HDDErase.zip

Tutorial on Disk Drive Data Sanitization

Gordon Hughes, UCSD CMRR (gfhughes@ucsd.edu)

Tom Coughlin, Coughlin Associates (tom@tomcoughlin.com)

April 26, 2007

Summary

Summary: user data is left on disk drives removed from computers and storage systems,

creating a data security vulnerability that many users are unaware of. Recent Federal and

state laws requiring secure erasure of user data expose companies to fines of $250,000

tested. Normal Secure Erase takes 30-60 minutes to complete. Some ATA drives also

implement the standard Enhanced Secure Erase command that takes only milliseconds to

complete.

Table of Contents

Tutorial on Disk Drive Data Sanitization............................................................................1

Summary..............................................................................................................................1

Introduction..........................................................................................................................1

Data Loss is Rampant..........................................................................................................2

Data Sanitization Legal Requirements.................................................................................3

Legal Penalties for Failure to Sanitize Data........................................................................5

Secure Erasure Implementation and Certification.............................................................11

Data Sanitization in the Real World..................................................................................12

About the Authors..............................................................................................................12

Glossary.............................................................................................................................13

Introduction

Data security has risen to be one of the highest concerns of computer professionals.

Tighter legal requirements now exist for protecting user data from unauthorized use, and

1

for both preserving and erasing (sanitizing) records to meet legal compliance

requirements. This Tutorial document will address concerns and developments in the

 Data in motion - data encrypted during transport

 Protection of data and crypto keys during transport

 Transparency to users (automatic encryption)

 Drive internal encryption (data encrypted by storage device)

 Access level dependent upon key or password used to decrypt data

 Drive data sanitization

 Secure erasure of user data for drive disposal or reuse

The following table (Table 1) outlines comparative times to execute various approaches

for data sanitization (erasure) as well as level of data sanitization security.

Table 1. Comparison of Various Data Sanitization Approaches

Secure Erase

Enhanced Secure

Erase

Data Loss is Rampant

The cardinal rule of computer storage design has been to protect user data at all costs.

Disk drives supply primary mass storage for computer systems, designed to prevent

accidental erasure of data. Techniques such as “recycle” folders and “Unerase”

commands are common ways that operating systems try to prevent accidental sanitization

of user data. Deletion of file pointers is standard to speeds data writing, because actual

overwriting of file data is far slower. Drives use elaborate error detection and correction

2

All this means that true computer data erasure is an abnormal event. These measures

taken to protect and speed access to user data can make that data vulnerable to recovery

 A survey of 769 corporate IT managers revealed that 64% had experienced laptop

theft. (Tech Republic)

When a computer is lost or disposed of, active and discarded data typically remains

stored on its hard disk drive. Even if users “delete” all their files, they can be recovered

from “recycling” folders or by special utility programs such as Norton Unerase.

of owners can and often does fall into the hands of others. Data can be recovered with

little effort, from discarded, warranty repaired, or resold disk drives. Many reports have

thousands of hard disk drives are retired. Some of these hard disk drives find their way

There is an urgent need for a capability to reliably erase data and prevent access to data

from retired computer hard disk drives for security and privacy reasons. Data sanitization

needs arise differently depending upon the user application. Even consumer drives could

use data sanitization to protect user privacy or for DRM purposes.

Data Sanitization Legal Requirements

While most people are aware of legal compliance regulations requiring long term

retention of data, the same regulations also specify the need for protection of data for

privacy and other reasons. Many of them also specify conditions and requirements for the

sanitization of data. Strict local, state and Federal legislation protecting investors,

consumers and the environment specify that organizations must be extremely careful

2

T. Coughlin, Rumors of My Erasure Are Premature, Coughlin Associates,

http://www.tomcoughlin.com/Techpapers/Rumors of my erasure,061803.pdf (2003)

3

J. Garfinkel, A. Shelat, A Study of Disk Sanitization Practices, IEEE Security and

Privacy, Jan.-Feb. 2003.

3

Personal Information Protection and Electronic Documents Act (PIPEDA)

Gramm-Leach-Bliley Act (GLBA)

Sarbanes-Oxley Act (SBA)

maximum fine of $250,000 and the responsible party can face a maximum of 10 years

imprisonment.

There are several approved methods for data sanitization that satisfy these legal

requirements or meet even more stringent corporate or government secrecy requirements.

Many of them physically destroy disk drives to prevent any future use. Another data

security measure is encryption of user data.. Secure data encryption from creation to

information. Federal document FIPS 142-2 sets cryptographic security requirements.

methods include executing the in-drive Secure Erase command, and degaussing. These

techniques. Such sophisticated techniques are threats to data privacy using specific drive

technology knowledge with specialized scientific and engineering instrumentation, to

attempt data recovery outside of the normal drive operating environment. They involve

signal processing equipment and personnel with knowledge of specific drive engineering

details, and can even involve removing the components from the hard disk drive for spin

stand testing.

Secure erase is recognized by NIST 800-88 as an effective and secure way to meet legal

NIST Special Publication 800-88, Guidelines for Media Sanitization, August 2006

4

Four basic sanitization security levels can be defined: weak erase (deleting files), block

erase (overwrite by external software), normal secure erase (current drives), and

enhanced secure erase (see below). The CMRR at UCSD has established test protocols

for software secure erase

6

erase ATA drives. A commercial secure erase device is available, which can also erase

SCSI and other drives

Block erase is most commonly used. While it significantly better than no erase, or file

came on the market). Enhanced secure erase now exists in Seagate drives, and these

drives are under evaluation by the CMRR.

These four erasure protocols exist because users make tradeoffs between sanitization

security level and the time required. A high security protocol that requires special

From Ensconce Data Technology, Inc, www.deadondemand.com

G. Hughes, CMRR Secure Erase Protocols, http:/cmrr.ucsd.edu/Hughes/

5