Recovering Data from a Destroyed Drive is Easier than You Think

Think shredding or overwriting your media gives you the security of total data destruction? Think again. 

Would you imagine that data could be recovered from a hard drive that had been partially melted, shredded, and charred? Yet, that is exactly what happened to a hard drive from the space shuttle Columbia. 

Partially melted after passing through the atmosphere, the hard drive dropped from about 40 miles above Earth at a phenomenal speed and remained on the ground for six months before it was found. The dust seal suffered a devastating impact from the intense heat when it went through the atmosphere. It was exposed to all kinds of particles. And yet, forensic analysts were able to recover 99% of the data present on the hard drive.

If data can be recovered from a disk drive destroyed while traveling through space, you may ask yourself: how secure is my data disposal program? 

Michael Harstrick

Chief Global Development Officer at Garner Products, Inc

Data Insecurity: Shredding is Not Enough

With 1.5 million workers now working from home, data security risks have risen exponentially. Too often, hard drives and devices are left to pile up in the back of a non-secure, almost forgotten closet after remote worker equipment is returned for a replacement or upgrade. Also, security teams, commonly operating with skeleton crews, are wondering how to properly dispose of all that decommissioned equipment filled with confidential, proprietary, and even top-secret data.

First and foremost: Know your industry data regulations and which apply to your organization. Numerous regulatory entities create laws and regulations addressing data breaches. Here is a link to the most common https://garnerproducts.com/compliance-regulations/overview.

All of these regulations have a common thread: to protect the privacy and sanctity of consumer information in all forms. While the method of data sanitization is not always clearly defined, best practices among the regulators indicate three steps: 

1. Completely erase the hard drive of all data
2. Physically destroy the hard drive
3. Maintain verified proof of data erasure and destruction

Complete Erasure. As I noted in my previous articles on the inadequacy of overwriting, a National Association for Information Destruction (NAID) study released in March 2017 found that 40 percent of used electronic devices sold on the secondhand market contained personally identifiable data. 

Usernames, passwords, credit card data, tax details, and contact information were found on used hard drives, mobile phones, and tablets that were analyzed in the study. The recovery process used to identify data on more than 250 devices required no advanced forensic training.

To ensure this does not happen, the National Security Agency (NSA) requires complete data erasure with a process like degaussing as the only sure way to guarantee that all of your data has been erased. Degaussing doesn’t rely on the software or operator to decide what data is sensitive. Degaussing does not leave any data behind. Degaussing erases the entire hard drive working or not, in less than one second by encompassing it with a strong magnetic pulse. Degaussing erases all data to the highest security level and only takes seconds to complete. The degaussing process can be laboratory tested and verified. Degaussing is an approved method of erasing TOP-SECRET data by the NSA.

Physical destruction. Although physical destruction of a hard drive is not necessary after it has been degaussed, hard drive erasure can be followed by a method of physical destruction to visually indicate the hard drive has gone through a complete data destruction process, this can be accomplished by using a crusher, bender or shredder. 

Despite what you may have heard, shredding alone is not complete destruction. Shredding only physically alters the size of the hard drive.  It is important to recognize, data can and is recoverable from “shredded” disk fragments. 

The NSA shred requirement is a 2mm²particle size, the size of the thickness of a pencil lead. To meet that requirement, you need a shredder/crusher/disintegrator that can achieve a 2mm²particle size.  

But even a 2mm² disk fragment still contains retrievable data, as you can see in the graphic below.  A 2mm²disk fragment is the paper equivalent of 2.52 pallets of paper, equaling 15 sets of an Encyclopedia Britannica containing data. Because of this, shredding alone is not complete data destruction.

Shredding isn’t easy or environmentally safe. Mechanically reducing a hard disk drive (HDD) to a 2mm²particle size requires a huge machine that is expensive, loud, takes a great deal of power, and produces significant amounts of dust into the surrounding air. Not a solution that lends itself to a data center or office.  

By contrast, degaussers are small (about the size of a CPU), light-weight (ranging from 35-105 lbs.), and can be carried or rolled into an office, data center, or warehouse.  A degausser plugs into a standard wall outlet and takes seconds to complete a cycle.  Degaussing is also environmentally friendly; it does not physically alter the external appearance of the hard drive allowing the degaussed hard drive to be recycled.  

Verified Proof of Erasure and Destruction. Documented proof of destruction is a necessity in our litigious society. How do you prove that your data destruction process meets the standards and regulations of your industry? Garner is the only degausser manufacturer that offers an automated erasure and destruction verification system called IRONCLAD. IRONCLAD takes JPEG images of the media before and after it is degaussed; verifies the destruction process was successful and generates a record of erasure and destruction for audit and archival purposes. The information is preserved in an exportable IRONCLAD Erasure and Destruction Certificate. 

Summary 

The bottom line: Shredding hard drives is not enough. Shredding is an analog solution to a digital problem. Shredding remains an industry-approved method for the destruction and disposal of paper, but in this digital world of hard drives and data storage, it is an insecure, inadequate, and outdated method of data destruction.  

 Today, your company needs to securely dispose of magnetic storage media.  Modern HDDs are written at 4 Tbits/sq inch — an unimaginable density. A 2mm particle of such a drive contains 500,000 pages of data. Shredding alone will not protect your organization from data breaches. True data protection is a reality only when you degauss, destroy and verify.

Garner Products is a nationally recognized leading manufacturer of NSA/CSS EPL-Listed data destruction equipment. Garner offers a full line of degaussers and destroyers from office-quiet desktop units to equipment for top-secret data elimination. Learn more about Garner Products at GarnerProducts.com

Safety First Data Disposal Practices

By Michael Harstrick
Chief Global Development Officer

Download PDF

As companies enter the next phase of the battle against COVID-19, the safety of employees and the security of their facilities remains a key concern. That includes how decommissioned media and sensitive data is eliminated.  

Is your IT closet stuffed with old disk drives and tapes that need to be destroyed? You are not alone. 

In light of the ongoing Shelter in Place (SIP) restrictions, a key consideration is whether to go with in-house, onsite disposal, or outsourcing.   

Outsourcing your data disposal needs has its benefits. You make a phone call and the company arrives with its team of professionals and sanitizes or removes your unwanted hard drives and tapes. Out-of-sight.  Out-of-mind. 

Yet in today’s environment, outside vendors coming into your facility may present unknown risks. Companies that have started to reengage workers are requiring a range of safety measures. 

These include “regular health screenings at entrances and requiring workers to wear face masks and other protective gear on the job. Many companies are changing floor plans, rerouting workers through separate entrances and exits, and staggering shifts to limit interaction,” according to the Wall Street Journal.

These measures impact both your employees and your outside vendors. 

The better alternative is to contain your data disposal in-house with your own equipment, operated by your in-house team on your schedule.

With in-house data disposal your company gains:

• The ability to immediately erase the data without stockpiling.
• Absolute control over the entire data elimination process. 
• Assurance that all compliance regulations are followed, chain-of-custody is maintained, and physical data breaches are prevented. 
• Accurate tracking and documentation to withstand the scrutiny of data security audits.

Choosing the right approach

You have many options when it comes to choosing in-house data elimination and destruction methods.

Overwriting

This may appear to be the easiest approach but actually takes the most knowledge to ensure compatibility of equipment.  Overwriting is a time and energy-intensive option, generally taking 8 to 14 hours for each drive. But be careful. Overwriting is not an NSA or DoD approved form of sanitization. Also, it can only be performed on fully functioning hard drives. Overwriting is the lowest level of data security for your organization. 

Shredders 

Shredders physically destroy your drives. However, physical destruction is not enough as I shared in a previous LinkedIn article. Recovering data from destroyed hard drives is easier than you might think: even when that disk drive fell from the space shuttle, burned on reentry, and sat in the dirt for six months. 

Degaussers

Degaussing — removal of all data from hard drives and tape media through demagnetizing – provides the most secure method of data elimination recognized by the NSA. Degaussing takes less than one second to eliminate all data on any size hard drive.  When you degauss your drive, regardless of whether you physically destroy it, you have performed the most secure method of data destruction. Degaussing provides complete protection for your organization. 

Destroyers

High-quality hard drive destroyers bend break and mangle hard drives and internal components — including the data platters, PC boards, and read-write heads. Hard drive destroyers physically damage the media which makes data recovery more challenging. They provide visual verification that the media has gone through a data destruction process before media disposal. Because destroyers alone lack the data elimination aspect that degaussers perform, it is best practice to destroy drives after degaussing, 

For fully secure data elimination and destruction, degauss and destroy your hard drives and tapes. 

Purchase considerations

When choosing your data elimination equipment, consider the following:

• Level of security needed. Your vendor should offer a range of products -- from those designed for quiet office operations to NSA-listed equipment developed for the elimination of TOP-SECRET data.
• Ease of use. The equipment should be easy to use by non-technical staff through a simple one or two-step process. 
• Transportable. For the most convenient data elimination, choose equipment that allows you to destroy data at the removal point. A rolling, easily transportable, the high-quality cart allows you to degauss and/or destroy data as it is removed from the rack.
• Verification. Be sure your equipment allows you to accurately verify, document, and preserve your process in a traceable log and generate a certificate for proof of erasure and destruction; including serial numbers and images of the media.

Garner products offers a full line of degaussers and destroyers complete with our IRONCLAD audit verification system. Learn more about Garner.

Protecting Our Healthcare First Responders

When you have the skills and talent to help, you step up. That’s a core value of Garner Products, Inc. It’s the driving reason behind Garner’s decision to expand beyond our Mission Critical manufacturing of NSA/CSS EPL-listed data erasure and destruction equipment to develop custom face shields for health care professionals battling against COVID-19.

Then there is the personal reason. Owners Ron and Michelle Stofan’s daughter is a nurse. While her hospital is not in a coronavirus hot spot, the Stofans saw a broader need. They wanted to make sure that healthcare providers have the equipment they need to protect themselves. 

“We heard there was a shortage of Personal Protection Equipment (PPE), and we wanted to do something about it,” said Michelle Stofan.  

The first step in our process was matching the PPE shortages to Garner’s manufacturing capabilities. That evaluation led to the decision to make face shields using our Flow waterjet. A waterjet uses a hair-thin, high-pressured stream of water as its cutting tool. Garner’s engineering team designed the face shield program in CAD, which was then converted into CAM and programmed into the waterjet. Next, Garner faced the challenge of many manufacturers in this environment—sourcing the right materials.

“Due to material shortages, it was difficult finding the plastic shield and elastic band material in the correct thickness. Engineering also designed and built a device that cut the elastic bands and seared the ends so they wouldn’t fray,” explained Ron Stofan.

With the design and manufacturing challenges behind them, it was time to find the manpower  to get the job done. Because the entire Garner team is still working at full capacity on our current customer commitments, the face shield project needed an extra effort. It was an effort that everyone from engineering to sales to graphics design was willing to step up to. 

A former machine shop team member, Justin Stofan, who is now part of the sales team, came in after hours to run the waterjet to cut the shields. Engineer, Ryan Moore, did assembly and packaging. A special touch was added by the graphic design department for the headband, provided by our graphic designer Shannon Hulley. Instead of a sterile hospital look, she designed a fun band with pictures of puppies, kittens and other images that would make patients smile.

“The goal is to help people and also make their lives a little happier,” Ron said. 

The first 100 shields made were sent to Hilltop Community Resources in Grand Junction, CO to support their mission of compassionate and comprehensive human services and care. Garner’s team is reaching out to local hospitals and care centers to identify where additional shields can do the most good.  

Garner Products is a nationally recognized leading manufacturer of NSA/CSS EPL-Listed data destruction equipment. Garner offers a full line of degaussers and destroyers from office-quiet desktop units to equipment for top secret data elimination.

Learn more about Garner Products at https://garnerproducts.com/