggedOnUser"=str\(1\):"(.+)"/Last Logged On User: \1/'
echo "$LogonUI" | grep -E '"LastLoggedOnDisplayName"=str\(1\):".+"' | sed -E 's/"LastLoggedOnDisplayName"=str\(1\):"(.+)"/Last Logged On User: \1/'
echo "$ProfileList" | grep -E '"ProfileImagePath"=str\(2\):".+"' | sed -E 's/"ProfileImagePath"=str\(2\):"(.+)"/User: \1/'
echo ""
echo "DOMAIN"
hivexregedit --export --unsafe-printable-strings --max-depth 1 --prefix \\HKEY_LOCAL_MACHINE\\SYSTEM /tmp/"$ticket_number"/SYSTEM '\ControlSet001\Services\Tcpip\Parameters'
echo ""
echo "USER DETAILS"
hivexregedit --export --unsafe-printable-strings --max-depth 1 --prefix \\HKEY_LOCAL_MACHINE\\SOFTWARE /tmp/"$ticket_number"/SOFTWARE '\Microsoft\Windows\CurrentVersion\Authentication\LogonUI'
echo ""
hivexregedit --export --unsafe-printable-strings --max-depth 2 --prefix \\HKEY_LOCAL_MACHINE\\SOFTWARE /tmp/"$ticket_number"/SOFTWARE '\Microsoft\Windows NT\CurrentVersion\ProfileList'
echo ""
tree -a -L 1 -D "$(find /mnt/"$ticket_number" -maxdepth 2 -type d -ipath "*/Users" -not -ipath "*Windows.old*")"
tree -a -L 1 -D "$(find /mnt/"$ticket_number"/ -maxdepth 2 -type d -ipath "*/Users" -not -ipath "*Windows.old*")"
echo ""
} >> "$infolog"
else
@@ -418,6 +455,11 @@ make_infolog () {
logwarn "No partitions detected, device is likely empty."
fi
echo "END OF LOG" >> "$infolog"
if [[ $print = "true" ]];
then
cat "$infolog" >&3;
fi
}
erase_device_lv0 () {
@@ -618,13 +660,17 @@ pcie_disable (){
}
main (){
get_netid
get_ticket
mount_remote
if [[ ! $offline = "true" ]];
then
get_netid
fi
loginfo "By running this script, you are confirming that it has been two weeks past the date written on the slip attached to the storage device. DO NOT erase the device before two weeks have passed."
confirm_message "Please type 'confirm' to acknowledge you have read this and that it has been two weeks." "confirm"
get_ticket
if [[ ! $offline = "true" ]];
then
mount_remote
fi
get_eraselevel #sets $eraselevel to 0-2 based on how to erase. Higher levels include lower levels.
get_devicetype #sets $devicetype to HDD_SATA/SSD_SATA/SSD_NVME