+1 for HDDErase.
I keep an old dedicated machine for this purpose including a power switched SATA bay to help bypass the ATA password problem.
Startech.com SATADOCK525
I though RAID 5 was 2 blocks XOR'd for parity to a 3rd block regardless of how many drives are in the array. Therefore 1 block write only requires 2 blocks read (2 data) and a 2 block write minimum(1 xor & 1 data), 3 block maximum(1 xor & 2 data). RAID 6 increases the XOR storage block to another drive equals a 4 block maximum. Subsequent blocks of data and xor(s) are rotated through the drive set so that parity blocks are never aligned to a single drive (RAID 3).
It doesn't matter how you boot, CD, ROM, Write Protected Disk...Now in the internet age, if your machine is vulnerable you will reboot clean and be re-infected. We need to write better software.
No problem, I will drop one in your mailbox or maybe just leave a USB flash drive on your driveway. You trust me er I mean local home town bank labeled CD right? (/sarcasm)
We do need to BUILD the TRUST up with these CA's. I would not have trusted DigiNotar if I knew they were running vulnerable weak password Windows boxes. I do agree that self-signed certs are just as secure, but when dealing with unknowns on the Internet we need the trust to start somewhere. I think there are already way too many certs in my browser and they are already valid until 2040! Yikes.
I use opendns because it allows me to manually refresh the cache (opendns.com/cache) when I am making name server changes on my domains. Then I know immediately if the changes are correct and will propagate to the rest of the internet eventually.