Slashdot Mirror
Secure Hard Drive Deletion Appliance?
An anonymous reader asks "I am searching for a box into which I can plug a hard drive (IDE or SCSI of various flavors) and automatically begin a secure deletion process (DoD 2250 compliant or the like would be good). This is normally for dead drives which need to be RMA-ed. Because of various regulations (HIPAA for starters), we need to at least attempt to do a good job clearing the disk. I've heard from a number of places, including this Slashdot story, that degaussing isn't great. There are software solutions out there, but in general, I want to toss a replacement hard drive in and not have to hunt around for hardware to put the bad drive in in order to run the software. Given the right case, a solid state drive, some SCSI cards and one of various pieces of software, I can imagine such a beast. Has anyone seen someone selling something like this?" No case-opening is necessary to use a USB/IDE converter, which might be a good middle ground. Any other ideas?
If you have something so important, it might be best to destroy/keep the dead drives and pay for new ones, which aren't that expensive compared to the risk of someone finding out a way to recover your data even after it's been processed by the state-of-the-art secure deletion processor.
I believe the information is secured only if it's still in your hand.
Rock that crushes, Paper & Scissors that don't matter.
It really depends upon what level of security you are talking about. Degaussing certainly does not do the job adequately enough for some purposes, but the issue of maintaining a box that has all the hardware to be backwards compatible can be cumbersome and expensive. I suspect you are not in a sensitive/classifed government position as they have protocols for this sort of thing, but if you truly have seriously data sensitive needs for hard drives you are going to retire, I would suggest first formatting the drive with multiple writes and reads of serial 1's and 0's which should prevent 99.9% of data recovery attempts. An older G4 tower running OS X, should allow you to recognize and mount drives formatted with a variety of operating systems. Stick a couple of SCSI cards in it and an ATA and SATA card (Sonnet makes a combined card) which should give you multiple SCSI formats, ATA, Firewire and USB depending upon your needs. If you are really paranoid, actually disassembling the drives, degaussing and physically destroying the platters will finish the job. Believe it or not, data can even be reconstructed at the microscopic level through the use of electron microscopy, so the more damage done to the physical media, the harder it is to extract information.
Visit Jonesblog and say hello.
The best you can do is use a degausser, since you can't open the drive without voiding your warranty.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
...44 Oz. Framing Hammer.
Just explain to the RMA operator how you work for a "major construction contracting firm"...
https://www.accountkiller.com/removal-requested
dban.sourceforge.net
http://dban.sourceforge.net/
Good hardware detection, GPL.
I have used BCWipe to declassify Secret hard drives. They have a DOS version you can throw on a MS-DOS boot disk and a linux version you can put on a livecd. Either works equally well.
See http://www.g4tv.com/unscrewed/features/45707/Dark_ Tip_Destroy_All_Data.html
have a few pieces of s/w and h/w mentioned there. use the floppy method on a standalone machine to plug your disk into and wipe it. try Darik's Boot and Nuke method: http://dban.sourceforge.net/
It basically means that everyone who works in the medical industry has to jump through hoops to make sure that anything that could compromise your privacy doesn't get out without your permission. This goes to the extent that when working with MRI images for cross-site study, we have to use custom face-removing software so that someone can't reconstruct what your face looks like from the 3d data. And even then, there are debates about how much skull needs to be removed...
sed "s/SJW.*$/... never mind. I was about to say something stupid, and also, I'm a troglodyte./Ig"
http://www.driveduplicators.com/124.html
:)
Its primarily a hard drive duplicator but it also has DoD 5220.22-M level wipe. Sorry to plug a specific product
what the heck is HIPAA?
Try the Health & Human Services - Office for Civil Right - HIPAA for some information. HIPAA is relevant to the article because it strengthened medical privacy laws.
These guys have even done the demonstration for you:
http://driveslag.eecue.com
...is my recommended approach. I actually built one of these myself, powered by an embedded Linux PC that boots from CD-ROM. It uses modular exponentation to generate a cryptographically random sector distribution list, to which it writes entropy data generated from an onboard Random Event Generator. It repeats this process 10 times consecutively, then cuts power to the drive and degausses the entire disk. This process is extensive enough to ensure that even the world's most sophisticated data recovery experts will recovery nary a bit from such a drive, and I've automated it to a plug and play process. Simply insert the drive into the degaussing chamber and attach data and power cables, then throw the switch. Wait about an hour or so, and the drive comes out irrevocably blank.
If you prize so much the confidentiality of the date to go to very extreme measures like high level gear just for that, as cheap as the HDs are now, I would just throw them inside a furnace.
Scientia est Potentia
The general rule of thumb for data security sensitive industries is to never return the platters.
Most governments have arrangements to either get a discount up front, or to get the manufacturer to accept the top cover as proof the drive is destroyed, and then provide a warranty replacement.
For everyone else it is the cost of doing business. Depending on your business the risk is measured in years in court, 7+ digit claims and real impacts on stock price. Replacing failed harddrives out of pocket is cheap.
Best thing to do is remove the platters and store them as they take up less space, and once you have enough pay a degauss service to blast the entire box. Even then, get an artist to turn them into a piece of art for your front lobby.
If the drive is faulty, you just might not be able to overwrite the info (not reliably anyways).
I'm surprised he's even looking for this. I work in a place where for similar regulations we have to wipe HDs securely before disposal, but that's only for working ones. Damaged HDs cannot be sent back because of the info on them, they have to be destroyed locally. We take the platters out, but I'm not 100% sure how they get destroyed (probably degaussed then physically damaged). The companies we buy PCs from are aware of this too. If a drive dies in one of the PCs that's still under warranty, they replace it and we keep the old drive for proper disposal.
Such a device would only be useful for disposing of old PCs with functionnal HDs in them. I can't see the regulations let them do this.
///<sig
Might I suggest the Wilton 20003 12 lb. Unbreakable Double Faced Sledge Hammer? At 12 pounds and with a shock absorbing handle, you'll find this fully OSHA-compliant device will serve your needs admirably.
And yes, this most certainly IS an Amazon affiliate link. I believe that if the submitter or other government officials purchase this mission-critical security appliance, I am entitled to my consulting fee. As for the parent poster, well... Uh, I'll buy him a beer when the windfall from this new sledge hammer gig comes rolling in.
"...all the labours of the ages, all the devotion, all the inspiration, all the noonday brightness..." yada yada
The drive housing may, in fact, shunt the field around the drive if it is ferromagnetic. (See if a magnet sticks to it)
If it were me, I'd make a nonmagnetic aluminum housing to screw the drive onto, pad the hell out of it (just incase I slipped), and head on over to Radiology, and use a 10 Tesla (or stronger) MRI to erase that bad boy. I'd rotate it in all 3 dimensions, more than once, just to make sure.
If the field you use demagnetizes to the servo and drive magnets, it'll probably be safe to return for replacement.
I agree that it's probably better to eat the cost of the drives than to risk the getting made the poster child for HIPAA. (You just know they'll looking for someone pull a Martha Stewart on.)
--Mike--
There was a two-part segment on the Screen Savers with Patrick Norton and Kevin Rose covering methods of data destruction, including software, grinding, acid, thermite...
Watch it here
SafeGuard Easy
Plenty of businesses use it to encrypt a hard drive (boot time password) prior to production. This way, if the drive fails mechanically and the data can't be destroyed (without physically destroying the drive), the data is still encrypted. As a plus, there is no need to wipe a drive since you only need erase the SafeGuard Kernel which renders it just about as useless. There was a case a while back where one of the European countries tried to brute force this software for a criminal trial and could not do so.
For HIPAA, you'll need to physically destroy a drive if it has failed mechanically and you can't otherwise wipe it.
Don't get me wrong - this software is a pain in the ass since you have to decrypt a drive using the admin software if the underlying OS becomes unbootable. But it is a relatively simple solution, otherwise.
More
The sledge hammer is the linux style solution. More work than is needed, what you need is user convience. Sledgehammers will tire you out, you don't want to do that all day long. What you need is the Remington 870 pump action shotgun. Available in assorted sizes and gauges, the 870 can erase as many as 5 hard drives in a single loading. The 870 comes in 12 gauge, 28 inch barrel for those SCSI drives, down to a .410 shotgun for those hard to wipe flash drives.
For maximum assurance of data erasure, the 870 cannot be beaten. Be sure to use number 3 shot or larger. Also available in left handed.
The Remington Gauge system follows the approved national standard, to avoid vendor lock-in. Shells from all competitors will function, though Remington shells are recommended for best preformance. Never doubt if your data was securely erased or not ever again! Come to Remington Country.
SAILING MISHAP
My point is not that there are people out to "get" other people...my point is that, if there is a security hole, it was not in what they were expending most of their effort in combating. Did they shred, burn, atomize, and scatter every last recepit from the operation? Probably not. Did they make sure nobody was secretly recording Ms. Smith while she read off her personal information to the pharmacist? Probably not, too. It seems so much "security" these days is devoted to expending vast resources on things that make very little difference. As an example, a small airport near me recently built a $500,000 "security fence" to keep out "terrorists." Complete with flashy card readers for the gate and computer accounting. Of course, if you walk 50 feet to the south, you can walk right through a corn field onto the main runway, but hey, it looks good! If people were more intelligent in apportioning their security resources, rather than worrying about ABSOLUTELY atomizing somebody's hard drive, then we'd be money ahead. There's always going to be that .03% on either end of a 6-sigma bell curve...don't worry about it.
Sorry folks, I'd rather rely on my community there than a bunch of fellow /.'s (grin). Elitist? Yar!
"[I]t is a wise man who admits the limits of his knowledge or skill, and that pretending either causes harm." --Terry Go
Nice OS analogy: allow me to embrace and extend.
The sledgehammer is a simple, solid and effective tool, yet requires a modest degree of effort. It is available everywhere there is human settlement, is cheap, and has no running costs. A sledgehammer never requires any form of licence or permit to use. It also just works.
A pump-action shotgun may be easier for the lazy or weak to use; it may even be more fun. It certainly makes it easier to harm your neighbours, or shoot yourself in the foot. Remind you of anything?