Discussion on:

Implement a data destruction policy to keep corporate secrets safe

is to pop them in the microwave for about 10 seconds. This totally obliterates the data.

You made no mention of the proper methods for destroying data on hard drives. Is there a standard accepted practice for this. What works best (multiple re-formats, magnet, 22, sledghammer, dynamite)? I've seen multiple suggestions out there, but is there one that is the industry standard?

Get yourself a copy of DBAN - Darren?s Boot and Nuke. It works excellent and you can choose how many passes it makes. If that is not good enough; buy a drill press. After the hard drive has been dban'ed then drill a few holes in it and fill it with sand.

In the second to last paragraph I said "(I intentionally didn't cover hard drives in this article, because hard drive destruction and destroying information on a hard drive is a totally different issue from portable media.)"

I covered Hard Drives in a previous issue:
http://techrepublic.com.com/5100-1009-5669904.html

and yes DBAN was my prefered method.

Mike Mullins
Security Solutions Columnist
Techrepublic

The only way to ultimately guarranty that your data on the hard drive is gone is to destroy the hard drive itself. I usually put the ones I don't want to save in an old 6 ton press we have. Other than that get one of the programs out there (I use GWSCAN) to write zeroes to the drive.

FIRE!!!!!

With flamable portable media ranging from paper, floppies, CDs, etc. this is EASY!!!

With something like a hard drive...a plasma cutting torch works GREAT!!! THINK about the fun of melting the media into ashes that barely exist! I know this works because I did it to a hard drive that crashed/quit working/WOULD NOT WORK ON IT'S OWN buwahahahaha!!!!

Yes, they make these.

http://www.edrsolutions.com/

They also make shredders, but they are more costly.

Physical destruction rules out the feared condition known as data remanence.

http://en.wikipedia.org/wiki/Data_remanence

if you cut the floppy, zip, and throw it away, i've still got your data! with the high density of this media and with the technology existing cheaply, it is best to pulverize the media. and if you don't have epa on your case and an open area, melt or burn...

adios

Optical media: Soak in water for a day or so, then take it out to the parking lot and burn it.

Floppy, ZIP, tapes: Run a strong magnet by it, soak in water, and burn it.

Flash drives: Rub feet on carpet then touch it & let the ESD fry the circuit, break it in half, soak in water, discard.

Paper: Shred and recycle.

HDD: Format, clean OS install, then use one of the many available data destruction programs, break it open, separate the disks, put them on concrete then stand on it and spin. That scratches it up pretty bad.

How can one recover data from a used hard drive that was formatted and partitioned?

Can somebody recommend any good tools that can help do that?

I have always thought that a bulk tape demagnetizer would be good. (Then the old pull tape from the reel.)

We had this discussion just yesterday. Bulk erasers could erase some of the data, but if you were to look at the tapes magnetic properties, you would most likely find that there is still readable data on the tape. Removing it from the spool is good and if someone really wanted to read the bits, it would still be possible (though it would take a lot of work) to mount the tape on a spool - or use some other manner to mount the media - and read what bits are left. Our records management person believes that heating the tape to the point where it melts, but doesn't burn, would be the best destruction practice you could use. IMHO this could be done in a microwave oven. Not sure what types of gases, etc. would be produced from this, so at the least, the oven should be in a well ventilated area. Any other ideas?

I liked the way Kevin rose did it on The Screen Savers, before G4 changed the show to games only.

nuked cdroms.

demagged hard drives.

shredded cdroms, floppys ( in paper shredder )

burned floppys, cdroms, and zip disks with blow torch.

but the best part of all..

thermite bomb inside the case of the system to destroy the hard drive.

would love to nuke some of them!

Incidentally, I think I'm about to have a problem with PDA's - due to a six month rota for qualifying doctors, I have a feeling that these are about to be passed from doctor to doctor on their rotation through this part of the health service.

Anyone heard anything about how "retrievable" information is from a PDA after a hard reset? Looked in all the usual places, but I appear to be asking the daft question first, yet again!

Incidentally - use DataEraser from Ontrack for data destruction - up to 99 passes, and certification produced, which the audit department just loves....

GG

We recently started using a company called Data Decimation for all of our media and data destruction needs. (www.datadecimation.com) I asked them for a description of their services to post here:

Data Decimation offers a complete, certified, auditable, fully-documented, fully-compliant data and media destruction service. We offer data destruction performed in a federal government facility with certification issued by a Department of Justice division. As regulations are becoming more restrictive and public scrutiny increases, all organizations must have an auditable data destruction plan. We are able to offer government-issued certificates of destruction which will suffice in all situations. We give you the strongest evidence of compliance available.

Our data destruction is all done in highly secured, highly monitored, government facilities with tight supervision. We can destroy all hard drives; CD's; back-up tapes; memory and all other electronic media formats. Other solutions and software are subject to human error and there is no proof that the data was actually destroyed thus creating vulnerabilities. Our reasonable pricing is lower than the cost of erasure software. All residual materials are processed in an environmentally friendly manner. We offer complete destruction, complete compliance, complete quality control and complete peace of mind. We can be reached at 410-975-9046 or via our website at www.datadecimation.com. We are a woman-owned company; a division of Turtle Wings Electronics Recycling. (MD DBE/MBE Certification Pending)

If you want to get an ad on TR, pay for it.

You will find people on a tech board are not the sheep you are used to with dealing with execs or whatever.

To have this same message SPAMMED to me via peer mail is also unacceptable behavior.

This really isn't as clever of a way to advertise as you think, as you will get much bad press very quickly.

Remember, there is a ring in hell reserved for SPAMMERS.

and needless to say, it went straight in the bin.

Yes, bad press will abound.

Deservedly so.

GG

I get "Help Help Me Mr Jerr" and spam email generally from here.

I do have a few peers with whom I converse.

Lizzie babe ain't one of them tho since she spammed me. And she doesn't have any information on her Yahoo profile, which always means they are really ugly or married or a transvestite.

I think it's funny that they state they are a woman owned business. Why would they even advertise that? Are they out pushing a feminist agenda? I personally will be boycotting the business not because they are woman owned business, but because they think they have to advertise it. I will be no part of whatever business or political agenda they are pushing.

And for the record, I work for a MAN owned business and we're better.

I mean, you'd really want to meet that dog, wouldn't you? It would be some sort of Genius-MBA dog, and I would buy his (or her) products, just to be able to say "would you believe that a DOG created this software??

Excellent points, jdclyde! After looking at Elizabeth's company site, I'm kind of skeptical about her claims of "certified data destruction" with a blessing from the Dept. of Justice. Sounds vaguely like a front for a certain federal prison system program!! Just what I want...convicted felons destroying my computer data!!!

Nor do they maintain any data standards.

As a government entity, they must comply with FIPS standards, which are promulgated (love that word) by our friends at NIST.

The DOJ are prosecutors and lawyers, not computer geeks, that's the job of NIST with their FIPS publications.

http://csrc.nist.gov/publications/PubsFIPS.html

FIPS does not endorse or approve specific products, it just says you have to follow the rules.

Why would you ask yourself permission to quote your own company's PR?

You pose as if you are a happy client of Turtle Wings when in fact you are the president of the company!?! See quote from Washington Post article that states:

...."A reputable recycler can talk you through what happens to your electronics and provide references," says Elizabeth Wilmot, president of Turtle Wings, a Maryland-based e-waste recycling service. For a fee, Turtle Wings"

http://www.washingtonpost.com/wp-dyn/content/article/2007/11/21/AR2007112102194.html

So your hard drive that you sent to a 'Recycler' for 'Data Destruction' would likely end up on 'eBay' with a 'Buy it now'