Erasure engine

The erasure engine is the field half of AVERASE: a bootable live ISO you write to a USB stick, boot on the machine to be processed, and use to audit the hardware and irreversibly erase its drives — with every result reported back to your AVERASE account for certification.

What it is

The engine is a self-contained Alpine Linux 3.21 x86_64 live system that runs entirely from RAM. It never installs anything, never mounts the target machine's filesystems for writing, and never touches the disks it is about to wipe until you explicitly commit an erase — which is exactly what makes it safe to boot on a machine whose drives still hold customer data.

On boot, the system logs in automatically, starts a minimal graphical session, and launches the erasure kiosk full-screen. There is no desktop, no terminal, and no way to exit to a shell from the UI. The kiosk runs as root — it needs direct block-device and firmware-command access to do its job — and if it ever crashes it is respawned automatically.

The ISO boots on both classic BIOS machines and UEFI machines with no boot menu to navigate: it just starts.

Target hardware

The engine targets x86_64 PCs, laptops, and servers, and can erase:

• NVMe drives (Sanitize and Format-based erasure)
• SATA/ATA drives (Sanitize and Security Erase)
• SAS/SCSI drives (SCSI Sanitize)
• TCG Opal self-encrypting drives (PSID Revert)

Drives sitting behind a RAID controller or HBA are visible read-only: the engine probes RAID members through controller passthrough (Broadcom/LSI MegaRAID and Dell PERC, HPE Smart Array, and Adaptec controllers) so they appear in the hardware fingerprint with model, size, media type, and serial — but they are not wipe targets. To erase RAID members, attach them directly to a supported controller.

Booting from ATA drives in a firmware-frozen security state is handled automatically: a boot-time unfreeze routine suspends and resumes the machine when a frozen disk is present, so ATA Secure Erase and Sanitize commands work without operator intervention.

Getting the engine

You never download a generic image. Each ISO is issued to your account:

1. A subscribed admin visits the Download page in the web app and requests the engine ISO.
2. AVERASE mints a device token — a signed license bound to your account — and issues a short-lived (5-minute) download link.
3. The download service streams the ISO with your token embedded directly into the image. The file arrives as averase-<id>.iso.

That embedded token is what the engine presents at every boot, check-in, and result upload. A stick with no token — or a revoked one — cannot wipe anything. Downloads cannot be resumed, so let the transfer finish in one go; if it fails, request a fresh link.

See Downloads for issuing, revoking, and suspending ISOs, and License tokens for how entitlement works end to end.

The UI shell

The kiosk is a single-window app with a light theme and a consistent layout:

• Sidebar (left, collapsed to an icon rail by default) with three destinations: Overview (the device fingerprint dashboard), Test (hardware tests), and Erase (drive selection and wipe). At the bottom sit three controls: Power (opens the Power options popup — Power off / Reboot / Cancel), Network (the Wi-Fi popup), and Worker (license and connection status). Navigation is disabled during a wipe and while the device is unverified.

• Header band across the top of the page, carrying the current screen's title:

  Screen	Band title
  Overview dashboard	Device fingerprint
  Hardware tests	Hardware tests (becomes Webcam Test / Audio Test while those tests are open)
  Erase configuration	Drives
  Wipe in progress	Wipe progress
  Post-wipe summary	Summary
  Locked (unverified)	(no title)

• Band controls: a Notes toggle on every screen (tooltips Notes / Close notes); on the dashboard only, an Advanced toggle and a Refresh button; during a wipe, an amber ● wipe in progress — navigation locked indicator.

• Notes panel: a 320px panel on the right where the operator types free-form notes about the machine. Notes autosave (1.5 seconds after you stop typing, and on blur or close) and attach to the machine's asset record in your account.

The five screens

Screen	What it does
Device fingerprint	The full hardware audit — system, board, CPU, memory, GPUs, storage, battery, displays, and more, with an Advanced toggle for deeper detail.
Hardware tests	Nine functional tests (keyboard, display, touchscreen, webcam, audio, USB, battery, Wi-Fi, Bluetooth), runnable one-by-one or as an automatic audit.
Drives	Select wipe targets, pick a method per drive (NIST 800-88 R2 Clear or Purge), and commit the erase through a two-step confirmation.
Wipe progress	Live per-drive progress, technique messages, and cancellation — navigation stays locked until every job finishes.
Summary	Per-drive result and disposition (sanitized / DESTROY / review). Certificates are issued by AVERASE cloud — download them from your account.

Safety principles

The engine is built fail-closed, and it's worth understanding why before you take it into the field:

• No license, no wipe. The device must verify its license online before the UI unlocks, and it checks in with the server again immediately before every wipe. A denied, revoked, suspended, or over-quota token blocks the wipe — and so does any network failure. An unentitled or offline stick is inert by design.
• No offline unlock. There is no bypass code, no grace period, and no offline mode. If the engine cannot reach the license server, it stays locked. This is what makes remote kill from the web app trustworthy.
• Verify before certify. Every erase is verified by reading the media back — pre-planted fingerprint markers plus representative sampling per NIST 800-88 — before a result is reported. Results that can't be fully verified are held for review rather than certified, and an unsatisfiable Purge fails outright and routes the drive to physical destruction instead of silently downgrading.
• Hardware data stays local until verified. While the device is locked, no hardware information leaves the machine — the asset report is only sent after a successful license verification.

Where to next