Hard disk drives are resilient, reliable storage devices that consumers and businesses can trust to safely contain their information for an extended period of time. A good hard disk can last for years and data remains retrievable even when the mechanical elements of the system no longer function properly. While this is great from a data hardiness perspective, it creates a wide range of challenges in terms of data security. In particular, the difficulty of destroying data stored on a hard disk can make it difficult to properly decommission hard disks without putting information at risk.
What’s more, the problems associated with deleting data on both hard disks and solid state drives have led to many misconceptions about what is necessary for keeping information safe. Many people believe they can adequately protect data by performing a software erase or reformatting a disk for reuse. A study from the Blancco Technology Group shows just how hard it is to destroy data via a software wipe.
How many resold storage devices actually contain private data?
The Blancco study focused on the storage device reseller market. To gather data, the firm purchased 200 used hard disks and solid state drivers on Craigslist and eBay. These devices were meant to be clear of data, but the digital forensics team at Blancco uncovered data residing on 78 percent of the drives involved in the study. Furthermore, the experiment showed that encryption is rarely applied within data removal processes because there is an assumption that the data is being deleted. Of the 78 percent of drives containing information, 67 percent of the devices contained personally identifiable information and 11 percent held corporate data.
All told, the types of data contained on these resold storage devices is troubling. Some of the key findings include:
- Nine percent of the drives contained company emails that employees had sent.
- Forty-three percent of devices contained photos, with 24 percent of the drives having photos that included GPS data.
- Twenty-three percent of drives contained Social Security numbers.
- Twenty-one percent held financial data.
- Five percent had corporate spreadsheets containing such details as sales projections or inventories.
- Three percent held customer data.
As part of the study, Paul Henry, a digital forensics expert working with Blancco, explained that the quantities and types of information frequently found on devices could allow for identity fraud.
“Two of the more incriminating types of personal information we recovered are financial data and resumes – these types of files contain all of the information needed for a hacker to go in, steal the information and then perpetrate identity theft and fraud,” said Henry. “And in a world where money rules, this could have devastating effects for individuals because it could not only rob them of their hard-earned money, but it could also hurt their chances to get approved for financing, mortgage loans and so much more. Not to mention, if the identity thief becomes involved in criminal activities, it could destroy their personal reputation.”
This research indicates a major problem in the data protection sector. Businesses and consumers are using inadequate data erasure methods prior to selling devices, putting significant quantities of data at risk and completely outside of their control. The problem here is further complicated when you think beyond simple SSDs and HDDs being put on sale and consider all the smartphones, tablets and other computing devices that are resold used by consumers and by retail chains. These systems all contained sensitive data at some point, and may well continue to hold that data even after a software erase. It is vital to completely purge data from storage media, and a release from the Internal Revenue Service highlights just how varied the data deletion options on the market can be from one another.
“Media sanitization can be a technically complex process.”
Data erasure that gets the job done
According to the IRS, media sanitization can be a technically complex process, and it is something that must be considered in light of the information that is contained on devices. Essentially, if storage media only includes non-confidential information, there may not be much to worry about. However, once data is sensitive, erasure becomes critical. Based on internal regulations, the IRS categorizes the information it handles as having a moderate degree of confidentially. Because of this, the IRS, based on guidelines from the National Institute of Standards & Technology, recommends that data be purged if the goal is to reuse the storage media. For these purposes, the IRS defines purging as a process that:
“Protects confidentiality of information against laboratory attack. Executing the secure erase firmware command on a disk drive and degaussing are acceptable methods of purging.”
There is one exception to this rule: The IRS believes that storage media need only be cleared, a process that involves overwriting data, if the storage media will continue to be used for internal purposes within the agency. Destruction, something that goes so far as to incinerate, disintegrate or melt the disk, is necessary.
Three lessons businesses can learn from the IRS’s application of the NIST regulations are:
1. Chain of custody is critical
The IRS shows that organizations can use an inferior method of erasure if they will maintain internal control of the hard disks up until they are destroyed. However, businesses will need to decommission devices at some point, and they can’t afford the risk that the storage media falls into the hands of a third party. For example, sending the drive to a destruction specialist means the storage media will leave corporate control at some point, breaking the chain of custody. While destruction may be a viable end point, it is vital to first purge a device using a degausser prior to breaking the chain of custody.
2. Different erasure methods are needed for various devices
The unique architectures of each storage media format make erasure somewhat unique depending on the device. However, the IRS mentioned degaussing as a viable option for purging data when dealing with floppy disks, ATA hard drives, removable USB drives, zip disks, SCSI drives and magnetic tapes.
The wide range of devices that can be purged using a degausser makes the hard disk sanitization method incredibly adaptable. Businesses that want to decommission hardware safely can purchase a degausser to handle a wide range of media types while also maintaining the chain of custody.
3. Not all degaussers are equal
The IRS documentation specifically points out the importance of using an NSA/CSS-approved degausser. This isn’t simply a matter of a government agency being cautious. Instead, degaussers use a magnetic charge to sanitize devices, creating a situation in which the power of the magnetic force is incredibly important. Some older degaussers or solutions not built to high standards may not be up to the task of fully purging data. The NSA/CSS certification verifies the strength of the magnets used to fully erase data while leaving the disk still usable in the future.
At Proton Data, we feature a full line of degaussers and disk shredders that can provide full data sanitization for businesses in a wide range of industries. Our degaussers are certified by the NSA and can give organizations the confidence they need to resell legacy hardware or donate it without having to worry about data theft. Our degausser line ranges from a system designed for top secret data to a convenient, handheld degaussing wand that is NSA listed for its ability to sanitize hard drives.
