Overview
This lecture discusses secure methods for destroying or erasing data on storage devices, including physical destruction, software deletion, and the importance of proper decommissioning.
Physical Destruction Methods
- Physically destroying storage devices (e.g., drilling, hammering) prevents data recovery.
- Industrial shredders can destroy multiple drives by grinding them into small pieces.
- Degaussers use strong magnets to erase hard drive data but do not work on SSDs or flash drives.
- Incineration completely destroys drives, ensuring data cannot be recovered.
Secure Deletion and Formatting
- File-level deletion utilities (e.g., SDelete) securely remove files so they cannot be restored.
- Whole-disk utilities (e.g., DBAN) overwrite all drive data, making it safe for reuse on hard drives.
- File-level and disk utilities are often ineffective on SSDs due to data stored outside the file system.
- Factory low-level format is not user-accessible and prepares the drive for use.
- Quick format only clears the file system index; data can still be recovered with special tools.
- Standard or regular format overwrites every sector, making data recovery nearly impossible.
Legal and Organizational Requirements
- Physical destruction may be legally required to protect sensitive data in industries such as finance and healthcare.
- Organizations with large numbers of drives may need third-party destruction services.
Third-Party Destruction Services
- Third-party providers can destroy drives and issue certificates of destruction as proof.
- Always obtain a certificate of destruction to verify the data is irretrievable.
Risks of Inadequate Decommissioning
- A 2019 study found 42% of used drives purchased online contained sensitive data.
- Drives examined included personally identifiable information, company data, and personal files.
- Proper erasure or destruction of drives is crucial to prevent sensitive data exposure.
Key Terms & Definitions
- Degaussing — Using a strong magnet to erase data on magnetic drives.
- Quick Format — Clears the file system index but does not delete the underlying data.
- Standard Format — Overwrites every sector on the drive, removing all data.
- Certificate of Destruction — Document proving that a drive was destroyed and data made unrecoverable.
Action Items / Next Steps
- Review and implement the appropriate data destruction policy for your organization.
- If using third-party destruction, require and keep certificates of destruction.
- Consider the limitations of software utilities with SSDs when planning secure deletion.