A drawer full of donor hard drives in Datarecovery.com’s parts inventory.

A new USB device is attracting attention for offering a “military-grade” solution to a common problem: How to permanently erase sensitive data from a hard drive. 

The device appears to be the sole offering of the brand DESTRUCT, which claims it utilizes advanced algorithms and multi-pass techniques to thoroughly overwrite disk contents. 

But for most users, this dedicated hardware may be unnecessary. We haven’t worked with a DESTRUCT USB gadget, but we’ve seen similar tools — and for the most part, they’re overkill. Here’s why. 

USB Data Sanitization Gadgets: Not a Scam, But Nothing Special

The Destruct gadget plugs into a computer’s USB port and, as Yahoo! Tech reports, operates as a bootable environment to execute data sanitization software automatically. 

Operating outside the computer’s primary operating system is key because it allows the device to overwrite the entire drive, including the OS, boot sectors, and hidden partitions. The goal is to ensure all data is destroyed by running comprehensive multi-pass programs.

The issue? You can download free software that performs the same function. If you’ve got a spare USB drive, for example, you might grab Darius Boot and Nuke (DBAN), a totally free utility that provides multiple options for data sanitization.

What Is “Military-Grade” Data Sanitization?

The term “military-grade” refers to highly specific, multi-pass overwriting standards, most famously the U.S. Department of Defense’s DoD 5220.22-M standard. We’re assuming that the Destruct gadget uses those methods, since buyers on Amazon have noted that the device can take multiple days to sanitize a single HDD. 

These multi-pass methods were developed for older, low-density magnetic media where residual magnetic traces might theoretically be detected after a single overwrite. 

“Theoretically” is an important bit of language: We’ve seen residual magnetic traces of data on extremely old media (such as floppy disks), but they weren’t nearly sufficient for data recovery purposes.

Given the high density of modern hard drives, magnetic artifacts are not a serious concern for data recovery (or data sanitization). 

To Sanitize Data, a Single-Pass Overwrite is Sufficient

Today, for modern, high-density hard disk drives (HDDs), a single-pass overwrite with zeros or a random pattern is generally considered sufficient. The original data is made unrecoverable by any known software or laboratory technique. 

Military-grade methods are valid but extremely time-consuming. Learn more about secure data wiping for HDDs in our article, How to Securely Wipe a Hard Drive Before Selling or Recycling It.

For SSDs, A Basic Format Sanitizes the Drive

If you are dealing with a Solid State Drive (SSD), the process is different, and a utility like DBAN isn’t necessary — fully overwriting the memory cells of an SSD will put unnecessary wear on the device. Most data sanitization programs will refuse to execute multiple overwrites on an SSD for that reason.

For a modern SSD, a full format is fine. The drive’s internal firmware uses TRIM to ensure deleted blocks are quickly and completely emptied. The most reliable method is to use the drive’s built-in ATA Secure Erase command, which instantly resets all storage cells. Most SSD manufacturers provide a free utility (e.g., Samsung Magician, Crucial Storage Executive) to execute this command easily.

Understanding the NIST SP 800-88 Guidelines

For commercial, government, or regulated environments, security protocols must be precise and verifiable. The National Institute of Standards and Technology (NIST) created Special Publication 800-88: Guidelines for Media Sanitization, which defines three distinct security levels for data destruction:

1. Clear: A software overwrite (like DBAN). It protects against simple, non-invasive data recovery techniques. This is effective for HDDs but is considered a minimum level of security.
2. Purge: Protects against state-of-the-art laboratory attacks. For HDDs, this involves degaussing (destroying the magnetic field) or a certified multiple-pass overwrite. For SSDs, it usually involves cryptographically erasing the encryption key.
3. Destroy: The most secure method, rendering the media permanently unusable. It involves physical destruction methods like incineration, pulverizing, or shredding.

These defined standards ensure that organizations select the correct sanitization method to meet their specific risk profile, regulatory obligations (like HIPAA), and the type of storage media they are using.

When Professional Data Sanitization Is Required

For individuals, a quick USB gadget or a free utility is sufficient. However, when decommissioning assets for a business, a healthcare provider, or a government organization, security and legal compliance are the top priority.

Protecting your organization from a data breach requires an auditable, verified, and legally defensible process. This is where professional, at-scale data sanitization services become necessary. 

At Datarecovery.com, we utilize specialized hardware and processes, such as magnetic degaussing and certified software solutions that meet or exceed the NIST standard. Crucially, we maintain a complete chain of custody — documentation that is essential for passing an audit or meeting regulatory requirements. 

If your organization has decommissioned data storage media and requires a verified, certified, and compliant destruction process, we offer secure solutions.

Call 1-800-237-4200 to discuss your media destruction project with an expert or submit a case online.

The post This “Military-Grade” USB Gadget Destroys Hard Drive Data appeared first on Datarecovery.com.

A hard drive badly burnt in a house fire.

You’re getting a new computer, or just replacing your hard disk drive (HDD) with a solid-state drive. What do you do with your old storage media? 

This is one of the most common questions we receive — and it’s an excellent question to address to a data recovery provider. After all, we’re able to recover files from hard drives that have been in house fires and floods; we know what it takes to permanently destroy data. 

The quick answer: You can use media sanitization software to securely erase your HDD, provided that it’s currently in a working condition. Some popular tools include:

• Darik’s Boot and Nuke (DBAN) 
• Macrorit Data Wiper 
• Microsoft SDelete 

If your hard drive isn’t working, it must be degaussed, shredded, or incinerated. Consult your local electronic recycling center (after all, you really shouldn’t be tossing a hard drive in the trash; all drives have plenty of recyclable components). 

If you have a large quantity of hard drives that need to be sanitized, the best practice is to work with a media sanitization provider. Datarecovery.com provides these services, and we can include verification and chain-of-custody reports upon request to aid in compliance. To learn more, call 1-800-237-4200 or request a quote online. 

Below, we’ll address some common questions regarding HDD disposal techniques. 

Can I physically destroy my hard drive to get rid of data?

The platters and actuator heads of a hard drive.

Yes, but to render data unrecoverable, you’ll need to target the platters. Those are the magnetic discs that contain your actual data; breaking other components might make the drive unusable, but if the platters are still intact, data recovery is still technically possible. 

You could physically destroy a hard drive on your own by drilling holes through it or removing the platters and breaking them apart. That’s a labor intensive process, so it’s really not recommended — but if you have the time and tools (and you want to see what the inside of your HDD looks like), it’s certainly doable. 

After destroying your platters, make sure to dispose of the leftovers in an environmentally friendly way. 

What does NIST recommend for HDD disposal?

The National Institute of Standards and Technology (NIST) provides comprehensive guidelines for media sanitization, including hard drive disposal. NIST Special Publication 800-88 Rev. 1 outlines three primary methods for sanitizing data storage devices:

• Clear: This involves overwriting the data on the hard drive with a pattern of ones and zeros. This is simple and cost-effective, but it’s not appropriate for sensitive data. 
• Purge: This method uses specialized software or hardware tools to overwrite the data on the hard drive multiple times with complex patterns (see the secure sanitization programs we mentioned in the introduction to this article). Purging is generally considered a more secure option than clearing, but it can be time-consuming.
• Destroy: This involves physically destroying the hard drive to render the data unrecoverable. As mentioned earlier, this method can be effective but comes with its own set of challenges, including environmental concerns and the potential for hazardous material exposure.

To learn more about NIST standards, read: What Are the Standards for Secure Data Sanitization?

Can I just encrypt my hard drive instead of disposing of it?

Encrypting your hard drive can be an effective way to protect your data, but it’s not a foolproof solution. If the encryption key is compromised or the encryption software has zero-day vulnerabilities, your data could still be at risk. 

Moreover, encryption doesn’t address the physical security of the hard drive itself. If the hard drive is lost or stolen, the data could still be accessed if the encryption is bypassed.

For at-scale media sanitization, trust the experts at Datarecovery.com

HDD disposal requires careful consideration to ensure the secure and responsible handling of sensitive data. You can handle this on your own — but at scale, sanitization should be handled by a qualified data services provider.

Our specialists meticulously maintain chain of custody records and adhere to NIST SP 800-88 standards, ensuring your project stays on track and compliant. This comprehensive approach not only streamlines your media migration or sanitization process, but also significantly reduces costs.

To learn more, submit a case online or call 1-800-237-4200 to speak with an expert.

The post HDD Disposal: Best Security Practices appeared first on Datarecovery.com.

But while recycling your e-waste is an excellent idea from an environmental perspective, privacy and security are also important. Once you’ve lost custody of your device, anything could happen. You want to destroy all recoverable data on the device before it leaves your control. 

As a leading data recovery provider, we’ve got tips for preventing anyone — including trained forensics engineers — from accessing your data. Here’s everything you need to do before you recycle an old hard drive (and tips for handling the process at scale). 

Protect your data by performing a complete overwrite of your HDD. 

The best practices of data sanitization are outlined in the National Institute of Standards and Technology (NIST)’s SP 800-88. If you’re not in the IT industry, however, you don’t need to read through that document — just understand that there are two basic ways to secure your data: By purging it with logical methods or destroying it with physical methods. 

Of these options, purging is easier, while destroying is less time-consuming. If you’re clearing a single hard drive and it’s still functional, purging is your best bet. 

To purge data in a way that makes it entirely unrecoverable, you must overwrite all data at least once with a fixed data value. We do not recommend specific software products, but free utilities like Darik’s Boot and Nuke (DBAN) and Macrorit Data Wiper are popular options. 

These programs overwrite data on a low level. Why is that important? The short answer is that when you delete a file from a hard drive, it’s not necessarily gone; the operating system simply marks the space occupied by the file as “available.” Over time, the file will be overwritten, but it’s still recoverable in the meantime. 

Fully overwriting the file will completely prevent any chance of recovery. Obviously, you’ll want to back up any important files before using secure deletion software (particularly Boot and Nuke, which is extremely simple and effective). 

Related: When Data Is “Gone Forever:” 3 Impossible Data Recovery Scenarios

Physical data sanitization methods can also prevent unauthorized data recovery. 

The exposed platters of a hard drive.

If your hard drive is not operational — or if you’re a bit paranoid about your data security — you can physically destroy the device. 

To do this, you’d simply open up the hard drive, remove the platters (the discs that store your data), and treat them like murder weapons: Scratch them, smash them, or shatter them into a hundred pieces. 

Of course, this is easier said than done. Some general concepts to keep in mind:

• While the printed circuit board (PCB) is an important component, destroying the hard drive’s electronics will not necessarily make data unrecoverable. You must target the platters. 
• Most hard drive enclosures are secured with Torx screws, so you’ll need a Torx screwdriver set to get to the platters. 
• Many hard drives have multiple platters. Each side of every platter must be physically destroyed to prevent any chance of recovery. 

Physically destroying a hard drive isn’t especially difficult — in fact, if you’re interested in electronics, it’s quite fun! — but it’s extremely time consuming. At scale, you’ll need commercial degaussers (which demagnetize platters) and/or shredders.

For large-scale hard drive recycling projects, plan carefully.

If you’re recycling 100 or more hard drives, your best bet is to work with an experienced data partner that can perform software/physical data sanitization. Look for a partner that can provide a chain of custody report and other relevant documentation of the process. This is especially important for organizations that need to maintain compliance with PCI-DSS and similar privacy/security laws. 

Datarecovery.com provides cost-effective data sanitization services designed to aid in compliance and reduce IT department workloads. To learn more, submit a case online or call 1-800-237-4200 to speak with an expert.

The post Before Recycling a Hard Drive, Read This appeared first on Datarecovery.com.

Published by the National Institute of Standards and Technology (NIST), SP 800-88 defines processes for destroying data on hard disk drives (HDDs) and other forms of electronic media. The standard was published in 2006, then updated in December 2014 to reflect changes in media storage technologies. 

What Does NIST SP 800-88 recommend for media sanitization?

NIST SP 800-88 defines three ways to sanitize media (and data): 

• Clear the data by using software (or hardware) to overwrite data with simple read and write commands.
• Purge the data by using software to execute specific sanitization methods.
• Destroy the media through degaussing or by physically destroying the storage areas of the device/disk.

Below, we’ll provide an overview of each method and its NIST SP 800-88 Rev. 1 requirements. The full NIST standards can be found on the institute’s website.

Clearing Data to Meet NIST SP 800-88

Clearing data is the least secure method outlined in NIST SP 800-88, and is only intended to protect data from basic recovery techniques. For example, resetting a device to its factory state would qualify as “clearing” data under NIST SP 800-88.

Simple read-and-write commands should only be used when data security is not a crucial concern (or, in the NIST’s language, “if information disclosure would have no impact on organizational mission, would not result in damage to organizational assets, and would not result in financial loss or harm to any individuals”). 

This is because Clear sanitization methods can usually be bypassed through standard data recovery efforts. For example, recovering data from a formatted hard drive can be accomplished relatively easily — Clear techniques should only be used when the device will remain under organizational control. 

Purging Data to Meet NIST SP 800-88

Purge techniques typically fall into several categories:

• Overwriting the target data/device.
• Utilizing block erase methods.
• Utilizing cryptographic erase methods.
• Destroying the device (see below), which also renders the data “purged.”

For overwrites on magnetic media and flash memory devices, NIST SP 800-88 requires at least a single write pass with a fixed data value (for example, all zeros). Multiple write passes are recommended when information disclosure would be a medium or high concern.

For flash media, data may be purged through a block erase. NIST SP 800-88 recommends writing binary 1s across the user addressable area of the storage media, then performing a second block erase.

Cryptographic erasure methods are more secure, and should be combined with block erasure or traditional overwrites for optimal security.

Destroying Media to Meet NIST SP 800-88

Destroy methods, by nature, also “purge” the target data. However, destroying media renders it unusable — as such, Destroy methods are typically used when the media is leaving the organization.

Destroy methods vary by media type:

• Hard drives that do not have a flash storage component may be degaussed. Degaussing requires specialized equipment, and the media must be inspected after degaussing to ensure that data is completely destroyed. Improper positioning may prevent degaussing from destroying all user-addressable data; the platters may also be removed and purged with a degaussing wand.
• Degaussing is not recommended for SCSI hard drives. Because flash media does not store data magnetically, degaussing is ineffective for flash media.
• Hard drives, flash media, and optical media may be shredded, pulverized, or incinerated. As we’ve discussed in other blogs, incineration is not ideal for hard drive destruction — the process must be carried out at extremely high temperatures to destroy all data, and incineration is not environmentally friendly.

NIST SP 800-88 Compliance: Choosing a Data Sanitization Method

NIST SP 800-88 is a straightforward document with specific standards for different types of data storage media. However, at scale, organizations often encounter challenges when complying with the guidelines.

For example, degaussing hard drives — while reliable — requires knowledge and time. The destruction must be verified to ensure compliance, and to comply with other laws, workers may need to keep detailed documentation of the process.

Datarecovery.com recommends working with an experienced partner when carrying out at-scale media sanitization. Our experts can maintain chain of custody reports while following NIST SP 800-88 requirements, reducing the cost of a media migration or sanitization project — and ensuring worry-free compliance with relevant standards and security/privacy laws. 

To learn more, submit a case online or call 1-800-237-4200 to speak with an expert.

The post What Are the Standards for Secure Data Sanitization? appeared first on Datarecovery.com.

Obviously, this only works on magnetic media — namely, hard disk drives (HDDs) and data storage tapes. When performed properly, degaussing irretrievably destroys data. Even with professional data recovery equipment, the information is lost forever. 

If you need to sanitize a large number of hard drives or data tapes, degaussing is an effective option. However, like all data sanitization methods, there are risks and drawbacks. 

How Hard Drive Degaussing Works

Hard drives contain platters coated with a thin magnetic material. When the drive operates, actuator heads read the charges from the platters and output data to the computer. 

The magnetic charges on the platters can be positive or neutral. Essentially, the hard drive sets the magnets in one way or the other (the data is stored in a binary format).

Hard drives also use error correction codes (EOC) to prevent missing charges from causing data loss, and a single file may be stored in disparate locations — not just in one space on the platter. To sanitize data, you’ll need to eliminate all traces of the original magnetic charges.

Degaussers apply a powerful charge across the surface of all hard drive platters, destroying all data (including the data that the hard drive references during startup). 

Some degaussers apply different types of charges to ensure that data is fully sanitized, and some data sanitization protocols call for several passes through degaussing equipment. In reality, once a hard drive passes through a degausser once, there’s a near-100% chance that it’s completely unrecoverable.

Advantages and Disadvantages of Degaussing for Data Sanitization

Degaussing isn’t appropriate for every data sanitization project. If you need to destroy a single hard drive, running it through a degausser is overkill — but if you’re working with a large library of media or you need to meet certain privacy/security standards, it’s a viable option.

Below, we’ll discuss the advantages and disadvantages. To discuss a specific data sanitization project, submit a case online or call 1-800-237-4200 to speak with an expert.

Advantages of Hard Drive Degaussing

• The degaussing process only takes a few seconds, so it’s ideal for mass HDD sanitization. 
• Degaussing works on broken hard drives. Any magnetic storage device can be degaussed, regardless of whether it’s functional. 
• Degaussing is permanent. Even with advanced data recovery equipment, the data is 100% irretrievable. 
• After degaussing, media can be recycled to comply with environmental regulations.

Disadvantages of Hard Drive Degaussing

• Degaussers are expensive. A basic degausser costs about $3,600, while advanced models can cost $18,000 or more. 
• Inexpensive models are available, but they’re not reliable for mass media sanitization. The magnetic fields of the degaussing equipment must be several times stronger than the magnetic material on the hard drive’s platters.
• Operator error can prevent total data sanitization. This is especially true if the hard drive must be positioned on the degausser in a specific way.
• Many data sanitization standards still require hard drive destruction after degaussing. The National Security Agency (NSA), for example, recommends media destruction. 
• Degaussing a hard drive renders it permanently unusable. 

Professional Options for Secure Data Sanitization

As the world leader in data recovery services, Datarecovery.com provides solutions for enterprise-level data sanitization. Our experts can maintain full chain-of-custody reports and produce other relevant documentation verifying compliance with relevant data security laws. 

We work closely with our clients to develop an appropriate, cost-effective media sanitization strategy. All storage devices are thoroughly tested to ensure conformance with NIST/NSA sanitization guidelines, and sanitized media can be safely destroyed onsite. 

To learn more about our media sanitization services, request a quote online or call us at 1-800-237-4200.

The post What Is Hard Drive Degaussing? appeared first on Datarecovery.com.

Strong magnetic fields can destroy data on hard disk drives (HDDs) and data tapes, for a simple reason: Those devices use magnetism to store data. Disrupting those charges will, necessarily, cause data loss. 

Many professional data recovery laboratories purposely use magnets to securely erase data. Degaussing is a process that applies strong magnetic fields to magnetized media, rendering them blank (and completely unusable, since the magnets also destroy the data that hard drives use for startup).

This isn’t effective for solid-state drives (SSDs), flash drives, and other flash-based media. SSDs and other NAND flash devices use floating-gate transistors to store data — not magnetic charges. 

Since they store data without relying on magnetic charges, you could theoretically place a strong magnet right next to your SSD without losing data (but as we’ll explain in a moment, you should not try this). 

The bottom line: Degaussing is not an acceptable form of secure media destruction for NAND media. However, before you place your favorite rare earth magnet next to your computer, read on.

Changes in magnetic fields can affect any electronic device.

A strong magnetic field can destroy a hard drive’s data, but doesn’t pose a realistic danger for an SSD.

However, the rate at which a magnetic field changes can introduce some issues. This rate of change is called the magnetic flux: the number of magnetic field lines that pass through a closed surface. 

Introducing a strong magnet can create small voltages, which may travel over electronic circuits and cause damage. To damage an SSD, you would need a tremendous change in magnetic flux — and that’s one of the many, many reasons that you shouldn’t bring your SSD into an MRI machine. 

Realistically, you could probably place strong magnets near your SSD without causing any issues. But even with professional degaussing equipment, you should not rely on magnetism alone to securely destroy files on an SSD. 

Related: The Dangers Of DIY Data Destruction

How can I securely destroy my SSD?

The simplest way to destroy an SSD is to physically shred it. Commercial shredders can certainly handle electronic media — but they’re expensive, and shredding your drive can create environmental hazards. 

You can also disassemble your SSD and pry out the memory chips that store the data, then destroy them. This is a time-consuming process, but it’s certainly secure.

For home and office computer users, there’s an easier way to handle data sanitization: Format the SSD. After the drive completes a TRIM operation, data is irreversibly destroyed. You can also encrypt the SSD, which may be a more realistic option if you’d eventually like to restore the data.

Related: Solid-State Drive (SSD) Data Recovery: Are My Files Lost Forever?

Before intentionally destroying data, make sure you’re prepared for the consequences.

If your SSD isn’t functioning as expected and you simply want to sanitize the data before recycling it, formatting (or removing the NAND memory chips) is an appropriate option. 

However, if your organization must follow certain standards for data sanitization, we strongly recommend working with experts. A simple format isn’t sufficient for meeting the NIST’s Guidelines for Media Sanitization, and physically destroying the device — while sufficient for sanitization — may cause compliance issues if you fail to keep appropriate documentation.

Datarecovery.com provides extensive services for data sanitization, storage media disposal, and data recovery. To learn more, submit a case online or call us at 1-800-237-4200 to speak with an expert.

The post Do Magnets Damage Solid-State Drives? appeared first on Datarecovery.com.

I can see the reason for the discussion as this is a little tricky. I find that Microsoft hasn’t been totally clear in a few places.

In Windows, a “Quick Format” (which can be thought of as a “regular” format, since it’s fairly common) does not wipe/zero/overwrite the data. But what about the specific command line “format”?

From the MS documentation here, the /q parameter appears at first glance to only prevent a CHKDSK run that would check for bad sectors.

But what does a “format” in the command line by itself with no parameters do? Well, this has changed in the past.

From the MS documentation on the format command:

If you do not specify any of the following command-line options, format uses the volume type to determine the default format for the disk.

Well what does that mean? Microsoft doesn’t link to any related documentation, unfortunately.

The GUI format dialog has a Quick Format checkbox, which seems to correspond to the /q parameter and is normally checked by default. However, MS changed the behavior of the format command for Windows Vista and later.

The behavior of the format command changed in Windows Vista and later Windows versions. By default in Windows Vista and later versions, the format command writes zeros to the whole disk when a full format is performed. In Windows XP and earlier versions of Windows, the format command does not write zeros to the whole disk when a full format is performed.

https://support.microsoft.com/en-us/kb/941961

That is fairly imprecise, since we don’t know what “when a full format is performed” means for actual command line commands.

Essentially, it means a “non /q” format on the command line. For XP and earlier, format command without /q did not overwrite with zeroes. For Vista and later, format without /q does overwrite with zeroes (one pass unless /p is specified).

How Can I Verify A Wiped Hard Drive in Windows?

The previous file system is destroyed or invalidated with a format command (speaking generally and not knowing which specific command was used). However, that doesn’t mean file data is completely gone.

If a format was completed that did not zero out all of the sectors, previous file data remains in the areas on the drive that the new file system considers to be free space until overwritten. Software that scans through raw data should be able to find files there.

Also, some software can use the remnants of the previous file system if there is still enough of that around to locate and extract files with also file system metadata intact. That works more often than you’d think with the right software in the hands of the right tech.

To verify the drive is wiped, you can use a couple different methods. Think like a data recovery engineer; try to find evidence or data from before the wipe.

Running software that scans raw data for files would be a good test of a true wipe. Something easy to try is Photorec, which is free and effective. It does a good job of scanning for files in raw data, particularly JPEGs because they have very well-defined header/footer in raw data. Each different file type is a bit different to recover from raw data. Plain text files, for instance, have no identifiers at all so are basically impossible to recover in an automated fashion, though they can certainly be seen in the raw data.

You could also simply open the drive up in a hex editor and scroll around and see what is actually on there. Is it zeroes? That’s what it should be from the MS documentation. Do some searches. Any recognizable ASCII or Unicode data in places? Binary data?

We recover data on a daily basis from drives that have had fresh Windows installs done on them that include a Quick Format. Quick Format is generally the default option in most situations (though now we know that’s no longer the case for the command line). It really depends on the overwrite damage in these cases, but we usually have good success.

The post How Windows Format Command Line Behavior Changed appeared first on Datarecovery.com.