If you’re determined to destroy your data, we’ve got good news: Contrary to popular misconception, it is possible to securely sanitize storage media in a way that prevents even the most advanced data recovery techniques from restoring your files.
To be clear, data recovery science has come a long way. At Datarecovery.com, we’ve successfully recovered data from fire-damaged servers, waterlogged hard drives, and everything in between — but even our capabilities are limited by physics.
If data physically does not exist on a storage device, it’s obviously unrecoverable. And the United States government has standards for media sanitization: the National Institute of Standards and Technology (NIST)’s SP 800-88.
You can read through those guidelines here. But if you’re not ready to read a long government document, we’ll explain the basics.
Data sanitization techniques fall into three categories.
The NIST defines those categories as clearing, purging, and destroying. Here’s a quick overview:
- Clearing – Refers to simple read-and-write commands and other techniques that are only intended to protect data from basic recovery techniques. If you move a file to your computer’s trash and empty the trash, you’ve cleared the file — but in most cases, the data is still recoverable.
- Purging – Refers to techniques that overwrite the target data or device utilizing block-erase or cryptographic erase methods.
- Destroying – Refers to techniques that physically destroy the storage media that holds the target file.
To make sure that data is unrecoverable, you will need to purge it in accordance with NIST standards; depending on the nature of the data, you may also want to destroy the target device.
Related: What Are the Standards for Secure Data Sanitization?
Purging data requires at least one write pass with a fixed data value.
In other words, the data must be overwritten at a block level. This usually requires special software; while we do not recommend specific software products, examples include Darik’s Boot and Nuke (DBAN) and Macrorit Data Wiper. Microsoft also offers SDelete for aiding in compliance on Windows NT/2000 systems.
So, why can’t you just delete a file? If you’re storing the data on a solid-state drive (SSD), that’s an option. Learn why deleted files are often unrecoverable on solid-state media.
But if you’re using magnetic storage (for example, a hard drive), deleting the file simply tells the operating system to mark the space as available. The hard drive doesn’t go to the trouble of actually overwriting the file — that would be resource intensive, and the file will be overwritten eventually anyway.
If the data must be sanitized, you need to overwrite the entire file. Each “pass” of the software overwrites the previously occupied space with a fixed value (in binary, a 1 or a 0). One pass is sufficient to guard against data recovery — but because software isn’t perfect, the NIST recommends conducting multiple passes for extremely sensitive files.
Destroying media can also prevent data recovery.
A hard drive badly burnt in a house fire.
Purging data is time consuming, and at scale, it can pose issues for sanitization projects. If you need to quickly clear a library of several hundred hard drives, loading up DBAN may not be practical — you may prefer to destroy the media.
Several secure options are available for hard drive destruction:
- Degaussing – High-powered magnets are passed over the hard drive, demagnetizing the platters and destroying the data. For proper sanitization, it’s crucial to use professional degaussers, which will also render the hard drives inoperable. Degaussing is only an option for magnetic storage media (not SSDs).
- Shredding – Commercial shredders can demolish hard drives, SSDs, data tapes, and other media. Because some devices have chips that store data, operators must take care to ensure that all parts of the media have been completely shredded.
- Incineration – Incineration is secure, but expensive. Additionally, it introduces serious environmental concerns, and organizations may have trouble documenting the process.
The best option is degaussing, but it must be undertaken carefully. Hard drives must be correctly positioned on degaussing equipment to ensure sanitization, and the hard drives should be checked after degaussing to verify the results.
Related: When Data Is “Gone Forever:” 3 Impossible Data Recovery Scenarios
I’m a personal computer user. What can I do to prevent sensitive data from falling into the wrong hands?
We do not recommend destroying your media. As we’ve discussed, physical destruction techniques can be tricky — and wasteful.
The best option is to use media sanitization software to completely overwrite the target files. If you’re especially concerned, perform several passes.
At scale, organizations should work with a qualified data partner to ensure compliance during media sanitization projects. Datarecovery.com provides cost-effective data sanitization services designed to aid in compliance (and reduce IT workloads).
To learn more, submit a case online or call 1-800-237-4200 to speak with an expert.
