Destructive Nature: Decommissioning Legacy Drives
Destructive Nature: Decommissioning Legacy Drives
May 29, 2007: When you are decommissioning hard drives from old PCs and MFDs, make sure that the only thing being salvaged on the second hand market is the value of the hardware and not the information in it.
“Think about how much people spend on security,” said Jorge Silveira, Executive Director of Consulvest, the distributor for data destruction appliance, the “Dead on Demand” Digital Shredder. “Business will spend vast amounts on security, but what happens when you decommission a hard drive? People just don’t think about that.”
The black box does what its name says: it shreds digital information lurking on old hard drives, beyond forensic recovery. Part of Silveria’s marketing collateral is a certificate from the City of Portsmouth, New Hampshire Police Department.
The DS-200 Digital Shredder is now being sold in Australia for A$20,000 or $460 per month on a 60 month lease.
According to Silveria, the three main methods of destroying information from hard drives are not fool proof. The problem with degaussing (removing an unwanted magnetic field) says Silveria, “is how do you verify it? By forensic testing? And how expensive is that?” Mechanical destruction using a drill, hammer or shredder only removes information from those parts destroyed while triple over-writing fails to delete shadow data and areas of the disk used for disaster recovery.
Silveria believes the $20,000 machine his company Consulvest is offering resolves these issues with its broad, low frequency magnetic sweep over the hard drive’s platter, eliminating all information from it. This, apparently, allows the sweep to go deeper and wider than when done at the normal frequency.
The digital shredder has three drawers (called “personality blocks”) in to which 2.5-3.5 inch, ATA, SATA or Scuzzy hard drives can be lodged and then inserted into the appliance for destruction. Destruction processes are controlled using a stylus and LCD touch screen where the command to “secure erase” can be activated.
Once the personality blocks are inserted, the Digital Shredder invokes a command called “secure erase” which Silveria says resides in the firmware of most ATA and SATA hard drives. The command locks the hard drive and encrypts it using 128 bit encryption.
The demo hard drive was 20GB and it took approximately 7 minutes to sanitize. After erasure is complete, a separate wrist band printer spits out a 2 dimensional bar-coded certificate that is time/date stamped, which can be attached to the hard drive or to a log book. Alternatively the log can be exported to CSV via the USB port. An 80GB hard drive would take 45 minutes to erase while a 250GB hard drive would take one and a half hours, says Silveria.
The critique
For $20,000 or $640 per month, you would want to make sure there aren’t cheaper alternatives out there that work just as well. According to David Lewis of Fulcrum Technologies, specialists in forensic hardware and software, the risk of data being recovered from hard drives when data destruction software is used is near zero.
Admittedly ‘near zero’ is not zero but Lewis says, “In the forensics field this technology is used quite often, so that if you re-use that hard drive it is clean.”
One example he points to is White Canyon’s Wipe Drive Professional, which sells for $150 per license or $750 for a 500 seat site-wide license. If an appliance is needed, he points to Intelligent Computer Solution’s Wipe Master, which can remove data from 9 drives at once at a rate of 2GB per minute. This sells for A$3,500.
The standard most computer forensics professionals refer to is US Department of Defense standard 5220 for data destruction. It recommends hard drives be written over 3-7 times. This is because the accuracy of the writing arm in old drives can be poor. Beyond this the Defense Department will then drill and shred its own hard-drives.
Although he did not view the Digital Shredder, he did find the low frequency magnetic field technique interesting.