How can I reliably erase all information on a hard drive?

Question

As storage technologies change over time, using different encodings and remappings to deal with sector errors, the best way to permanently erase/wipe/shred data changes also.

Methods for flash drives and other solid-state drives are covered nicely at Jesper Mortensen's answer on SSD erasure.

Various methods for hard drives are described at http://en.wikipedia.org/wiki/Data_erasure and include

• "Secure erase", a function built into modern ATA hard drives
• Gutmann's methods for various old hard drives
• An oft-cited data sanitization method in NISP Operating Manual (DoD 5220.22-M)

Does the ATA "secure erase" cover all modern hard drives and interfaces?

Are there modern storage devices besides SSDs that require something different?

The other option I've heard of is always encrypting everything you send to the drive yourself via something like Truecrypt. If you do that, it would seem that you have to be able to securely destroy the keys when necessary. And in the absence of a neuralyzer, does human memory of the password render any hard disk encryption schemes vulnerable to data recovery?

Answer 1

The only NIST approved method to securely erase a hard drive is by utilizing the secure erase internal command - documented at the Center for Magnetic Recording Research (CMRR) - and that is what everyone should be doing. It is an ATA command, and covers (S)ATA interfaces.

After that, you can optionally degauss the drive to erase the firmware itself.

Lots of interesting info in Guidelines for Media Sanitization, NIST SP 800-88 (2014).

A quote from the paper:

Secure Erase

An overwrite technology using firmware based process to overwrite a hard drive. Is a drive command defined in the ANSI ATA and SCSI disk drive interface specifications, which runs inside drive hardware. It completes in about 1/8 the time of 5220 block erasure. It Was added to the ATA specification in part at CMRR request. For ATA drives manufactured after 2001 (Over 15 GB) have the Secure Erase command and successfully pass secure erase validation testing at CMRR. A standardized internal secure erase command also exists for SCSI drives, but it is optional and not currently implemented in SCSI drives tested by CMRR. SCSI drives are a small percentage of the world’s hard disk drives, and the command will be implemented when users demand it.

A more recent (2010) short presentation from NIST that compares different erase techniques and their limitation is in a ppt presentation by Lyle and Russell.

Answer 2

From a theoretical standpoint the idea of total drive destruction may be the only way of destroying data on a hard drive fully.

From a practical standpoint, I've not seen any evidence that it's possible to recover meaningful data from a standard hard drive (ie, not taking SSDs or other devices that use wear levelling or similar technologies) after a once over wipe from /dev/zero or similar.

There's an interesting article here, that goes into some depth on the opinion that a single pass wipe is sufficient.

Some good additional information from the links provided by @woliveirajr seems to confirm that point. From This paper

This study has demonstrated that correctly wiped data cannot reasonably be retrieved even if it is of a small size or found only over small parts of the hard drive. Not even with the use of a MFM or other known methods. The belief that a tool can be developed to retrieve gigabytes or terabytes of information from a wiped drive is in error. "

And from this document on the subject of using MFM for retrieving data from a disk

Extrapolating this (and forgetting that an 80GB drive from 2006 does not compare in the resolution requirements of a 1Tb drive from 2008 ) it would be expected that a complete image of a 1 TB hard disk platter would take around 89 years to completely image using an MFM based technique.

Update: Another interesting answer on this topic from the Skeptics site here, has some good information and links on the subject of single pass wipes being sufficient.

Answer 3

As storage technologies change over time, using different encodings and remappings to deal with sector errors, the best way to permanently erase data changes also.

Very smart people have expended enormous amounts of time and effort arguing over this problem. Most of them end up at the same bottom line, which is: the only method you can truly trust is physical destruction of the media. (And then those very smart people tend to argue over what sorts of physical destruction are sufficient). Keep this in mind as you start worrying about newer types of media (SSDs) which more blatantly fail the old "rules of thumb" for soft deletion of data.

The other option I've heard of is always encrypting everything you send to the drive yourself via something like Truecrypt. If you do that, it would seem that you have to be able to securely destroy the keys when necessary.

Yes, that is a viable method, and you're right about the keys. I would add: if you're paranoid enough to use this method, you're paranoid enough to have to worry about whether your opponent has the ability to compromise your (machine, keyboard, cables) in such a way as to defeat this method.

And in the absence of a neuralyzer, does human memory of the password render any hard disk encryption schemes vulnerable to data recovery?

If the keys exist, then yes, the human memory of the password becomes the sticking point. And humans often will disclose passwords under the threat of physical/emotional/financial harm, physical/emotional/financial enticement, subpoena, or 'contempt of court' jail sentences.

Answer 4

Do you need to erase the data, or do you need to persuade other people that the data has been erased?

(I will only talk about 'entire disk' wiping on conventional drives; I'm not talking about wiping single files or slack space or SSDs.)

As far as I am aware there is no software package that claims to be able to recover data that has had a single overwrite. There are no companies that claim to be able to recover such data. There are no research papers that have shown such data recovery. So, for most purposes (risk:cost analysis) a single overwrite of all 0 is fine, although a couple of overwrites of pseudo-random data is probably better.

But then you may have to persuade auditors that the data has gone. And maybe, just maybe, there is a super secret method used by TLAs to get that data. If your task is to persuade other people (auditors, customers) that the data is unrecoverable and will remain so for ever a secure ATA erase followed by mechanical shredding do.

Answer 5

If ATA Secure Erase is not an option or not supported on your hard drive, I'd recommend DBAN. DBAN is a well-engineered piece of software for wiping a hard drive, by performing multiple overwrite passes at a very low level. As a result, it is time-consuming but very thorough. It includes methods based upon Gutmann's research, DOD standards, and other research -- and it is easy to use.

Caution: DBAN is only suitable for use with hard disks (magnetic storage). It is not appropriate for flash-based storage, such as SSDs.

DBAN does not erase the Host Protected Area (HPA) (often used to store a recovery partition for your OS, and thus probably relatively low-risk). DBAN does not erase remapped sectors (i.e., blocks marked as bad) unless you specify a particular option. I would expect remapped sectors to be rare. DBAN does not erase the Device Configuration Overlay (DCO) portion of the hard disk (stores hard disk configuration; I would expect it to be relatively low-risk in most settings). If these are a concern, use ATA Secure Erase. Despite that, I expect DBAN to be good enough for most users with magnetic hard drives.

For relatively modern hard drives (ones that support ATA Secure Erase), I recommend using ATA Secure Erase. But if, for whatever reason, ATA Secure Erase is not available (e.g., you have a SCSI drive; you have an older hard drive that doesn't support ATA Secure Erase), DBAN is probably more than adequate.

Be very careful when using DBAN! It will irreversibly destroy your data.

Answer 6

Hard drive destruction is not that easy. There's some theory over it, metal just loses the magnetic data when heated above certain level.

If you do a good research on google you'll find some theory about recovering HDD information using powerful microscopes and their magnetic signal.

Encrypting data before storing is the best solution, if you:

• use good cryptography

• use protection against someone stealing your key (by physical access to your computer, for example, intercepting your keyboard, memory, etc)

• have time to securely erase your key when throwing away the HDD.

And that might not be that easy. Secure your computer means, for example, that no one can access it even just after you have secure-deleted-and-wiped the key.

Password is somehow related to the key. If you delete the key, the password is kind of useless. So a combination of good key + good password, losing one make the other useless.

A good combination in truecrypt is to use more than one key, each stored in a different media. For example, one in the HDD, one in the flash memory, another in a token.

Use the effort that you need according to the security you want in your information.

Finally: have you downloaded the source code of truecrypt, read it, compiled your own version? If not, how can you trust it is secure? :)

Answer 7

When evaluating your erasure method, you need to consider:

• How quickly you need to erase the data (Is it an emergency response to terrorists banging on your door, or are you selling your old hardware on Ebay next week?)
• How much effort, money, or time will any potential attacker realistically spend trying to get at your data? (Are you a high-stakes target, or does someone just want to get your bank account details? Is your potential attacker a small-time crook or are they sponsored by a nation state or massive cartel?)
• How long will your data remain valuable -- will the threat go away after time?
• What have you got to lose? (Your cool? Money? Employment? People's lives? A war?)

If the stakes are unacceptably high, by all means go to extremes: erase data and destroy the medium; however, in most cases, plan to make any attack offputtingly difficult. Again, you have a choice: do you make it obvious to an attacker that it's not worth their bother (with a warning label or obvious damage), or do you let them try until they give up in frustration?

Examples:

1) You're handing your laptop down to your child for homework, having bought a shiny new one. They are not allowed to take it out of the house, and the battery doesn't hold charge anyway. You're essentially still in control of the computer. If your operating system doesn't restrict you from doing so, create a fresh user account for your child. Move/delete your old files and empty your wastebasket. You want to hang onto an Administrator or root login so you can do maintenance, but if you can, delete your old user account from that computer.

2) You want to give your old home PC to charity. The charity is unlikely to attack, but you don't know where your old computer will end up. People poke around for fun sometimes. You've got plenty of time to make backups of the data you want to keep and then do a fresh operating system install, ensuring you get it to reformat the hard disk the slow way, overwriting each sector to check for bad blocks. (If your chosen OS doesn't allow this, you can always download a Linux liveCD, boot into that and use the dd command to copy data from /dev/urandom to the machine's primary disk, usually /dev/sda. This may take many hours. Be really sure that no other disks are attached whose data you want to keep, just in case you overwrite the wrong disk! Finally, install an OS so the machine will work.

3) You need rid of that data fast! Ruthless baddies are at the door and lives are at stake. Grab a hammer or electric drill and destroy that disk! Put as many holes and dents into those shiny platters as you can. Hard disk heads fly incredibly close to the surface of the disk, with very finicky accuracy. A head crash can be caused by a particle as small as a particle of smoke getting between the head and the platter while it spins. You are filling the drive with broken particles, deforming the mirror-like disk surface, pitting it, smearing magnetic material about, and likely shattering the platters if they are glass, as some are. Trying to mount this mess on a rig in a clean-room to get data off it is only going to damage the rig and contaminate the clean-room. Any remaining options for recovering random chunks of data from fragments are going to be preposterously expensive, impractical and reliant on luck, so you should have time to leg-it and take mitigating action just in case. (You're still going to be in trouble for not encrypting life-or-death data in the first place, though.)

I haven't covered SSDs - I don't know enough about them.

Answer 8

Just burn them. Use a 20 liter steel drum, with ~0.5 cm holes punched circumferentially, just above the bottom rim. Dry oak, accelerated occasionally with paraffin, works very well. Only steel parts will remain.