Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

As storage technologies change over time, using different encodings and remappings to deal with sector errors, the best way to permanently erase/wipe/shred data changes also.

Methods for flash drives and other solid-state drives are covered nicely at Jesper Mortensen's answer on SSD erasure.

Various methods for hard drives are described at http://en.wikipedia.org/wiki/Data_erasure and include

Does the ATA "secure erase" cover all modern hard drives and interfaces?

Are there modern storage devices besides SSDs that require something different?

The other option I've heard of is always encrypting everything you send to the drive yourself via something like Truecrypt. If you do that, it would seem that you have to be able to securely destroy the keys when necessary. And in the absence of a neuralyzer, does human memory of the password render any hard disk encryption schemes vulnerable to data recovery?

share|improve this question
2  
Maybe you should break this up, this covers, IDE, SCSI, SATA, and SSD. These drives use different recording methods, densities, and controls. For example a low density IDE drive may be recoverable if track fluxes have wobble, but high density SATA drives are not. –  this.josh Jul 29 '11 at 7:55
    
@this.josh - I intended to cover non-SSDs - that's why I split SSD out by referring to the other answer. From what I've heard so far, there is enough similarity in how the others should be approached that it makes sense to cover them here - e.g. if secure erase doesn't work for a particular drive then fallback to a simple overwrite of the raw disk should work. If there is a better phrasing for that than "hard drive" (rotating disc?), let me know. –  nealmcb Jul 29 '11 at 20:22
1  
What matters is remence of data after rewiting. I can think of two factors that may cause remence: difference between the area changed by the write head and area sensed by the read head, and linear and track precision. As linear density and track density increase there is less area for remence due to imprecision. There is an order of magnitude difference between drives manufactured in 2001 and 2005. If you go back to 2001 densities, could a exceptionally well resourced atacker find remence? –  this.josh Jul 29 '11 at 22:13
1  
@this.josh Right - "it depends". So I guess as I see it, we might as well have a single question for hard drives, since a good answer will inevitably need to give a risk-sensitive process for deciding what to do, and there is enough similarity in the various hard drive technologies and answers that having them in one place is useful. E.g. depending on the threat level and technology, people will want to know how to decide whether a single overwrite is suitable or whether one of Gutmann's methods would be cost-effective. –  nealmcb Jul 29 '11 at 23:23
    

8 Answers 8

The only NIST approved method to securely erase a hard drive is by utilizing the secure erase internal command - documented at the Center for Magnetic Recording Research (CMRR) - and that is what everyone should be doing. It is an ATA command, and covers (S)ATA interfaces.

After that, you can optionally degauss the drive to erase the firmware itself.

Lots of interesting info in Guidelines for Media Sanitization, NIST SP 800-88 (2006).

A quote from the paper

Secure Erase

An overwrite technology using firmware based process to overwrite a hard drive. Is a drive command defined in the ANSI ATA and SCSI disk drive interface specifications, which runs inside drive hardware. It completes in about 1/8 the time of 5220 block erasure. It Was added to the ATA specification in part at CMRR request. For ATA drives manufactured after 2001 (Over 15 GB) have the Secure Erase command and successfully pass secure erase validation testing at CMRR. A standardized internal secure erase command also exists for SCSI drives, but it is optional and not currently implemented in SCSI drives tested by CMRR. SCSI drives are a small percentage of the world’s hard disk drives, and the command will be implemented when users demand it.

A more recent (2010) short presentation from NIST that compares different erase techniques and their limitation is in a ppt presentation by Lyle and Russell.

share|improve this answer
    
Thanks. Also, you might specifically note that the HPA (en.wikipedia.org/wiki/Host_protected_area) and DCO parts of the disk would be missed by normal software using the OS to erase the drive. But ATA secure erase will generally still erase them - see Accessing HPA and DCO Areas on Hard Drives « Data Destruction Topics. –  nealmcb Jul 29 '11 at 5:07
    
I Noticed on this page ata.wiki.kernel.org/index.php/ATA_Secure_Erase about secure erase that it mentions the hdderase command you linked to but does say that "controller support is spotty at best" so perhaps one to be aware of –  Rоry McCune Jul 30 '11 at 10:55
    
Also from consulvest.com.au/UserFiles/Page/UserPages/hdd_sanitisation.php you need to watch your tech using secure erase as "although SCSI, SAS and Fibre Channel drive specifications classify the Secure Erase Implementation as "optional". To date it is unknown if any SCSI, SAS or Fibre Channel drive to support the Secure Erase technology. " –  Rоry McCune Jul 30 '11 at 10:59
    
@nealmcb Yes, I should have mentioned that. That is one of the most important uses of secure erase, and the reason most forensics people used it in a lab I used to be. –  john Aug 1 '11 at 14:36
    
@RoryMcCune From my experience, most of today's controllers support the normal secure erase command. I guess support for the enchanced version is not that good. But you can try it yourself at your disk, just start the program and it will report if it's supported or not. Don't worry, there are confirmation steps before the command :-) Now on the drives side, I have noticed that there are issues with the support from a lot SSD drives. –  john Aug 1 '11 at 14:40

From a theoretical standpoint the idea of total drive destruction may be the only way of destroying data on a hard drive fully.

From a practical standpoint, I've not seen any evidence that it's possible to recover meaningful data from a standard hard drive (ie, not taking SSDs or other devices that use wear levelling or similar technologies) after a once over wipe from /dev/zero or similar.

There's an interesting article here, that goes into some depth on the opinion that a single pass wipe is sufficient.

Some good additional information from the links provided by @woliveirajr seems to confirm that point. From This paper

This study has demonstrated that correctly wiped data cannot reasonably be retrieved even if it is of a small size or found only over small parts of the hard drive. Not even with the use of a MFM or other known methods. The belief that a tool can be developed to retrieve gigabytes or terabytes of information from a wiped drive is in error. "

And from this document on the subject of using MFM for retrieving data from a disk

Extrapolating this (and forgetting that an 80GB drive from 2006 does not compare in the resolution requirements of a 1Tb drive from 2008 ) it would be expected that a complete image of a 1 TB hard disk platter would take around 89 years to completely image using an MFM based technique.

Update: Another interesting answer on this topic from the Skeptics site here, has some good information and links on the subject of single pass wipes being sufficient.

share|improve this answer
    
I'd think a once over wipe would miss remapped sectors, journal data, etc, which is why there is a specific ATA secure erase command. According to the SSD answer I cited, it also is inappropriate for flash drives. So that article seems off base. –  nealmcb Jul 28 '11 at 15:21
2  
well remapped sectors only occur (AFAIK) when the sector is marked as unreadable, so it could be argued that no usuable data is present. For anything higher level than that (eg, File system journal data) a command like DD would (again AFAIK) overwrite everything if done on the entire device. –  Rоry McCune Jul 28 '11 at 15:29
1  
interesting. From the wikipedia article it looks like user data is not typially stored in the HPA, so for the purposes of reliably deleting your data from a disk would it matter that it's not covered? –  Rоry McCune Jul 29 '11 at 6:47
2  
One thing on the secure erase though, aren't you reliant on the controller manufacturer having correctly implemented the command? From ata.wiki.kernel.org/index.php/ATA_Secure_Erase it mentions that " controller support is spotty at best." for the hdderase utility –  Rоry McCune Jul 30 '11 at 10:54
1  
well each to their own on this one I guess, I'm a bit leary of a claim that this is always implemented correctly given the known problems the the implementation of it on SSDs (eg, usenix.org/events/fast11/tech/full_papers/Wei.pdf) whereas dd is an extremely well known unix command that would (for most purposes assuming you don't need unwriteable areas covered) handle the job :) –  Rоry McCune Aug 2 '11 at 6:44

Do you need to erase the data, or do you need to persuade other people that the data has been erased?

(I will only talk about 'entire disk' wiping; I'm not talking about wiping single files or slack space.)

As far as I am aware there is no software package that claims to be able to recover data that has had a single overwrite. There are no companies that claim to be able to recover such data. There are no research papers that have shown such data recovery. So, for most purposes (risk:cost analysis) a single overwrite of all 0 is fine.

But then you may have to persuade auditors that the data has gone. And maybe, just maybe, there is a super secret method used by TLAs to get that data. So, secure ATA erase first, then physical destruction of the platters and firmware, is enough to convince everyone that the data has gone.

share|improve this answer
    
A brief comment about Wikipedia: WP is about verifiability, not truth. Their "reliable sources" policy means that 'someone can use $TECHNOLOGY_X to recover data over-written just once' (an idea which appears in many places) will appear in the article, even if it's not strictly true. –  DanBeale Jul 30 '11 at 17:49
1  
"the multiple overwrite approach is not very much more effective than a single overwrite since it does not do much to the remaining track edges where most of the very low level distorted remnant data remains after an overwrite and it takes a lot more time"Center for Magnetic Recording Research 2008 –  this.josh Aug 1 '11 at 18:26

As storage technologies change over time, using different encodings and remappings to deal with sector errors, the best way to permanently erase data changes also.

Very smart people have expended enormous amounts of time and effort arguing over this problem. Most of them end up at the same bottom line, which is: the only method you can truly trust is physical destruction of the media. (And then those very smart people tend to argue over what sorts of physical destruction are sufficient). Keep this in mind as you start worrying about newer types of media (SSDs) which more blatantly fail the old "rules of thumb" for soft deletion of data.

The other option I've heard of is always encrypting everything you send to the drive yourself via something like Truecrypt. If you do that, it would seem that you have to be able to securely destroy the keys when necessary.

Yes, that is a viable method, and you're right about the keys. I would add: if you're paranoid enough to use this method, you're paranoid enough to have to worry about whether your opponent has the ability to compromise your (machine, keyboard, cables) in such a way as to defeat this method.

And in the absence of a neuralyzer, does human memory of the password render any hard disk encryption schemes vulnerable to data recovery?

If the keys exist, then yes, the human memory of the password becomes the sticking point. And humans often will disclose passwords under the threat of physical/emotional/financial harm, physical/emotional/financial enticement, subpoena, or 'contempt of court' jail sentences.

share|improve this answer
1  
Shredding or melting the platters will work. (Well, anything that heats the platters above the en.wikipedia.org/wiki/Curie_point destroys their magnetic alignment (which is used to record the data), so that should work) –  Billy ONeal Jul 30 '11 at 6:06
1  
Aparently shredding is not a guarantee. "physical destruction is not absolute if any remaining disk pieces are larger than a single record block in size, about 1/125” in today’s drives" Center for Magnetic Recording Research 2008 But recovery looks practically impossible. "recovering any actual user data requires overcoming almost a dozen independent recording technology hurdles." Center for Magnetic Recording Research 2008 –  this.josh Aug 1 '11 at 18:20

If ATA Secure Erase is not an option or not supported on your hard drive, I'd recommend DBAN. DBAN is a well-engineered piece of software for wiping a hard drive, by performing multiple overwrite passes at a very low level. As a result, it is time-consuming but very thorough. It includes methods based upon Gutmann's research, DOD standards, and other research -- and it is easy to use.

Caution: DBAN is only suitable for use with hard disks (magnetic storage). It is not appropriate for flash-based storage, such as SSDs.

DBAN does not erase the Host Protected Area (HPA) (often used to store a recovery partition for your OS, and thus probably relatively low-risk). DBAN does not erase remapped sectors (i.e., blocks marked as bad) unless you specify a particular option. I would expect remapped sectors to be rare. DBAN does not erase the Device Configuration Overlay (DCO) portion of the hard disk (stores hard disk configuration; I would expect it to be relatively low-risk in most settings). If these are a concern, use ATA Secure Erase. Despite that, I expect DBAN to be good enough for most users with magnetic hard drives.

For relatively modern hard drives (ones that support ATA Secure Erase), I recommend using ATA Secure Erase. But if, for whatever reason, ATA Secure Erase is not available (e.g., you have a SCSI drive; you have an older hard drive that doesn't support ATA Secure Erase), DBAN is probably more than adequate.

Be very careful when using DBAN! It will irreversibly destroy your data.

share|improve this answer
    
So why does NIST specify Secure Erase instead? Perhaps because DBAN misses reassigned blocks, the HPA and DCO areas, etc? See e.g. destructdata.com/blog/?page_id=282 –  nealmcb Aug 1 '11 at 17:30
1  
nealmcb, I can think of two reasons. (1) DBAN is open source. NIST very rarely recommends any open source projects due to the inherent volatility of that type of project. Furthermore they wouldn't risk introducing untrusted software to an organization. (2) DOD 5220.22-M, the good old 7 pass technique (re: DBAN), relies on the a process of standardizing residual magnetic signature on the platters, to minimize the ability to reconstruct the data. This works on physical discs but not so well on other media. –  grauwulf Dec 4 '12 at 16:59

Hard drive destruction is not that easy. There's some theory over it, metal just loses the magnetic data when heated above certain level.

If you do a good research on google you'll find some theory about recovering HDD information using powerful microscopes and their magnetic signal.

Encrypting data before storing is the best solution, if you:

  • use good cryptography

  • use protection against someone stealing your key (by physical access to your computer, for example, intercepting your keyboard, memory, etc)

  • have time to securely erase your key when throwing away the HDD.

And that might not be that easy. Secure your computer means, for example, that no one can access it even just after you have secure-deleted-and-wiped the key.

Password is somehow related to the key. If you delete the key, the password is kind of useless. So a combination of good key + good password, losing one make the other useless.

A good combination in truecrypt is to use more than one key, each stored in a different media. For example, one in the HDD, one in the flash memory, another in a token.

Use the effort that you need according to the security you want in your information.

Finally: have you downloaded the source code of truecrypt, read it, compiled your own version? If not, how can you trust it is secure? :)

share|improve this answer
2  
Do you have any citations for the idea that magnetic force microscopy will find any data from a modern hard drive? I've heard it said many times, but not seen the data to confirm it. –  Rоry McCune Jul 28 '11 at 17:24
    
here, take a look at the bibliography mentioned in the end of this page: computer-forensics.sans.org/blog/2009/01/28/… –  woliveirajr Jul 28 '11 at 17:35
    
@Rory one PDF: vidarholen.net/~vidar/overwriting_hard_drive_data.pdf –  woliveirajr Jul 28 '11 at 17:40
1  
Thanks for those papers, very interesting. But reading both of them seems to confirm what I was saying that in practical terms data cannot be retrieved once overwritten one. –  Rоry McCune Jul 28 '11 at 19:26
    
@Rory : in general, I agree with you. Depending on the information and it's value, I'd choose my approach. I'll update my answer to exemplify. –  woliveirajr Jul 28 '11 at 19:58

Just burn them. Use a 20 liter steel drum, with ~0.5 cm holes punched circumferentially, just above the bottom rim. Dry oak, accelerated occasionally with paraffin, works very well. Only steel parts will remain.

share|improve this answer

How about filling the drive with junk data files or large media files that will assure that everything has been written on?

share|improve this answer
    
The problem is that prior writes to the disk can still be detected, after being overwritten, with some sophisticated techniques, for a variety of reasons. See the other answers for details. –  nealmcb Aug 14 '13 at 14:54

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.