Cheap Bulk Eraser for Hard Disks?

cute-boy asks: "Recently I had to replace some hard disk drives from the same batch which had failed, while still under warranty. Because the drives were no longer recognized by the SCSI controller, it was not possible to erase the data on them. In view of the sensitivity of the data contained upon them, and the chance this was still forensically recoverable, our company decided to buy new drives rather than risk the disclosure of their contents by returning then to the supplier. How would you non-destructively (physically) destroy data on a hard disk without access to a bulk eraser? Obviously in this case it's a bit late to be thinking of using encryption."

Comments

Why no physical?

[daeg]

Why are you against physical destruction? Let your IT department have a field trip to an abadoned parking lot with some sledge hammers.

Re:Why no physical?

[bhmit1]

A bulk eraser, aka degausser, will destroy not only the data, but also the factory written tracks. The end result is that the drive can never be used again. This may invalidate the warranty if the manufacturer doesn't offer the "send back the face plate" option. Not to mention, most of these degaussers cost 10 times that of a replacement drive according to a quick google search. Considering your line of work, make sure you pick drives from manufacturers that allow replacements without sending back the data.

Re:Why no physical?

[alienw]

I've never seen cast aluminum used for the cover. Usually, it's a relatively flat piece of stamped metal. It has filters and stuff built in, so you can't just replace it, but it's just a cheap piece of stamped aluminum. Anyway, the reason the manufacturer won't accept faceplates for warranty claims is due to several reasons:
- they can't verify the drive has actually failed
- they can't verify the drive wasn't physically damaged
- they can't refurbish the defective drive
Most drives you send in are actually rebuilt or reformatted. The warranty replacement drive you receive is someone else's failed drive. Because most manufacturers don't perform proper verification, it's not uncommon to get a defective or about-to-fail replacement. I would never use a warranty replacement drive for even a semi-important application, and certainly not in a server.

Re:Why no physical?

[iq in binary]

Having seen faceplates and knowing what basic function they have to serve, and being a machinist......

You could knock another faceplate out tha would serve the same purpose for less than $5 in material and maybe an hour of your own personal time. Assuming you had the machines and tooling.

Actually a lucrative thing to do, if you have the resources :-P

Re:Why no physical?

[Wwolmack]

Breaking hard drive platters is not easy, and given a significant level of paranoia, physically snapping the platters in half may not be enough.
Degaussing the drives may not be thorough enough, given various anecdotes about the ability to recover data off almost any drive using fancy super-expensive equipment.

Unless you've got IBM Deathstar 75GXP's (and if you do, well your data is already as good as gone), your platters are probably metal. Even if you have Deathstars, their platters are glass and are susceptible to the method below:

Metal melts. Magnetic metals lose their net magnetism below the melting point. So find somebody with a kiln, and turn the platters into inert blobs.

You are stuck with these drives. You can't return them for replacement, and if you keep them and still get a replacement, the data is still on the platters. You could just send them to a data-destruction company, but where's the fun in that?

Re:Why no physical?

[hey!]

At my workplace we had a couple of these for the express purpose of erasing hard drives, and following the instructions we waved them on the outside of the case and found they did nothing. We even opened the case of one hard drive and placed the magnet directly on the platter, leaving it there overnight. The PC with that hard drive rebooted without any problems.

Obviously you failed to placate the God of Technological Peversity.

As a result, yoru computer has become a revenant. Expect it to show up in your bedroom some night playing Paris Hilton MP3s over the computer speaker.

Next time, sprinkle fresh chicken blood on the platters and let it sit for a day. I gurantee the computer won't boot.

Re:Why no physical?

[markhb]

Dude, you work for an organization that can cure acute constipation remotely, just by sending a letter. I would be very surprised if there were a deal you couldn't work out.

Physically destroy the platters

[GarrettZilla]

Open the hard drive (get some Torx T-7 through T-9 bits first, you'll probably need them), pull the platters, and sand them.

Re:Physically destroy the platters

[ryanhos]

Won't that just round the corners off the windows and smooth out the text so it doesn't look so BuMpY?

Re:Physically destroy the platters

[mrbcs]

And while yer at it, pull out thoses monster magnets inside! They're lots of fun! Especially the ones from those old quantum bigfoots. It's damn near impossible pulling them off a piece of steel. Great for magnetizing screw drivers.

If you've got your heart set against the physical

[voice_of_all_reason]

...and they can be quite fun... I guess your only option is to open up the new drives, swap the platters, and erase the data that way. Then swap the platters again if you wish so that they're (technically) new again.

Never tried it myself, though everyone on the intrawebs largely agrees that there are legions of the mighty dust army waiting breathlessly for you to crack open the drive so that they can invade it. There is apparently no invention of man capable of withstanding their attack, meaning a high possibility that if you perform this operation and then plug the drive back in, a single dust atom will be all that is needed to whir around frantically in the formerly pristine environment, loosing the veritable fires of Hades on your poor machine until it erupts in a wild, flaming mess, sending shards of platter in all directions to seek the soft flesh of babes and women.

So yeah, they don't recommend doing that.

Or maybe try somebody like these folks

[GarrettZilla]

http://www.semshred.com/content291.html

Special return options...

[Fallen Kell]

Well, most all hardware manufacturers will offer you replacements even without sending back the complete drive. You need to contact them by phone and setup the special RMA. For instance, we can't send back any of our disks if they fail due to the data. We can only send back non-electrical and non-memory containing parts. A lot of times we simply send back the cover plate to the disks. I know for a fact that Seagate and Western Digital will take back disks like this if you explain the situation.

Also depending on who your vendors are, you can usually upgrade your service so that you do not need to send back failed disks. Dell for instance has this as part of one of there higher level support contracts.

Top cover?

[Anonymous Coward]

I've heard that most HD manufacturers understand this common problem, and will allow you to remove and return only the top cover (with the complete model/serial number sticker still entact) of each failed drive as proof that it was destroyed. You should ask about this when requesting an RMA number for your batch of dead drives.

I've heard somewhere

[vadim_t]

That some companies have a deal with the hard disk manufacturer that they'll ship only the drive's cover when it fails, and destroy the rest. Not 100% sure if this is possible, but if your reason for wanting to wipe the drives is getting a warranty replacement, you might want to consider that.

Otherwise, use thermite, and lots of it. It's cheap and fun.

Did you talk to tech support?

[Bombcar]

Maxtor, Western Digital, and Hitachi all replaced drives that we'd sold into sensitive environments with little fuss. Hitachi needed a signed form faxed back, Maxtor & Western Digital needed the top cover of the drive.

Introduction to slashdot groupthink...

[IANAAC]

Highly recognizable keyword(s) + question mark = highly qualified answers from first posters who never made it past the first sentence.

It's because they don't know the answer

[Travoltus]

to the pertinent question.

There is probably no such thing as a cheap and effective bulk eraser. We have an agreement with Maxtor (now Seagate) that allows us to send in the chassis for a replacement, minus the platters. The replacement contract is expensive, though, but we need it since we have a LOT of banking data.

Re:Magnet!

[Nutria]

Magnets! They might bend the heads and scratch the surface, making if that is what you cann 'non-destructive', but it always works.

The military doesn't think so.

There's

• Software wiping (MilStd 5220.22-M)
  
• Degaussing (MilStd 5200 28-M)
  
• Destroying the platters. "destroyed by melting, incineration, crushing, or shredding."

This is more difficult than you think.

http://cc.uoregon.edu/cnews/summer2005/purge.htm

For example, see the March 2004 Network World article "Inside the DoD's crime lab," which recounts how the Department of Defense computer forensics lab has been able to successfully recover hard drives that have been "thrown off of balconies and even shot with AK-47s, as in one recent battlefield case."

So, hitting with a sledghammer doesn't seem very effctive.

A power drill and wire cup brush (http://shop.com.edgesuite.net/ccimg.shop.com/2300 00/230300/230375/products/lg_33486043.jpg) would definitely work, as would various acids (which have hazards of their own).

Re:If you've got your heart set against the physic

[alienw]

They are not hermetically sealed, but they are sealed against dust, so yeah, opening it will fuck it up pretty fast. But it will run for 20-30 minutes before it craps out.

SCSI controller or on-board electronics problem?

[AJWM]

the drives were no longer recognized by the SCSI controller,

A problem with the SCSI controller, or with the drive's on-board electronics?

If the former, just replace the controller. Check this by moving the drives to a box with a working controller.

If the problem is the on-board drive electronics, then using a working drive of the exact same make and model, carefully undo the 3 or 4 screws holding the circuit board to the drive and swap the board from the good drive with the board from the bad drive. If this was the problem you should now be able to access the data on the old drive.

I've done this with a Seagate Barracuda that had its electronics fried because of a catastrophic power supply failure (detonated one of the chips and vaporized a couple of circuit traces). Swapping the board from an identical drive (I had a bunch around) let me recover the data. Not knowing the condition of any circuitry within the drive itself, I retired the drive after copying off the data. I would have erased it too but I was planning on disassembling it anyway.

(NB - even the same make an model number doesn't guarantee interchangable parts -- I had a similar problem with a Western Digital 80GB drive that I didn't happen to have a duplicate of, although that model was still on the market. Alas there's another 4-character code after the model number (ie, the "real" model number, except you need to see the faceplate to find it out) and in the year or so since buying the first one, there were enough minor changes that the circuit boards weren't interchangeable.)

park them in the corner of your office

[MooseTick]

I recently got rid of some very OLD equipment. I had some old hard drive that predated me by 15 years. They were huge and I had no idea what was on them. They weren't IDE or MFM. They came from the day that hard drives required an external controller card. Since I needed to wipe anything that left the building I didn't have many options. I did what my predecessor and his predecessor had done.

I left the drives sitting in a cabinet where they had sat for the last 2+ decades.

Since you don't need to send the drives back to the manufacturter and you just need to be sure no one else can get the data, why don't you just sit on the drives? If they sit there for 10-20 years then even if the data were to get out in the wild it would likely be 100% useless anyway.