Firmware audit & sanitization
Work below the operating system: recovery when flash access is viable, security-focused firmware review on supported platforms, and NIST 800-88 aligned wiping with a written integrity report. Every engagement is quoted after you describe the hardware.
Hardware recovery
Enterprise assets that are locked, bricked, or never fully tested—using physical SPI where the board design allows (platform-dependent).
- BIOS / firmware recovery (model-specific)
- SPI flash EEPROM reprogramming
- 1.8 V / 3.3 V logic-level access
- ME region handling where applicable
Ring −2 hardening
Review System Management Mode and firmware attack surface on supported Intel/AMD systems—findings and mitigations in your report.
- SMM flash write lock (BWP/BLE) audit
- CHIPSEC-based platform analysis
- SMI / persistence risk notes
- TPM 2.0 & boot-chain observations
NIST 800-88 aligned wipe
Destruction of data on NVMe, SSD, and magnetic media using methods appropriate to the device—verified and logged.
- Cryptographic erase / secure erase
- Verification passes on completed media
- Serial and method recorded in your report
- Suitable for resale and decommission handover
What we document so people trust the hardware
Included in scope when quoted—each line is recorded in the Darkhorse Integrity Report (or summarised on inventory listings for lab stock).
Burn-in & health
24–48h memtest or vendor diagnostics where available; POST clean; storage SMART with no critical attributes flagged for disks we ship.
TPM ownership
TPM cleared or ownership reset for the next owner—documented so BitLocker, Windows Hello, or prior tenant keys are not a surprise.
OEM golden firmware
Optional reflash from vendor BIOS/BMC packages, then SHA-256 hash in the report—strong signal for enterprise buyers when the model is supported.
BMC / IPMI
Exposure notes (dedicated vs shared LAN), default credentials rotated, firmware version recorded, advisory check dated (vendor security page or CVE snapshot).
| Scope | Typical includes |
|---|---|
| Resale ready | NIST-aligned wipe, SMART, BMC creds, basic POST, one-page report |
| Assurance | Resale ready + burn-in + TPM clear + BIOS/BMC version & hash |
| Assurance + OEM | Assurance + vendor golden reflash (quoted per model) + advisory check |
Exact steps depend on make, model, and your quote—unsupported platforms are called out before work starts.
Darkhorse Integrity Report
Serial numbers, wipe method, SMART summary, TPM/BMC status, firmware versions and hashes, burn-in result, and advisory check date—plain language your buyer or compliance owner can file.
Request a quote Lab-verified inventory