Discussion on:

Don't leave information on old hard drives

A utility I like to use is the Maxtor Low Level Format. It writes Zero's for every bit on the drive. It takes a while, but the drive is completely clean.

In Linux you can just copy zeroes or random numbers directly to the disk in order to randomize the bits on the platter.

Plus you should encrypt your disks so that if you dispose of your disk drive without "cleaning" it people will still not be able to read the data. My Linux disks are encrypted.

Check out the eraser utility at

http://sourceforge.net/projects/eraser

This not only includes an erase option on all the explorer menu to wipe individual files, but you can create a bootable floppy that will boot and completely erase any attached hard drives using an erase pattern that is DOD compliant or if you have a while to run it will wipe your drive using the Guttmann protocol of 15 passes that is unrecoverable by even advanced equipment.

Use any product that employs the DoD Secure Erasure Algorithm. I believe at a minimum it does 7 passes over the entire drive alternately writing 0s then 1s. I've use GDISK (available with Ghost) and a freeware/shareware app called SHIVA. Both are slow runs, but effective.

Having tried to many products with no guarantees of success, I just overheard a conversation about this product found at: http://www.cybersecurityinstitute.biz/software
I tried it and by itself wipes all products advertised here in comments listed hands down while meeting the DOD 5220.22-M, NAVSO P5239-26, RCMP TSSIT97e OPS-II, AFSSI-5020, and AR380-19 standards for clearing, purging, and sanitizing media; runs in a DOS Boot window and will wipe both FAT and NTFS partitions. I created a boot CD and placed this program and other utilities of the trade (Partition Magic 8 Boot) and others. I found even on locked down boxes it could wipe that A_ _ and make the drive media think it was NEW fresh out of the box.

I had a couple of hours to spare yesterday so decided to take your advice and defragle my hard drive.
Your source really should have included a requirement to back up the drive before starting; I'm not stupid so of course I copied the whole of C drive onto a dvd and saved it in the parish church so it could not get corrupted. I then followed the step by step instructions.
It was not difficult to dissemble the drive but I really had to work hard with a razor blade to scrape off all of the brown crud which had accumulated on each side of the discs, however I succeeded then turned on the loudspeaker to switch all of the 0's and 1's. I left it running for half an hour at full volume.
I managed to re-assemble with no bits left over, but when I switched on the computer I got absolutely nothing except a tinny voice from the bottom of the unit talking about shoes or boots or something like that, I couldn't hear it very well because as you know, testing computers all those years ago has made me slightly deaf. I then had the idea of getting the dvd back and playing that to retrieve all of my saved data but the dvd drive refused to work as the computer would not switch on.
I think that the advice you gave me must have missed a step or something.
Can you tell me what to do now?

you used a razor blade instead of a metal file. You must have accidentally sliced Windows open when you did it, then it bled out onto the rest of the hdd corrupting it.

next time, pay attention!

I turn an old drive over to the good ol' boys in the machine shop and let them work their magic. Band saws, drill presses, lathes, routers, etc. They have a high old time coming up with a new method each time I toss one to them.

I sometimes throw 20-30 old drives into the pickup pile (wiped of course) (scrubbed is a better term).

Mybe I shhould pull out the power equipment next time....

yeahm window washer also does this and is much cheaper than evidence eliminator.

http://privacy-software-review.toptenreviews.com/?ttreng=1&ttrkey=window+washer

I use DBAN http://dban.sourceforge.net/

Hi all,
DBAN Rocks I use whenever I need to clean a drive. Writing 0's to a drive is ok but it doesn't get rid of all the data, there are still ghost images on the drive. It stops some people. To get rid of the data you need to overwrite the data many times with different patterns. If this is not done then there is still a good chance the data can be recovered if enough money is spent. (Then again with enough money all things are possible.)

The best answer is to wipe the drive and then destroy the drive. (Grind the drive to dust or see TechTV's data destruction with Thermite. (Remember to be careful went working with tools to destroy the drives.)

HI,
I still love DBAN but I have run into some problems with DBAN on SCSI Drives. (It seems to do one pass and quit.) I found that Norton's GDISK will do a DOD wipe. (This will do up to 7 drives.)

gdisk 1 /DISKWIPE /DOD /Y
gdisk 2 /DISKWIPE /DOD /Y
gdisk 3 /DISKWIPE /DOD /Y
gdisk 4 /DISKWIPE /DOD /Y
gdisk 5 /DISKWIPE /DOD /Y
gdisk 6 /DISKWIPE /DOD /Y
gdisk 7 /DISKWIPE /DOD /Y

This program wiped a set of drives that DBAN failed on. I'm going to a class on wiping and recovering data later in the month so maybe they'll have something add.

P.S. A friend said that they tested DBAN against many other products and it was the fastest of the ones they tried.

Where's my sledgehammer

If it's an old work disc,even after formatting,take a hammer,and smash it to bits.Let's see the b%*^!"ds try and read that!!

If you had really incriminating evidence on it, say for a massive worldwide scam or childporn crackdown..even if you smashed it, burnt it, scratched it, did anything to it - it can still be recovered by the good guys in the FBI/Army Forensics teams

There is only one way that you can totally destroy it forever, but i wasn't told.

is typically 'destroyed' by degaussing or
overwriting. Formatting a disk once does not completly destroy all
data.The entire media must be overwritten or formatted several times to be "safe".Even then some back-room military "cell" would probably find some way of reading it.Unless it had been smashed into atomic particles of course.
Did'nt the cia shred some documents years ago,and a communist country simply glued all the bits together,because the "bits" were simply left in the waste bin?

It was after the takeover of the the US Embassy in Iran that the "students" (one of whom is the current President of Iran) took the time to tape together paper from a non-cross cut shreader to reconstruct classified documents. Apparetnly the embassy had the procedure to "shread" documents to make them burn better, but didn't have time to burn them.

A hobby of mine is rebuilding discarded PC's. I've found all sorts of information on HDD's that were discarded. This experience has taught me that the best solution (for me) is to physically destroy the HDD's by disassembling them and damaging the individual platters. Of course, this is a time consuming process!

Most of the old drives we have were removed from service because they had failed. How do remove data from a drive that doesn't work?

A few things. Policy should be that nothing sensitive gets put on the hard drive in the first place. I've worked in Health, Police and mining companies where this ought never to happen. Ok, now the real world..

The level of your response (paranoia) should depend upon what you expect to be on those machines, which comes back to what industry you are in. But just as filing cabinets that go to auction (still) filled full of 'official' papers makes a good news story (good in the sense of 'story' that is..), it really doesn't matter whether material that leaks out on old hard disks is earth shattering, it's enough that it leaked if it's a 'slow news day'. So there has to be at a minimum some security response. I'll start by talking about disposal 'methods', and then go on to talk about destruction techniques

Drives are 'old' either through failure (I'lll come back to that later) or through upgrade. In that latter case the machines often end up on the second hand market (and I'm including sales to staff). Now if they are going on the open market one of the things you can do is 'cover the traces', possibly shipping them out through another agency (if you happen to be an 'interesting' one such as Police etc) and mixing them up with machines from other places. There's no point making the hackers life easy by advertising 'ex-police computers' (or leaving Police related stickers all over them).

You'd think that sales to staff might be 'safer', than disposing of machines to the general public, but people in whatever industry you are talking about have a natural curiousity about their colleagues, and what's more will know 'what to look for'. And ultimately anything that is sold to staff could be re-sold onto the open market. Which gets to another point - asset track this stuff. A computer full of 'whatever' that ends up in the open market that attracts the attention of the press (or the police) can be traced back to your organisation. You need to be very ready to quickly point out that it was disposed of (and certified clean) on xyz date.

For any disposal then, 'anonymise' the machines as much as possible. For general industries I found that a whole disk triple over-lay using a randomised mix of 0's and 1's does the job, but for anything a bit more sensitive I'd recommend a seven layer wipe.

When you add up the sheer time (even if it's fully automated) to do a 7 layer wipe of multiple multi-gb hard disks it then comes down to a question of disposing of the machines without the hard disks, and sending the disks down the destruction path. It's pretty easy to peruade the executive or the bean counters if you give them a short talk about deep-level data recovery and a few cases of punitive damages levied on organisations following digital data loss.

Coming back to the issue of disk failure. You'd think that in most cases we'd move straight on to consideration of methods of destruction, but there is an interesting issue when the hard drive is under warranty. In those cases the terms of the warranty often include the requirement to return the disk. Things might be different these days, but in the old days they were actually taken back and re-assembled (on the basis that the fault might be in the controller rather than the platters). I had a case where we had to simply purchase a new disk because the information on the old one was 'so' sensitive (and there wasn't any way of damaging the platters that wouldn't void the warranty). So forget about the warranty in these cases (unless you can retain the old disk).

Destruction (the fun bit). I don't trust heating, unless we're talking about industrial scale heat. If you try it on the 'domestic' level (eg in the oven in the tea-room or kitchen you might end up generating some mind-altering fumes. Drilling through the case and platters doesn't destroy any more data than is 'punched' out. Sure reading a swiss cheese disk is difficult, but you've just 'advertised' to the hackers that this might be a disk worth recovering

I tend to go for disassembly. A bit of diversion for your helpdesk people. Generally a torx screwdriver will do the job (and invest in an electric screwdriver if you have more than a couple to do). Once the platters are taken out of the 'box' they can be scored, and then bent in a vice (no need to be gentle). You can also salvage the magnets around the voice coil arm. They're very useful around the tool shed etc (a bit too strong generally for whiteboards).

Finally, coming back to the point about asset tracking, your entire disposal/destruction strategy should be built around a executive-endorsed policy, and should include 'observation' and sign-off on the process of destruction by a third party if warranted. It's good for the company, but even better for your 'peace of mind'.

I understand that the data recovery companies have a clean room with working copies of many hard drives. For a failed drive, they open up the failed drive and transfer the disks* to a working version of that drive.

(That's how they can recover the data that someone failed to back up!)

*("disks" should have been "platters" - but my memory blanked on that...)

When the students took over the embassy in Tehran back in the day, the embassy staff had shredded a bunch of classified documents with a "strip" shredder, the type that makes a document into long parallel strips instead of confetti. The students spent long hours reassembling the documents and garnered classified information from the reconstituted pages. True story.

I find that placing the hdd into an old cast iron wock and heating it up until it turns into a puddle of molten metal always works for me and i enjoy it so much lol lets see some one get that data !!

Using a large bit in a Drillpress and boring through the case and platters in several locations almost guarantees non-readability.

make alphabet soup! the bits start floating around, ...

How about that?

If your hard disk is not available to be read, then no one will
read it at all...

i.e. The old mafia argument: If you shoot someone, throw the
gun into a river.

Sorry, guys, just adding some humour into the argument...

DONT TRY THIS AT HOME!!!

I've got a friend who is a police officer and can tell some great stories about the guns they've fished out of the local river. I suspect that if you told them there was a hard drive filled with child porn that someone had dumped in the river, they would probably fish it out and send the owner off to the slammer.

We have found cyberCide www.cyberscrub.com/cybercide to be an excellent soution for data erasure. They have provided intensive support for our needs. Free products are generally worth what you pay for them.

I'm surprised that every article covering this topic doesn't attempt a simple explanation in terms known to many. Some definitions have changed over time due to various reasons.

Delete: Now means "moved to the recycle bin" or equivalent in the OS you are running. Data in this state is easily recoverable by tools supplied with the OS.

emptied from the recycle bin: (or delete bypassing the recycle bin, or deleted from the command line, or deleted by a system process) Basically data in this state is what you had when you deleted a file in the DOS days. The data is still intact on the drive, but it's location is now marked available for reuse with new data. In the later days of DOS there was an undelete tool. There are equivalent tools available for Windows to recover data in this state.

The above is for data at the file level. At the partition or drive level you have formating and partitioning. Data is in essentially the same state and can be recovered with software tools which are not hard to find. You may not get all the pieces to completely reassemble your deleted Word doc or checkbook file, but you can typically get enough to reconstruct the original.

Then you have overwriting or wiping or sanitizing. Again this can occur at the file, partition, drive and even targeted sectors. The overwrite can be one or many times with specific patterns or random bit patterns. If a file hasn't been deleted yet, then you can overwrite it. If you first draft plans of the better moustrap were deleted years ago, then you need to overwrite at the partition or drive levels. Data removed by these methods cannot be recovered by software means. You will need clean room lab techniques to get this data back.

Special note: Sometimes low-level formats also include a single overwrite, somtimes just a rewrite of the handful of index marks and associated tables. You should confirm before relying on a low level format to remove old data.

Degaussing has been mentioned. This can be effective. There are two reasons for degaussing. First is to refresh magnetic media which is starting to show errors. Some tapes build up old magnetic patterns which are never completely erased during regular backup cycles. They have plenty of hours of life left, but the old data is affecting the new data patterns. Degaussing can make those tapes like new. Some tapes though have timing or index marks which can only be written by the factory and deguassing makes them unusable.
The second reason is to remove old data. For this purpose you usually want a stronger deguassing field. Modern magnetic media densities require very strong fields to remove the data to acceptable levels. Just like some tapes have factory written timing or index marks, so do Zip and some other magnetic media. Hard drives also become unusable when a strong enough field has been used. Hard drives have magnets in them (believe it, or not) for the spindle motor and the head positioning. Those magnets will be altered and head alignment will be off and spindle speeds out of spec.

Finally, you have various means of physical destruction. Punching a dozen holes through the platters may or may not be good enough. Also smashing with a sledge hammer, depending on how much smashing of the actual platter has occurred. Disks can also be shredded (industrial strength metal ones for hard drives), pulverized, disintegrated, powdered, ground to dust, disolved in acids, melted, etc. The effectiveness of these methods is guaged by how small and mixed up the resulting pieces are. Similar methods are used for non-magnetic media like CDs, DVDs, etc. If the data had been recorded in bits of 1/2 micron in size, then if the disk is ground to 1/2 micron dust particles, you can be fairly sure the data is non-recoverable.

Which method you choose depends on the value of your data. Personally, a single pass overwrite is fine for the data on my home computer. My employer has data valuable enough to warrant more extensive data removal on some of it's drives. It's not that expensive compared to the cost of a data loss to a competitor or criminal.

Encryption was mentioned as well. An equally thorough analysis should be made when choosing an effective encryption package. It is a good idea to use an effective encryption package. That also greatly reduces the risk of data loss.

Step 1 repartition using differant file system

Step 2 format new partition

Step 3 remove hard drive from system

Step 4 open up your subwoofer box and place drive inside box and attach drive to magnet

step 5 crank up tunes or play with your bass test cd

step 6 remove drive from speaker box and take to
work bench

Step 7 Remove Logic board, top shell and platters

Step 8 place logic board on table saw, make several passes making several equal width strips

Step 9 turn piesce 80 degrees and repeat above step

Step 10 take remaining drive and place on drill press

Step 11 make random patterns on platters using drill bit

Step 12 take all compenonts outside to concrete pad and remove frustration on remaining parts

Step 13 place newly flattened pieces into cast iron skillet and flambay until they begin to change shape

Step 15 deliver new paper weight to local scrap yard and place in grinding unit

Where is step 14?

14. Carefully pour mixture into mold and let cool.

This step was most likely left out do to legal reasons. Someone might do this and then sue because they didn't know that molten metal is hot and can hurt you.

The reason Step 14 was left out is EXACTLY the reason stated by dlauer@ due to legal reason's. If McDonalds can get sue'd for server HOT cofee because some idiot put the cup between his legs and burned his organs, than i could get sue'd for suggesting pouring molten metal and plastic into a mold and some idiot burning their finger or other body part KNOWING that it JUST came off a VERY HOT IRON SKILLET.

The Mickey D's case was a HER, not a him.

Back to the subject at hand, how secure is the wipe feature found in SpyBot Search & Destroy? Anyone looked at it lately?

Perfect example of defense-in-depth.

ONE easy step involving "industrial heat" (mentioned somewhere above) :

Melt the thing into unrecognizable and very scant ashes with a welding/plasma/cutting torch. IT WORKS!!!

smashing can be very theraputic for some. for me i found it much more enjoyable to disassemble the hard drive. of course there are no useable parts once you are done, unless you are an hobbiest who can use stepper moters and such elsewhere. to get back to the heart of the matter, as wwood so clearly states, if you let a hard drive out of your control without makeing sure there is no sensitive info, you are inviting all sorts of possible trouble. good article and thanks for the reminder.

I have always wanted to turn an old drive into a speaker. Don't know if it would erase/corrupt the data but it sounds like fun.