Back in the early Jurassic era (or 1956 for those requiring specifics), secure deletion of data was not an issue as computing had not entered the mainstream. That year, IBM shipped the first hard disk drives (HDDs) as part of the 305 RAMAC system. They had 24-inch platters and a capacity of 3.75 MB each. Nowadays, 4TB drives that fit in the palm of your hand are common and 10TB versions were first shipped in 2015.
As data storage requirements increase, companies often discard older equipment to keep pace with technology, by donating to charities or by means of staff purchase options, for example. However, can companies be sure that confidential or embarrassing data is removed completely from decommissioned devices? What does secure deletion of data actually involve?
Data is stored on many devices these days — from standard HDDs to solid state drives (SSDs), flash drives, memory cards and, of course, mobile devices such as smartphones and tablets. Users typically believe that using a "delete" function, clearing browser history or emptying a recycle bin is all that's needed to remove damaging and embarrassing evidence of an interest in Justin Bieber or Britney Spears, but this is far from the case.
When the data source is not physically damaged, even users with basic technical knowledge can use data recovery software to restore data, regardless of device type or data format. However, when it comes to physical damage, even dry-roasted laptops are recovered. It is not cheap but specialists in data recovery and forensics can recover practically anything, with costs ranging from hundreds to thousands of dollars. The value of the data outweighs cost considerations in many cases.
Experts readily confirm that standard user deletion or even formatting is worthless when it comes to secure deletion of data.
"Deletion and formatting are not barriers to recovery. Changing the file structure or partition structure could provide some difficulty, depending on what's changed. As long as the device is still intact, the only thing that makes data unrecoverable is writing over it," said Steve Burgess, president of Burgess Consulting & Forensics, a Santa Maria, CA-based provider of forensic data recovery and expert witness services.
Fire damage or submerging in liquid will not prevent data recovery either.
"I've also recovered data from dunked devices, as well as devices that have had lattes, martinis and dog wee-wee on them," said Burgess.
Consumer-level data recovery software can recover more than you'd think.
"If the data was recently deleted and nothing much else done to the computer or device, then consumer-level software will tend to do a fine job of recovery. It just depends on how extensive the hardware/software damage is. Software isn't much help with physically damaged devices. That would be like reading a book to fix a broken bone," said Burgess.
Therefore, physically damaged devices resist software recovery. However, there are advanced forensics techniques to recover from damaged devices — some you have seen on CSI Cyber, such as cellphone recovery at a component level — but when it comes to HDDs, you are often talking logic board (electronics that control the mechanical actions of a hard drive) replacement or cleanroom recovery, where platters are removed and inserted in a working HDD.
These actions are usually beyond the abilities of even sophisticated users as specialist skills and expensive equipment are necessary to perform this level of recovery. Unfortunately, some hackers are well funded and therein lies the requirement for secure deletion of data that could compromise the company. Failure to do so could result in financial costs from lawsuits and fines for non-compliance, and could permanently damage the company's reputation.
Therefore, it is up to companies to ensure data on decommissioned equipment is not recoverable. Successful techniques vary but the key is to damage platters (for HDDs) and storage components (for all component-based storage).
"For HDDs, a spike through the platters tends to be very effective. So is the means afforded by being a second amendment nation. The Feds melt their platters down. Degaussing [placing the drive in a strong magnetic field] may not be as effective. Using a device like a Tableau TD2u (a forensic duplicator) is pretty effective for a wipe. File-wiping software is great in principal but not always 100% effective in practice," said Burgess.
Reduce Risk and Costs of Data Loss
Of the options presented, using devices as target practice at your local firing range is an appealing one. Make it an employee day out and have fun, releasing any pent-up aggression against domineering superiors. Just make sure management are not in attendance. Remember that almost anything can be recovered if the professionals are involved and confirm that platters or appropriate components are smashed afterwards.
"I had a case of a minister whose wife thought he had his little black book on his computer, which she proceeded to take to a sandbox, pounded on it with a sledge hammer, and shoveled sand into it. After much cleaning and repair work, and lots of piecing together disparate pieces of data, we got some data back — but not nearly all of it," said Burgess.
In conclusion, if you want to ensure that even the most dedicated hacker or forensic professional cannot restore data from a decommissioned device, device destruction is the aim. Incineration can work but Burgess recommends two options, a car shredder or demolition hammer. Given the examples provided, how secure is your secure deletion process? Are you in the habit of donating equipment without securely deleting data? Time to change your process, perhaps?