How can I reliably erase all information on a hard drive?

Question

As storage technologies change over time, using different encodings and remappings to deal with sector errors, the best way to permanently erase/wipe/shred data changes also.

Methods for flash drives and other solid-state drives are covered nicely at Jesper Mortensen's answer on SSD erasure.

Various methods for hard drives are described at http://en.wikipedia.org/wiki/Data_erasure and include

• "Secure erase", a function built into modern ATA hard drives
• Gutmann's methods for various old hard drives
• An oft-cited data sanitization method in NISP Operating Manual (DoD 5220.22-M)

Does the ATA "secure erase" cover all modern hard drives and interfaces?

Are there modern storage devices besides SSDs that require something different?

The other option I've heard of is always encrypting everything you send to the drive yourself via something like Truecrypt. If you do that, it would seem that you have to be able to securely destroy the keys when necessary. And in the absence of a neuralyzer, does human memory of the password render any hard disk encryption schemes vulnerable to data recovery?

Answer 1

The only NIST approved method to securely erase a hard drive is by utilizing the secure erase internal command - documented at the Center for Magnetic Recording Research (CMRR) - and that is what everyone should be doing. It is an ATA command, and covers (S)ATA interfaces.

After that, you can optionally degauss the drive to erase the firmware itself.

Lots of interesting info in Guidelines for Media Sanitization, NIST SP 800-88 (2006).

A quote from the paper

Secure Erase

An overwrite technology using firmware based process to overwrite a hard drive. Is a drive command defined in the ANSI ATA and SCSI disk drive interface specifications, which runs inside drive hardware. It completes in about 1/8 the time of 5220 block erasure. It Was added to the ATA specification in part at CMRR request. For ATA drives manufactured after 2001 (Over 15 GB) have the Secure Erase command and successfully pass secure erase validation testing at CMRR. A standardized internal secure erase command also exists for SCSI drives, but it is optional and not currently implemented in SCSI drives tested by CMRR. SCSI drives are a small percentage of the world’s hard disk drives, and the command will be implemented when users demand it.

A more recent (2010) short presentation from NIST that compares different erase techniques and their limitation is in a ppt presentation by Lyle and Russell.

Answer 2

From a theoretical standpoint the idea of total drive destruction may be the only way of destroying data on a hard drive fully.

From a practical standpoint, I've not seen any evidence that it's possible to recover meaningful data from a standard hard drive (ie, not taking SSDs or other devices that use wear levelling or similar technologies) after a once over wipe from /dev/zero or similar.

There's an interesting article here, that goes into some depth on the opinion that a single pass wipe is sufficient.

Some good additional information from the links provided by @woliveirajr seems to confirm that point. From This paper

This study has demonstrated that correctly wiped data cannot reasonably be retrieved even if it is of a small size or found only over small parts of the hard drive. Not even with the use of a MFM or other known methods. The belief that a tool can be developed to retrieve gigabytes or terabytes of information from a wiped drive is in error. "

And from this document on the subject of using MFM for retrieving data from a disk

Extrapolating this (and forgetting that an 80GB drive from 2006 does not compare in the resolution requirements of a 1Tb drive from 2008 ) it would be expected that a complete image of a 1 TB hard disk platter would take around 89 years to completely image using an MFM based technique.

Update: Another interesting answer on this topic from the Skeptics site here, has some good information and links on the subject of single pass wipes being sufficient.

Answer 3

Do you need to erase the data, or do you need to persuade other people that the data has been erased?

(I will only talk about 'entire disk' wiping; I'm not talking about wiping single files or slack space.)

As far as I am aware there is no software package that claims to be able to recover data that has had a single overwrite. There are no companies that claim to be able to recover such data. There are no research papers that have shown such data recovery. So, for most purposes (risk:cost analysis) a single overwrite of all 0 is fine.

But then you may have to persuade auditors that the data has gone. And maybe, just maybe, there is a super secret method used by TLAs to get that data. So, secure ATA erase first, then physical destruction of the platters and firmware, is enough to convince everyone that the data has gone.

Answer 4

As storage technologies change over time, using different encodings and remappings to deal with sector errors, the best way to permanently erase data changes also.

Very smart people have expended enormous amounts of time and effort arguing over this problem. Most of them end up at the same bottom line, which is: the only method you can truly trust is physical destruction of the media. (And then those very smart people tend to argue over what sorts of physical destruction are sufficient). Keep this in mind as you start worrying about newer types of media (SSDs) which more blatantly fail the old "rules of thumb" for soft deletion of data.

The other option I've heard of is always encrypting everything you send to the drive yourself via something like Truecrypt. If you do that, it would seem that you have to be able to securely destroy the keys when necessary.

Yes, that is a viable method, and you're right about the keys. I would add: if you're paranoid enough to use this method, you're paranoid enough to have to worry about whether your opponent has the ability to compromise your (machine, keyboard, cables) in such a way as to defeat this method.

And in the absence of a neuralyzer, does human memory of the password render any hard disk encryption schemes vulnerable to data recovery?

If the keys exist, then yes, the human memory of the password becomes the sticking point. And humans often will disclose passwords under the threat of physical/emotional/financial harm, physical/emotional/financial enticement, subpoena, or 'contempt of court' jail sentences.

Answer 5

Hard drive destruction is not that easy. There's some theory over it, metal just looses the magnetic data when heated above certain level.

If you do a good research on google you'll find some theory about recovering HDD information using powerfull microscopes and theier magnetic signal.

Encrypting data before storing is the best solution, if you:

• use good cryptography

• use protection agains someone stealing your key (by physical access to your computer, for example, intercepting your keyboard, memory, etc)

• have time to securelly erase your key when throwing away the HDD.

And that might not be that easy. Secure your computer means, for example, that no one can access it even just after you have secure-deleted-and-wiped the key.

Password is somehow related to the key. If you delete the key, the password is kind of useless. So a combination of good key + good password, loosing one make the other useless.

A good combination in truecrypt is to use more than one key, each stored in a different media. For example, one in the HDD, one in the flash memory, another in a token.

Use the effort that you need according to the security you want in your information.

Finally: have you downloaded the source code of truecrypt, read it, compiled your own version? If not, how can you trust it is secure? :)

Answer 6

If ATA Secure Erase is not an option or not supported on your hard drive, I'd recommend DBAN. DBAN is a well-engineered piece of software for wiping a hard drive, by performing multiple overwrite passes at a very low level. As a result, it is time-consuming but very thorough. It includes methods based upon Gutmann's research, DOD standards, and other research -- and it is easy to use.

Caution: DBAN is only suitable for use with hard disks (magnetic storage). It is not appropriate for flash-based storage, such as SSDs.

DBAN does not erase the Host Protected Area (HPA) (often used to store a recovery partition for your OS, and thus probably relatively low-risk). DBAN does not erase remapped sectors (i.e., blocks marked as bad) unless you specify a particular option. I would expect remapped sectors to be rare. DBAN does not erase the Device Configuration Overlay (DCO) portion of the hard disk (stores hard disk configuration; I would expect it to be relatively low-risk in most settings). If these are a concern, use ATA Secure Erase. Despite that, I expect DBAN to be good enough for most users with magnetic hard drives.

For relatively modern hard drives (ones that support ATA Secure Erase), I recommend using ATA Secure Erase. But if, for whatever reason, ATA Secure Erase is not available (e.g., you have a SCSI drive; you have an older hard drive that doesn't support ATA Secure Erase), DBAN is probably more than adequate.

Be very careful when using DBAN! It will irreversibly destroy your data.