2

So there are several RAID configurations to chose from, and I was wondering, eventually I expect some 25-45% of my drives may need to get swapped for a warranty repair. I know that there is no hope of privacy for a drive that came from a RAID1 config. Can anyone suggest whether any data can be gleaned from a single RMAd drive that was part of RAID5, RAID6 or RAID0+1 ?

By data, I'm talking about operational data from a *.doc, *.xls, flat text files, etc.

1
  • 1
    Major manufacturers you can pay a bit more for your warranty and you don't have to return defective media (including HDs). Ask you manufacturer about it if it's an important concern for you.
    – Chris S
    Oct 15, 2010 at 20:45

4 Answers 4

6

As Chopper said, a striped data format will make it slightly less convenient to recover data from your drives. If you're RMAing the drives, you absolutely cannot count on any sort of wipe operation to do much good, since the most likely failure mode prevents you from reliably writing to some sectors, and the other failure mode prevents you from verifying that you have written to them.

Consider your adversary. A professional team will have no problem recovering a LOT of data from any unwiped raid drive, even if the heads are crashed. The company doing the refurbishment work is unlikely to be interested in your data, and they do zero drives and do a read/write on each sector before sending them out to another customer, meaning that only a very determined adversary would be able to recover data after that operation.

In industries where this is a serious consideration, drives are simply destroyed and not RMA'd. Operational security is considered far more valuable than the money saved by returning the drives. Large organizations negotiate discounts in exchange for agreeing not to utilize the standard warranty process, and either simply report failure rates for replacement, or absorb failure costs, depending on the agreement.

If you absolutely must RMA the drives and retain data security, your only option is full disk encryption. This will impact your performance significantly, and require you to enter a passphrase by hand every time the machine boots.

If you can budget any money for this, buy better quality drives. If you really expect a 50% failure rate over the expected life of your drive array, I'd wager you're not using enterprise class hardware or are planning to keep it far beyond its useful lifespan. Buy enterprise grade drives and replace your drives and arrays with newer hardware within a reasonable timeframe.

Pragmatically, if you simply want the most convenient solution without spending further money or sacrificing performance, use a striped data format to make it less convenient to recover data, and use a disk wiping utility like DBAN to remove as much data as possible from failing disks before you RMA them. Depending on your security needs, drives with crashed heads that won't wipe significant data should be destroyed professionally rather than RMA'd.

If you want to read an interesting report about failure rates of consumer-grade drives in a very large organization, Google's report on that is quite interesting:

http://static.googleusercontent.com/external_content/untrusted_dlcp/labs.google.com/en/us/papers/disk_failures.pdf

8
  • Paul: A good answer. My assumption then is that by 'striped' what is occurring is something like 1-4K of contiguous bits are written to one drive, and the next 1-4K of contiguous bits go to drive #2, and so on. Accordingly, for all cases except for a head crash, I'll try DBAN or doing multiple writes of random data (e.g. using Linux 'dd') to the 'sick drive'. Oct 15, 2010 at 22:50
  • Perhaps not perfect, and perhaps magnetic domains persist at the fringes of the overwritten (DBANned) tracks... but good enough, considering, for example a 4-disk RAID5 might have 1/3 of the source document data in multiple stripes of a single drive. Oct 15, 2010 at 22:52
  • Incidentally, NSA, & other gov't agencies... just because I mentioned I might be using RAID5 doesn't mean I am... I might just be messing with you. Oct 15, 2010 at 22:53
  • By the way, the NSA has a really nice lobby. Surely receptionists, but nice lobby. Oct 15, 2010 at 22:54
  • The issue with DBAN isn't that the data is still recoverable after being written. The issue is that modern drives remap bad sectors and tracks on the fly in firmware, leaving the "bad" are in an often very readable state, even if the drive hardware itself sometimes has errors reading it. Oct 19, 2010 at 6:28
1

Any levels that stripe (i.e. 0, 3, 4, 5, 6 (DP), 10, 50, 60) will at least make it PRETTY/VERY hard for someone to get data from, especially as you're likely to be sending them in 'broken' but there's really no substitute for properly wiping them if it's that important to you. You can always set full disk encryption over the array too but this may slow the array down of course.

1
  • Keep in mind that the amount of data recoverable from any striped drive is going to be proportional to your storage efficiency (i.e. if you have 4gb usable out of 5gb physical, the recoverable data will be 4/5 of your base array capacity). Granted, recovered data with only one out of every 4 stripes is often less useful than data where you have every other stripe. On the other hand, you have a sample of the whole array, meaning any given drive is more likely to contain some confidential information. Oct 15, 2010 at 22:36
0

If you're returning drives to the manufacturer/seller and want data privacy, wiping the drive properly is what you want to do, rather than use a particular RAID configuration. Your RAID level should be determined by your performance, redundancy, and cost needs instead.

Edit: Wiped "properly" means properly for how much money/time you want to spend vs the sensitivity of the data. At our datacenters, we use a special degausser + drilling to destroy drives. For just wiping drives via software, a tool like DBAN can work.

2
  • Degaussing + drilling is a pretty decent solution against most adversaries. I've worked with people who lived by the mantra that "if there is any smooth area of the disk left, we can recover that data." They were recovering 50%+ of the data from drives that had been "wiped" using the USMC method (buckshot at point blank), as well as from drives that had been commercially degaussed. Granted, the lab had millions of dollars worth of equipment, and it took a lot of effort to recover that data, but still... Oct 15, 2010 at 22:08
  • When allowed to finish completely, their results showed that a tool like DBAN actually did a better job than the degausser. The drawbacks are that is incredibly slow, doesn't work for failing/failed disks, and isn't absolutely complete on modern drives that map bad clusters in firmware. Oct 15, 2010 at 22:12
0

Degaussing your disk should suffice

1
  • No, it almost certainly will not, if the adversary is particularly motivated. That simply prevents the disk itself from reading its media (and often destroys the more sensitive portions of the disk hardware into the bargain). Polarity differences between individual sectors can still be determined readily with proper equipment. Oct 15, 2010 at 20:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .