Skip to content

s0 · Sector Zero

License NIST SP 800-88 Ed25519 Tests Portal

s0 (Sector Zero) is an open-source, forensic-grade command-line suite and web dashboard for secure digital sanitization and deleted-file recovery. Every wipe operation produces a cryptographically signed, hash-chained audit certificate — verifiable offline, forever, by anyone — making s0 the only sanitization tool that delivers mathematical proof of data destruction rather than an unverified log entry.

Built for security engineers, digital forensic examiners, compliance auditors, and field technicians who must guarantee and mathematically prove that confidential evidence or retired media is beyond forensic reconstruction.

⚖️ Legal & Responsible Use Requirement

s0 is a certified digital forensic sanitization and recovery tool. You must only operate on storage devices and files that you legally own or for which you have explicit, documented written authorization to process. Unauthorized data destruction or forensic acquisition may violate computer crime legislation (including CFAA 18 U.S.C. § 1030, Computer Misuse Act 1990, and IT Act 2000). See the Legal & Ethics FAQ.

Core Modules

  • Drive Eraser

    NIST SP 800-88 Rev.1 Clear and Purge sanitization for NVMe SSDs, SATA HDDs/SSDs, USB flash drives, and raw disk images. Automates NVME_SANITIZE, ATA_SECURE_ERASE, BLKDISCARD ioctls, and multi-pass pattern overwriting with 64-block post-wipe readback verification.

    Standards: NIST SP 800-88 Rev.1 · IEEE 2883-2022 · ISO/IEC 27037 · DPDPA 2023

    Drive Eraser Manual

  • File & Folder Eraser

    Cross-platform native cluster sanitization. Overwrites file extents in-place, truncates files to 0 bytes, resets inode timestamps to Unix epoch zero (1970-01-01), purges Windows Alternate Data Streams (:Zone.Identifier), flushes Darwin hardware caches (F_FULLFSYNC), and scrambles directory entry filenames before unlinking.

    Platforms: Linux · macOS · Windows

    File Eraser Docs

  • File Carver

    Forensic deleted file recovery engine. Reconstructs lost evidence directly from filesystem structures (ext4 inode extent trees, NTFS $MFT multi-fragment runlists, FAT32 directory entries, and exFAT cluster heaps) alongside raw sliding-window signature carving with 4-factor Shannon entropy scoring.

    Filesystems: ext4 · NTFS · FAT32 · exFAT · raw signature carving

    File Carver Guide

  • Drive Imager & Cloner

    Forensic bit-stream disk acquisition engine compliant with NIST SP 800-86 and ISO/IEC 27037. Creates forensically sound raw images (.raw, .img, .dd) or 1:1 hardware disk clones with real-time simultaneous SHA-256/MD5 hashing, write-blocking safety refusals, and fault-tolerant zero-filling for failing storage media.

    Capabilities: Raw Bit-Stream Image · 1:1 Disk Clone · Fault-Tolerant Bad Sector Recovery · Live Dual Hashing

    Drive Imager Manual

  • Blockchain Audit Ledger

    Every operation is permanently recorded in a SHA-256 block hash-chained SQLite ledger (~/.s0/s0_audit.db). Altering any past block invalidates all subsequent hashes, providing local, mathematically provable tamper evidence without external internet dependencies.

    Verification: Ed25519 · SHA-256 chain · 100% client-side portal

    Audit Ledger Specs

Why s0?

Most sanitization tools tell you a drive was wiped. s0 proves it mathematically.

Capability s0 Suite Conventional Tools (e.g. Blancco / DBAN)
NIST SP 800-88 Rev.1 Purge & Clear Yes (Automatic selection) Varies
Ed25519 Asymmetric Digital Signatures Yes (Built-in RFC 8032) No (Closed proprietary signatures)
Deterministic s0 Canonical JSON v1 Yes (Strict integer discipline) No (Unstandardized XML/CSV)
SHA-256 Hash-Chained Blockchain Ledger Yes (Tamper-evident) No (Plain text / mutable logs)
Offline Air-Gapped Verification Yes (100% client-side WebCrypto) No (Requires central cloud server)
Offensive Forensics in Same Binary Yes (ext4, NTFS, FAT32 carvers) No (Separate, costly software needed)
Zero External Network Exfiltration Yes (Strict SCIF/air-gap compliant) No (Telemetry beacons)
Permissive Open Source License Yes (MIT License) No (Expensive per-wipe paywalls)

Three Architectural Pillars

Mathematical Non-Repudiation

Every sanitization certificate carries an Ed25519 digital signature (RFC 8032) computed over s0 Canonical JSON v1. The canonicalization engine eliminates JSON whitespace, key ordering, and floating-point divergences. The certificate content and its signature are mathematically inseparable: if the operation data is modified by even one bit, the signature check fails.

Air-Gapped Verification

The Verification Portal runs 100% in browser memory. It downloads zero external CDN scripts and makes zero server requests. The portal can be saved to a thumb drive and executed via file:/// on an isolated air-gapped machine in a secure facility or courtroom.

Absolute Engineering Honesty

We disclose every technical boundary. Hardware limitations, Flash Translation Layer (FTL) wear-leveling nuances on solid-state media, and Copy-on-Write (Btrfs, ZFS, APFS) filesystem behaviors are logged explicitly as signed warnings in certificates.

Quick Start

Three commands to your first verified wipe

The installer runs on Linux, macOS, and Windows. No root is required for installation or disk image testing.

# 1. Install s0
curl -sSL https://raw.githubusercontent.com/kartik2005221/s0/master/scripts/install.sh | bash

# 2. Inventory attached block devices
s0 list

# 3. Dry-run plan (inspect recommended NIST tier; writes nothing)
s0 plan --target /dev/sdb

# 4. Wipe target drive and issue signed certificate
sudo s0 wipe --target /dev/sdb --operator "analyst-01" --organization "Forensics Lab"

# 1. Install s0
irm https://raw.githubusercontent.com/kartik2005221/s0/master/scripts/install.ps1 | iex

# 2. Inventory drives
s0 list

# 3. Dry-run plan
s0 plan --target \\.\PhysicalDrive1

# 4. Wipe drive
s0 wipe --target \\.\PhysicalDrive1 --operator "analyst-01" --organization "Forensics Lab"

Destructive Operation

s0 wipe permanently and irreversibly destroys data on the target storage. Always confirm the target device path with s0 list and s0 plan before proceeding.

Standards & Compliance

s0's sanitization algorithms and evidence collection protocols are mapped directly to international standards:

Standard Coverage Tier Legal & Evidentiary Role
NIST SP 800-88 Rev. 1 Clear & Purge Automated controller firmware purge and multi-pass logical clearing
IEEE 2883-2022 Clear & Purge Sanitization method definitions and verification readback standards
ISO/IEC 27037:2012 Evidence Handling Cryptographic SHA-256 evidence hashing and immutable audit logging
DPDPA 2023 Data Destruction Verifiable sanitization records of hardware containing personal digital data

Documentation Directory

  • Getting Started

    Installation, prerequisites, platform support, and your first wipe walkthrough.

    Getting Started

  • Drive Eraser Manual

    Device inventory, dry-run planning, wiping workflows, and 64-block verification.

    User Manual

  • File & Folder Eraser

    In-place cluster overwriting, metadata zeroing, and directory entry scrambling.

    File Eraser Manual

  • Forensic File Carver

    Structure-based ext4/NTFS/FAT/exFAT recovery and 4-factor confidence scoring.

    Carving Guide

  • Forensic Drive Imager

    Bit-stream acquisition, 1:1 disk cloning, fault-tolerant zero filling, and dual hashing.

    Imager Docs

  • Blockchain Audit Ledger

    Append-only SQLite architecture, SHA-256 hash chaining, and integrity audits.

    Audit Ledger Docs

  • Verification & Air-Gapped Trust

    Running the portal offline, strict public key pinning, and optical QR verification.

    Verification Guide

  • CLI Reference

    Exhaustive reference for every subcommand, flag, argument, exit code, and JSON output.

    CLI Reference

  • Compliance Guide

    NIST SP 800-88, IEEE 2883, ISO 27037, and DPDPA compliance specifications.

    Compliance Guide

  • Bare-Metal Live ISO

    Debian Live USB creation, Fedora Podman builds, Windows Rufus DD mode, and offline kiosk wiping.

    Live ISO Guide

  • Frequently Asked Questions

    NIST standards, device safety refusals, air-gap verification, and forensic carver mechanics.

    View FAQ