40

My concern is the disposal of a replaced disk from a private RAID5 disk array.

I have had to replace a disk from my personal RAID5 disk-array. It had started developing errors, so out it went.

But now, I have this disk lying on my desk and that got me wondering... The data on the array was never encrypted. I'm concerned that turning it in at the recycle-station could be a security-risk.
Is it possible that some mischievous individual would be able to retrieve personal data (photo's, files etc.) from the disk? Or is the fact that it was part of a RAID5 array sufficient for the data to have been scrambled beyond recognition?

  • 42
    anecdotally I have recovered lots of jpeg embedded thumbnails from single raid5 drives in the past – PlasmaHH Jan 8 '18 at 16:52
  • 3
    If it's a dead drive and magnetic, you could put it in a degausser to wipe the data, it's pretty quick but finding one might be hard. I know eliminating the data wasn't part of the question, but I figured I'd mention it – DeadChex Jan 8 '18 at 17:42
  • 5
    If its developing errors it is worthless. I'd spend a couple of minutes with a club hammer and a cold chisel through the side to shatter or deform the platters then turn it in at the recycling station. – RedGrittyBrick Jan 8 '18 at 19:37
  • 13
    best way to make sure data cannot be retrieved: i.stack.imgur.com/McuAt.jpg – SeanC Jan 8 '18 at 20:33
  • 5
    If you want to dispose of the drive anyway, physical destruction seems the best solution. We already have a question about that :-) : How do you destroy an old hard drive?. – sleske Jan 9 '18 at 10:39
35

In the interests of actually testing this, I pointed a copy of Foremost at a disk that was formerly part of a RAID-6 array (made available thanks to Seagate). The array had a chunk size of 512KB, so any file of 512KB or less is theoretically present intact. The data on the array is from nearly 25 years of computer use, including disk images of every computer I've owned.

The amount of data that I recovered was, frankly, scary. Word documents containing high-school homework assignments. Data files from games I'd uninstalled decades ago. DLL files from a hundred different versions of WINE. Images attached to unread Usenet posts. Ten thousand cached web pages. Adding a custom extraction rule found three SSL private keys and an SSH key.

Another thing to note is that you don't always need to extract the entire file to get compromising information. For example, the first 512k of a PDF can give you the table of contents, the first 512k of a BMP can give you a caption (BMP stores its image data upside-down), and the first 512k of a JPEG can give you a thumbnail. MPEG and MP3 files are designed to be streamable, so even a chunk from the middle of one can give someone useful data.

How scrambled is data on a RAID 5 disk? Not scrambled enough.

  • 2
    Thanks for trying this, and also, I'm amazed that you still have a 25 yo disk still in use! – JPhi1618 Jan 11 '18 at 16:37
  • @JPhi1618, I do have a couple 25-year-old disks in use, but this isn't one of them. It's just got (partial) images of those disks. – Mark Jan 11 '18 at 19:12
61

Raid 5 stripes the data across the disks but the blocks used for striping are typically pretty big. At the very least they will bewhole sectors but normally they will much larger than that. For example madm defaults to half-megabyte chunks. Even one sector is big enough that you are likely to find recongisable chunks of text and with typical chunk sizes it is quite likely entire recognisable files will be present on the individual drives from the array.

  • 12
    Since whole sectors (512 bytes or 4 kilobytes) to megabytes is a pretty big range it might be worth a mention that mdadm defaults to 512 kilobyte chunks. – AndrolGenhald Jan 8 '18 at 16:19
  • 8
    @Mausy5043, quite unrelated. The redundancy is parity blocks, which are not very useful by themselves. And block/stripe size is unrelated to the RAID level. – jcaron Jan 8 '18 at 17:21
  • 7
    @J..., the techniques aren't "rather advanced". Any but the most primitive "undelete" software has a mode that will ignore the filesystem structure and scan the disk directly for things that look like files. I've used it to pull JPEG thumbnails out of a virtual machine's memory dump; a single disk from a RAID array will be no problem. – Mark Jan 8 '18 at 21:02
  • 14
    @J..., in the interests of science, I pointed a copy of Foremost at a hard drive removed from a RAID-6 array. The amount of recognizable data it found is, frankly, scary, and some of it surprisingly old (an ad for GTE Internet Services? A custom startup screen for Windows 95?) – Mark Jan 9 '18 at 10:50
  • 2
    @xDaizu The range starts at "sectors", which is typically 512b to 4Kb, and ends at "megabytes". – Taemyr Jan 9 '18 at 12:38
15

Sounds like people may be confusing drive sector size (typically 512B to 4KB) with RAID 5 stripe size (typically 16KB to 128KB, sometimes larger). The RAID stripe size is the logical writeable size for the array, so each part of the stripe on each drive will contain that much data. If an entire file fits into the stripe size, it will likely all be visible as a contiguous block on the remove drive.

  • 11
    For example, an RSA private key should be <=4kB and has easily identifiable text - you could trivially find one with just strings and grep. That's the kind of data you could be leaking. – Bob Jan 9 '18 at 1:27
  • 4
    Stripe sizes of 1MB aren't uncommon. – Twisty Impersonator Jan 9 '18 at 1:45
  • And also, even if the entire file doesn't fit into the stripe size, partial files of these sizes are just as much a "security-risk" in the sense the questioner is asking about :-) It would be a mistake to get hung up on file size, for example to think, "all my video files are much larger than the stripe size and therefore they'll be scrambled". – Steve Jessop Jan 10 '18 at 9:59
8

A single member of a RAID 5 array will consist of plain blocks and parity blocks, for example 75% plain and 25% parity for a 4 member array. The plain blocks can be read in plain view; there is no scrambling of these blocks and you do not need to refer to other members to make sense of it. These blocks are typically 16KB to 512KB in size though with RAID-5 this is usually 128KB or below to minimise write amplification. There is plenty of scope to read sensitive data that appears in such plain blocks.

Each parity block contains data that is generated from three plain blocks on other drives, in such a way that if any of those three other drives (in a four-member array) is lost the information can be recovered by applying an algorithm to the parity block and the blocks from the other remaining two drives. The data in a parity block makes no sense and could not be recovered on its own, unless you could guess the content of two of the three other blocks it combines with - which may in some cases be easy if two of the three blocks were empty (zeroes) or contain predictable data. Thus while it isn't cryptographically secure the information in a parity block is generally useless without two of the three other blocks it is generated from.

RAID 4 had a similar design to RAID 5 except that all the parity blocks were stored on one drive, so if you only had that drive, you would have no easily recoverable data. RAID 5 modified this to distribute the parity blocks evenly between members, meaning that any drive on its own will contain a lot of plain blocks from which you might recover data.

4

Or is the fact that it was part of a RAID5 array sufficient for the data to have been scrambled beyond recognition?

Rule of thumb would be to always secure erase magnetic media before giving it away under such circumstances (recycling, donation, etc.). Don't make any assumptions about the underlying data, whether it was encrypted, whether it was RAID0 or RAID 5, etc.

Even if contemporary wisdom is that something is secure, experience has shown us that such beliefs can be invalidated in the future (e.g. look at the number of years the Spectre/Meltdown security issues existed undetected, until researchers discovered how that could misuse processors' behaviour).

2

In the data centers that I work in we take data security very seriously. If the drive was part of an array that was not encrypted yes there is still enough data that can be retrieved from the drive. I would honestly recommend either scrubbing the drive if it is still functional or if it is not functional I recommend degaussing the drive with some sort of controlled magnetic device.

  • 3
    Or put it through a physical hash function with the aid of a hammer – Martin Bonner Jan 11 '18 at 14:20
  • LOL at "physical hash function" @martin-bonner . Must remember that. – Phylyp Jan 14 '18 at 6:52

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.