When Your Data Absolutely, Positively has to be Destroyed (Video)

Here's a corporate motto for you: "Destroying data since 1959." Timothy ran into a company called Garner Products (which doesn't use that motto as far as we know), at a security conference. While most exhibitors were busily preserving or encrypting data one way or another, Garner was not only destroying data but delighting in it. And yes, they've really been doing this since 1959; they started out degaussing broadcast cartridges so broadcasters could re-use them without worrying about old cue tones creeping into new recordings. Now, you might ask, "Instead of spending $9,000 or more to render hard drives useless, couldn't you just use a $24 sledge hammer? And have the fun of destroying something physical as a free bonus?" Yes, you could. You'd get healthy exercise as well, and if you only wanted to destroy the data on the hard drives, so what? New drives are cheap these days. But some government agencies and financial institutions require degaussing before the physical destruction (and Garner has machines that do physical destruction, too -- which is how they deal with SSDs). Garner Products President Ron Stofan says in the interview that their destruction process is more certain than shooting a hard drive with a .45. But neither he nor Tim demonstrated a shooting vs. degaussing test for us, so we remain skeptical.

Comments

Re:dd

[Hatta]

Does the DoD have evidence that data can be recovered from a zeroed drive? Or do the recommend overkill just because they can?

Re:dd

[Anubis IV]

The theory regarding how data could be recovered from a zeroed drive seems sound enough, namely that by measuring the difference between the analog signal captured directly from the head before it is converted to a digital signal, and then taking the difference between it and the digital signal, one can determine what the previous state was for each of those bits. And it also stands to reason that the various intelligence agencies who are purported to possess such capabilities would not be forthcoming in revealing their ability to do so.

That said, regardless of whether the technology exists or not, people who advocate 7-pass and 35-pass overwrites are just wasting their time, since even the author of the paper that proposed the 35-pass method acknowledged that only a subset of those passes are necessary for any particular drive, and that with modern drives a simple series of random rewrites would be more than sufficient. He even referred to the way that many people were using his technique as "a kind of voodoo incantation".

Re:dd

[Penguinisto]

And if you are buying your computers from a standard manufacturer, they cost the same as the TB drives. Might as well get the bigger drives.

As a bonus, a really enterprising sysadmin will use the (aggregate) empty desktop disk space as a de-centralized near-term backup solution. Mind you, it should never replace tapes, snapshots, etc, but...

If you can park encrypted copies of critical data around redundantly on every desktop, deny the use of that space to the desktop user, and do it in a way that's automated? Sweet. Why do it? Because you could possibly recover lost data much faster than calling your offsite provider and waiting for a tape to arrive. It also serves as a last-ditch, everything-else-has-failed means of recovering whatever data it is that you deposited there. You;d have to set up some sort of RAID-like redundancy, and a means to automatically update that data on a semi-regular basis, but damn if it wouldn't work. As a bonus, you can put that disk space to legitimate use, instead of watching it get filled up with cat pictures and web cached files from facebook. If each desktop has a TB of drive, you could slash it to 300GB for the desktop user, and take 600GB+ (mind the overhead) from each desktop for company use. Even with only, say, 40 desktops? You could get up an easy 12 TB of aggregate storage with a RAID1-like redundancy - maybe 6 TB if you had 4 copies of each chunk of data, which is still nothing to sneeze at (especially if you've priced SAN shelving as a near-line backup depot...)

(...though if you were a true BOFH, you could do the same thing, say it's for company data, then use it for your own personal stash or whatever...)

We Sandblasted ours

[billstewart]

Back in the 80s I ran a computer center that handled classified data, and we used DEC RM05 removable-disk-pack drives on a VAX. The AR380-380 regs for declassifying storage media gave us a few choices

- Degaussing with NSA-certified Big Magnets (not in MY computer lab, where I still have disks I want to keep!) - NSA-certified software. The big deal isn't just overwriting it 3-7 times to prevent the KGB from using electron microscopes on it, it's making sure that you've really erased all the data, including the spare and bad blocks remapped by the disk controllers, and if you only had one disk drive in the machine, the software needed to be able to keep running from RAM even after you'd erased the operating system including the files for your disk-wiping commands. (Too much paperwork required.) - Physical destruction. Why, yes, we're a large company with a machine shop down in the basement, and they have Sandblasters! Win!

I was no longer sysadmin by the time they closed the classified processing system. My successor got to disassemble the dozen or so disk packs we had and take them down to the machine shop for sandblasting.

Remember how ever sysadmin in the 80s used to have a disk on their wall with decorative scratches on it from a head crash? Hers was pure shiny metal.

Re:dd

[Shadow99_1]

I've done this before in an old 'server' I was re-using. As is typical this had been laying around in the server room for 7 or 8 years even after it had been replaced (once upon a time it ran WinNT). My company at the time gave me no budget and said they wanted our website (which not even 500 people a year ever looked at) moved inhouse. So I repurposed this guy and seeing as how the enclosure was designed to hold a dozen or so drive I stuffed it full of old 40 GB drives I'd pulled from desktops and set up a RAID 5 arrangement with 10 of them. Was never really any reason not to do it. It made an ok little linux webserver running a CLI environment for remote access.

Re:dd

[Synerg1y]

This:

http://mashable.com/2011/09/13/hard-drive-creations/

nobody would think to recover data from my skyline replica!