Security

Ask something
Discussion Locked

HDD Security - rarely discussed problem

0 helpful
14 replies

by kahunanui

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

1. We are interested in What FREEWARE app/program the TechRep people use that wipe DRIVES? We know about Darik's Boot and Nuke ("DBAN") but are there others? We've seen Disk Wipe ($50) from Dti data recovery http://www.dtidata.com/tech_support.asp but wonder what other freeware is out there that will do this.
-----------------------------------------------

THIS IS RARELY DISCUSSED but we feel extremely important:

2. As IT Pros we see the biggest problem is dealing with drives that are physically (or mechanically) unusable. Our client's concerns are that we return these drives to the various mfgs (IBM/Hitachi, Western Digital, etc.) and they want to MAKE SURE that their data won't be able to be recovered. We tend to empathize with their
paranoia. These companies receive THOUSANDS of drives back for RMA. We can see a HUGE incentive in checking out some if not all [we know how much work this would be but hey, who really knows what apps these guys have for processing this stuff quickly?] the stuff people are putting in their drives. Perhaps there is a neat little agreement
with gov't and these companies. Especially in this age of all this "terrorism" etc.

Problem is that degaussers can be expensive:
http://www.athana.com/ddequip/v91mHD.htm

We are wondering if you know whether a simple handheld degausser would be effective enough for this task:
http://www.athana.com/ddequip/v91mHD.htm

What we've found is most will tell you that it is totally inadequate for this job, in efforts to either make you buy the expensive ones designed for the task, or for plain 'ole disinformation purposes. We don't buy this answer. After all, we keep hearing about how important it is to keep the drives away from *ANY* magnetic sources and that you may lose your data (which is absolutlely true - we know from experience). And we wondered if even just extremely powerful magnets can do the trick. We recently received some that are so powerful, we almost have to keep them in the middle of the room to prevent them from stickin to something. They are almost impossible to get apart and when you stick 'em onto any metal, we better darn make sure we've got our fingers well out of the way!! Never seen anything like 'em.

We find it hard to believe that it would be less than a minor or major nightmare to recover data after you blast a drive with even a handheld degausser [see link above] or such strong magnets but wanted an unbiased and objective discussion on it. Of course we could experiment, but we'd really like to hear other comments on this.

We appreciate your help or any info you can help us with on this.

Thank you very much!!!!!!

14 replies

by don_c

Sounds like to me that you have a policy problem. Do you have a policy for bad drives and do your clients know what that policy is. My opion is that if my client was concern about there data and the drive was unusable than I give them the drive back. Then peace of mind. I had a customer with a bad drive and was on warranty he did not want to send it back to the factory for replacement He just bought a new one Since he was in research an development at his company I figure he was being careful

I hope this helps and far as disk wipe if the drive is unusable then it would be hard to run the program

by kahunanui

TimberWolf2: Mahalo [Thanks] for your comments!

No, this isn't what we're asking. This has nothing to with POLICY. Sure, there are some companies we work with where policies such as these are discussed. But we work with many different clients and have come to the point where we simply want to discuss whether a hand-held degausser and/or strong magnets like we described would do the job on a hard drive's data! How recovereable would the data be? etc... On the one hand, drives are so much more inexpensive that if one was worried about personal data, one could simply destroy the drive and forget about any RMA. On the other hand, many of us are not made of money,would appreciate the new drive, yet want to make sure their data will not be recovered. Of course, our original post already alluded to the FACT that unless the drive can spin up, software solutions are OUT OF THE QUESTION - hence our questions on degaussing.

We hope that others may be able to offer something more tangible and specific on this.
Thanks again.

by hal 9000

Short of melting down the whole drive in a blast furnace you can always recover data off the drive no matter what has happened to it {provided the platters are still more or less intact.}

Even drilling holes through a drive will not stop someone with the time and resources in recovering data and there currently is NO way to totally remove data from any HDD.

As a matter of prinicipal I don't return any business drives under any circumstances once the company gets their hands on a HDD it always stays as that companies property and even when the computer leaves the business they retain the HDD.

This is the only way to make perfectly sure that DATA does not leak.

Of course for any "Home" user things are different unless otherwise specified.

by thechas

A dead drive that is under the drive manufactures warranty is indeed a problem.

1 issue I see with degaussing the drive is that you may damage the magnets for both the head and spindle motors.

This could result in a denied warranty claim.

I would start by working with the drive venders, and getting a written copy of their procedures for handling returned drives.

Next, see if you can arrange for the return of the platters from dead drives.

Physically destroying the platters is the ONLY way to assure that any data cannot be recovered.

I recall an article or discussion where a peer had a similar issue with the drive from a police department computer.
He was able to get permission from the drive manufacture to physically destroy the drive before returning it.
A few minutes on the target range produced a fully non-recoverable drive.

Chas

by shekinahguild

Go get a large magnet.. any large magnet. If you can only get small magnets, then glue or tape them together.

Spin up platters, place magnets on top of platters.... hear step motor whine away as dimagnetic field engages slowing down the disks...

You have now destroyed the information on this drive forever... no recovory, no hope, no reuse, and no data company in the world can help you.

works for me :)

by kahunanui

Interesting, but not according to some of the few that have input response(s) to this discussion.
We tend to agree, however, whats more interesting
that anything so far, is when we note the few responses and contributions to this discussion. Actually, it is exactly what we suspected. We feel that this shows that there are very few out there who can really offer tangible PROOF towards what it is we are asking. It would seem, that few really know intimately about this subject. As mentioned in the very beginning, we noted how little we can find on the subject...kinda like Voodoo...not many people know about it much less understand any of it.

Hopefully, we can generate some more discussion and gain input from some who can really offer something tangible. Otherwise we shall believe that either:

1. Nobody else cares to input anything about this.
2. Nobody else really knows anything about it.

by aaronh

What most people are avoiding is the proper discussion of managing the risk of exposing data on the drives that are being returned to the factory or thrown away. This thread started off with some reality as to what a manufacturer is up against: hundreds of returned drives a day with varying problems, defects and from different OS and hardware platforms. Even if they were to conspire (cooperate) with a government agency to provide them access to these drives, the sheer size of the task would make it impossible to scan all of the drives. So, what you really see is target cooperation where the hardware companies turn over returned hard drives from specific companies and persons of interest. The rest just get tested and refurbished or destroyed.

To expand on some of technical details of this problem, yes, just about any handheld degausser will render it impossible for a normal adversary using commonly available tools to recover the information from a hard drive. Would the same handheld degausser stop the NSA from getting the information? No. The reason why all but the most expensive degaussers cannot assure data destruction is because of the density of information on hard drive platters is so high now that the magnetic energy (gauss) required to completely scramble it can barely be produced without disturbing everything around it. I have researched purchasing several of the $10k plus degaussers and determined that the life span of the device is too short. As the density of new hard drive technology increases so does the required amount of energy to destroy the data patters on the platters. If you have a standard set of technology, say 40 gig drives, that you are trying destroy then you can purchase a solution that will be able to perform this reliable and continuously. However, as soon as you upgrade all of your 40 gig drives to 80 gig drives that same degausser will probably no longer be able to properly disrupt the information on the platters.

A little long winded. The reality comes down to what security related question should always be based on. The threat: Do I really believe that some one is going to attempt to recover the information from my returned or disposed of hard drives by any other method other than just putting it in a computer and seeing if there is any data on it. If this is the threat then a nice hand held degausser should meet your requirements. (This is type of ?recovery? has been the most common and embarrassing type portrayed in the news. Drives that were formatted, which of course is essentially a useless procedure from a security perspective, and then put back into computers and recovered.) If not, and you feel that you are potentially the target of sophisticated and well funded adversaries, then you need do one of two things: Purchase and continually upgrade your degausser to ensure that it covers the density of drives you are trying to wipe, or, remove the platters from the hard drives and run them through a metal shredder. My government organization shreds them.

by kahunanui

What an interesting answer... similar to what TheChas is saying...

So are we all being totally deceived by believing these degaussers WILL remove data from these drives?! Enough for gov't agencies and such?!

http://www.datadev.com/government.html

Is this all just a bunch of Snake Oil that all these agencies are believing in?

Your answer doesn't seem to take into consideration that we are only dealing with magnetic data. If we completely ALTER this data, to the point where it is considered DESTROYED compaired to what it was, how on God's earth can it be RESTORED the way it was?! Because if what you say is true, than all these other Security data wipers (that wipe files/folders and free space) are all Snake Oil also?! All they do is alter the data so it is allegedly unrecoverable.

How can this be so?

We've had personal experience with a lot of data recovery software (simple to high end stuff including AnaDisk) but not much when it comes to "Clean Room" recovery.

by hal 9000

Being told what to believe as what is passed off as Mil grade apps are just that they will make it impossible for most people to recover data but Government agiences are a different story or for that matter anyone with enough resources to afford the equipment. But it is possible to load a HDD 1,000 or more and still be able to read indivual layers of data off the drive.

Sure it is expensive but it is possible it all depends on how highly you value you're company Data.

But then again I'm biased as I saw one of my ex-clients go somewhere else and get ripped off as he took his new HP back for repairs and within 6 months was out of business as somehow his DB was put into his rivials hands who where just starting out and that computer was a stand alone unit that was not connected to anything other than the mains but it did leave his place of business 3 times within the first 6 months for 'Repairs."

Then there was a Government Department who sold off some old computers and I was called in as a witness when DATA was recovered of their HDD's so that whoever bought these computers not only had all the Data but a fully working OS as well so they could just read all the records that had been stored on the computer that they bought.

But those computers only came from the Health Department so they only had personal medical records and things like that on them. The one that I did really like was the Victorian Works Department sold off several computers and none of these came from a "Secure" area so they where justed wiped with what where the then available Comercial HDD's wiping programs and then sold on. 1 15 year old kid had one given to him and he recovered the data/OS so he didn't have to buy an OS for it and although there was nothing important stored on the computer as stated by the security protocols there was the address book which had the States Premier's {for the US friends here read that as the State Governs} personal and public e-mail accounts and phone numbers/address.

Now while these are hardly a secret that are some what restricted and are certianly not "Public Domain." But the computer in question didn't come from a "Secure" area so there couldn't have been anything important on it could there?

by hal 9000

That happened here last year. South Austrralia sold off some computers from non-secure places seems that they just ran FDISK and then put them up for Auction as they held no important data and where not considered as potential dangerious units.

Well they where sold at auction for whatever which was probably next to nothing and some guy bought one for his 12 year old kid who promptly recovered all the data which included the address book which had the South Australian Premiers e-mail address {for our US people here that is sought of equivelant to a State Govener.} It seems that this kid didn't know what he had and just sent e-mails to everyone in the address book asking for money to be paid to him. After a prolonged Police investigsation {which cost more than they made in the sale} they found the culprit but as he had only asked for money and not tried to gather this by any nerfirious means they had to let him go.

But it does just go to show what is on a HDD even on non-critical computers. After all how important is and address book?

Me I'd go with the metal shreading option and just fit a new HDD unformatted its safer and there is no posibility of any comeback.

But you forgot places like Singapore who are a bit parinod about what their citizens get up to as they already have their own section to hack Personal COmputers just to see what their citizens are up to they do this through Simtel the State owned Telecomunication group so would you honestly trust any HDD that had to be returned to Singapore not to be first checked for the data contents?

Granted I'm paronid but I still believe that an IDE HDD is a lot cheaper than running the risk of loosing control of you're data after all what does one cost to a Government agency and what are the potential damages involved if the data was to get out? To me it is cheep insurance just destroying these drives when they either fail or become redundant.

by jeromey

I create a boot disk with a debug script that wipes out the drive and the boot sector.

==========
BEGIN BATCH
This file can be autoexec.bat or any other that can be manually ran after booting to disk
===========
@ECHO OFF
ECHO PLEASE WAIT ERASING HARD DISK...
debug.exe

by hal 9000

They used to have a downloadable program called wipe & zap. Wipe could be run from a basic DOS prompt and would write 0's to every sector of a HDD. Zap on the other hand would only overwrite the File Allocation Tables or whatever was on the drive.

This worked fairly well on drives that didn't have any critical Data on them "like Home Computers that where only used for games" but I never took the chance with HDD that had critical data on them and this also covered "Home Computers" where Electronic Banking was performed on them as I could never take the chance that the data would not be recovered costing my clients dearly.

by tomsal

...and I'd pay anyone TWICE the cost of the drive itself if they'd restore it.

First if the data on the drive isn't that important (ie mostly just games and personal pictures, etc.)

I just dump it..could care less if people see that stuff.

BUT if the drive is very important I have fun killing it :)

Take my trusty sledge hammer, whack the platters -- they shatter into MANY pieces.
Then those pieces are put into my little metal cup ..then I get the ol' propane torch going and melt it.

All this is good for relieving stress too..generally have AC/DC playing in background during the bashing..lol
ok I'm a strange man, perhaps I shouldn't of said that.

carry on. :)

by hal 9000

And then attack it with a propane torch till all the magentic material is burnt off the platters.

Of course it was a lot easier when IBM had those glass platter drives as they made a lovely mess when you just dropped them and they rattled quite nicely.

As a general rule I only take these precautions when it comes to business HDD's and I'm not all that concerned about domestic HDD's unless of course they use electronic banking and then you have to treat the HDD's exactly the same as business drives as the posibility of getting the bank data recovered is just too great.

This discussion is closed to new replies.