As the most widely used storage medium today, it is no wonder hard drives represent one of the biggest security challenges. Yet despite stricter government data compliance and security mandates, more needs to be done to safeguard end-of-life data. Ensuring the data on a hard drive is completely eliminated before it is disposed, redeployed or donated should be a top priority for every organization. A clear understanding of these methods and their limitations is essential to ensuring the safety of end-of-life data. To help you better understand your options, I’ve summarized them below for your consideration.

Secure Erase Technology
Caution: Many vendors who sell commercial software products use the term “secure erase” incorrectly. They use the term to describe an “erasure that is secure”. However it is important to distinguish this misused marketing term with Secure Erase technology.

In the late 90’s, the hard drive manufacturers called for a global summit to discuss the rapidly growing challenge of properly sanitizing hard drives. The challenge was to develop a means for certifiably sanitizing hard drives beyond forensic reconstruction while retaining the ability to reuse the hard drive. The hard drive industry collaborated with Center for Magnetic Recording Research (CMRR), under the direction of the US National Security Agency (NSA), to meet this challenge. They developed a sanitization standard called Secure Erase. The Secure Erase standard has been implemented by all hard drive manufacturers since 2002. It is embedded in the firmware of all ATA/IDE and SATA hard drives and is recommended by the National Institute for Standards and Technology (NIST SP 800-88) as a “purge technology”, a step above software overwriting which is characterized as a “clear technology”.

Since it is located in the firmware of the drive, the sanitization procedure is up to 18x faster than commercial software overwrite routines, which have to communicate to the drive through the OS and BIOS. In addition, it is able to purge all sectors of the hard drive as it has direct access to all bad sector tables stored internally on the drive.

Commercial Overwrite Routines
Commercial overwriting tools are designed to write random bits of data on all user accessible sectors of a drive. The software is loaded onto a machine or server to execute the overwrite procedure. Most overwriting tools execute multiple passes for added security. However, even multiple passes does not guarantee complete sanitization. Some overwriting tools are not able to access bad sectors of a hard drive. This leaves recoverable data on these sectors. In addition, software can take an enormous amount of time, usually lacks an automated logging capability for audit purposes and is not a physically secure process. Both public and private sectors have acknowledged the ineffectiveness of software overwriting. One example of this occurred in June of 2007 when the US Defense Security Service disapproved of this methodology as a method for destroying data.

Degaussing Machines
Degaussers produce a strong magnetic field in order to destroy the magnetically recorded data on the hard drive. Degassers have the unfortunate consequence of destroying the read/write head of the hard drive, rendering the hard drive unusable. The original intent of degaussers was for use with non-rigid disks and magnetic tape media. As the sophistication and platter density in most modern hard drives continues to increase so to does the inadequacy of this methodology. Aside from dangers they pose to other nearby electronic equipment there is no way to ensure that the hard drive platter does not contain any

You do not have flash or javascript support.

Average (2 votes)

Reply