18

How do you recommend destroying sensitive information on a hard drive? I've used DBAN in the past, is that good enough?

1

19 Answers 19

23

DBAN is just fine. Here's the dirty little secret--any program that overwrites every byte of the drive will have wiped everything permanently. You don't need to do multiple passes with different write patterns, etc.

Don't believe me? See the standing challenge to prove that a drive overwritten with 0s once can be recovered. Nobody seems willing to take up the challenge. http://16systems.com/zero.php

14
  • 13
    Or the $500 grand prize is a rounding error compared to the many thousands of dollars required to analyze and recover a drive.
    – Grant
    Apr 30, 2009 at 15:12
  • 2
    While true, if I were a 3LO, I wouldn't go around winning contests like that.
    – Tom Ritter
    Apr 30, 2009 at 15:13
  • 1
    Also, vendors of secure erase programs have financial incentive to try and point out where something like a simple, low level format isn't good enough.
    – TorgoGuy
    Apr 30, 2009 at 15:20
  • 2
    Wedge--If it has been demonstrated, please provide a link. I'm happy to delete my answer if shown that I'm wrong, so please show me the evidence.
    – TorgoGuy
    Apr 30, 2009 at 20:59
  • 5
    This link reports on an attempt to recover data using an electron microscope after a single pass - no data was recovered. sansforensics.wordpress.com/2009/01/15/… May 1, 2009 at 14:05
11

Anything that does a single overwrite of a hard drive is fine, including DBAN.

Some people say you have to do multiple overwrites with random data and specific patterns. This may have been true in the days of floppy disk drives (remember them?) where the area of magnetic media per byte was big enough to not get completely overwritten, but modern hard drives are much too densely packed with data for this to happen. But don't take my word for it - read this article about trying to recover overwritten data using an electron microscope.

Other options include the wipe utility, or a simple

# dd if=/dev/zero of=/dev/sda

These methods all work fine for overwriting entire hard drives or partitions. However be aware that overwriting single files can lead to some data being left elsewhere on the hard drive, particularly with journaling file systems such as ext3 and NTFS. They write bits of data to disk outside the file, so small amounts of data can escape the current file being overwritten. Also, if the partition has been defragmented since the file was first written then the original file may still exist on the hard drive.

7

I have used PGP 8.0's wipe tool with success.

Don't ever physically destroy the hardware before wiping the data with software, forensics can retrieve parts of a destroyed hard drive.

3

physically destroy the platters - it's the only way to be sure ;-)

6
  • 3
    Not necessarily. "Serious forensic efforts can throw a lot of resources toward piecing your drive together" lifehacker.com/5153684/properly-erase-your-physical-media Apr 30, 2009 at 15:07
  • not if you distribute the pieces globally ;-) other than that - WOW...
    – geocoin
    Apr 30, 2009 at 15:13
  • 2
    Nuke it from orbit (with thermite).
    – Wedge
    Apr 30, 2009 at 19:09
  • 2
    Just don't thermite the drive if you are on the second floor of a building. Otherwise the people below you might be either unhappy or dead. It's way safer to just open the drive, sneeze on the platters, then toss it into a street corner garbage receptacle.
    – Grant
    May 1, 2009 at 0:48
  • 2
    Just label the platters "Contaminated with Swine Flu" and toss them in the regular trash. May 4, 2009 at 17:51
2

It depends on how sensitive your data is. If you arn't the CIA or NSA, then DBAN is fine.

1
  • Even if you are the CIA, DBAN is fine - see link in my answer May 1, 2009 at 14:03
2

I use a hammer or sledge.

2

Yes, DBAN even at it's lowest setting is way more than enough.

http://www.dban.org/

2

I always use DBAN and then use a beltsander to the platters. Paranoid sure but i know that not even the NSA/MIT/CALTECH and all the computer geeks in Russia/China combined could recover the data! If your paraniod and want to ensure your data is never EVER EVER recovered even if aliens get ahold of it then DBAN/Beltsander it :o)

1

You should use the procedure set down in your organization's security policy.

When it comes to security, technical advice (such as you receive here) is only half the question. You also have to be able to justify your actions to an auditor. And auditors aren't so concerned with the results of your actions, but that you followed the appropriate procedures as set down in the appropriate policy. The auditor's job it make sure that some cowboy (or cowgirl) doesn't just go around doing whatever they think is right, without oversight or justification.

Of course, your organization's security policy comes from somewhere; when you're wondering what is an appropriate method to securely wipe sensitive data to put into your security policy, you'll find a number of suggestions in the other responses to this question. :-)

1

DBAN works great. However, one of the challenges that I run into in how to securely erase a hard drive that has failed, but is part of a RAID set.

I normally have to return the hard drive back to Dell, and they would not take kindly to receiving a drive with a hole drilled in it. Furthermore, it's hard to run DBAN on just a single drive within a RAID set prior to removing the drive from service. Assuming that the drive is still functional.

How do others handle this situation?

1
  • Pay the few extra bucks to Dell to allow you to keep failed hard drives. Then the disposal is up to you, and you can drill them to your heart's content. May 14, 2009 at 15:20
0

i take a drill with a 3/8" bit and drill 4 holes through the drive ... making sure to hit the platters. steve gibson of http://www.grc.com gave the advice of drilling holes in the drive on one of his podcasts a while back.

-don

1
  • 3
    ... after overwriting with zeros, otherwise there's huge areas of data still left on there ... if you're that paranoid.
    – Jim T
    May 7, 2009 at 7:55
0

Use something like DBAN. Then physically destroy the drive by smashing it into little pieces with a sledgehammer. The US Marine Corps back in the late 80s/early 90s came up with this solution while my father was still in. You may throw in a more modern technique of degaussing your HD before the physical destruction step.

0

I have seen a talk from a professor who teaches forensics where one assignment is for his students to recover data from drives that have been "destroyed" by smashing, drilling, or magnetic erasing. He said the only sure way to destroy data is to use a belt grinder to turn the platters into metal shavings.

0

I can't believe no one has recommended sdelete.exe from sysinternals. Is it really not that good at clearing out certain bits of the drives or something?

2
  • sdelete appears to be effective at securely removing files, etc, but not securely wiping an entire hard disk.
    – Mike
    May 12, 2009 at 12:49
  • 1
    If your format the drive, then use the -z option (cleanse free space) - it should wipe the free space, which is basically the entire drive. Granted, this is limited to the newly created partition so there might be a tiny bit of data at the beginning and end of the drive that gets missed - but chances are that data wasn't present/meaningful in those areas either.
    – Goyuix
    May 12, 2009 at 16:04
0

Have a look at this similar question, where I posted the following answer.

Here is a list of options for Windows, Mac and Unix.

0

Heidi.ie's Eraser is the best windows tool I've used for this with respect to a hard drive that's still in use. You can wipe an individual file, an entire drive, the empty space on a drive, or securely move a file or directory. It provides a variety of overwrite/paranoia levels and integrates seamlessly into the windows right-click context menu.

0

For a good free solution, use the 'shred' command from Knoppix . It allows you to run the command from a computer that you are discarding without needing to remove the drive first.

Boot the knoppix CD.

sudo shred -n 2 -z -v /dev/hda1

Where n is the number of randomized overwrite passes.

I also have a USB to IDE/SATA adapter that lets me hang the drive as external off the PC for cases where I want to erase a drive removed from service. Disconnect the internal PC drive for safety.

0

Secure against whom? The US government requires -destruction- of the data. You can choose between sandblasting the platters or heating them past the Curie point in a kiln. (Most people heat past melting to demonstrate due diligence).

Otherwise, overwriting with /dev/zero will stop any attacker who does not have tremendous resources. The "DOD erase" of multiple iterations overwriting with differing data is silly.

0

Some work has been done on using scanning electron microscopes to detect residual magnetic flux on hard drives. The origin of the 'seven passes with random data' notion is that this would make the flux lost in the noise from the overwritten random patterns.

In theory the SEM methods work but they are very slow - if you're really keen to destroy the data on a disk wipe it with any disk erase utility first and then physically destroy the drive. If you're feeling really keen take the drive apart, remove the platters and run them over a bulk eraser.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .