BitRaser >
Data Destruction Methods and Techniques

Chapter 3

Data Destruction Methods and Techniques

Chapter

3 of 6

Published on

August 31, 2021

Read Chapter 2| Read Chapter 4

Go to

Data destruction has emerged as a top-tier industrial need considering the surfeit of data, storage devices, and data protection laws. We elaborated on the key drivers elevating data destruction to its current prominence in Chapter 2 of our Data Destruction knowledge series. Interestingly, the data destruction realm is not new. It has been an integral part of the human knowledge cycle for thousands of years since papyrus was invented in 4000 BCE. You may want to read Chapter 1 to explore the historical origins and fundamental meaning of data destruction. Fast forward to the present, organizations need to understand “how to” execute data destruction in the real world such that they safeguard the data privacy of customers, avoid breaches, and meet compliance with the global data privacy and protection laws.

This chapter discusses the methods and techniques for data destruction. We take a broad perspective to the data destruction methods by mapping the underlying approaches to the frontend techniques.

Data Destruction Methods: A Bird’s Eye View
Data Destruction: Approaches and Techniques
Overwriting vs. Degaussing vs. Shredding

Data Destruction Methods: A Bird’s Eye View

Broadly, there are two categories of data destruction methods — Physical and Logical — based on their fundamental approach and target element.

1. Physical Method
The physical method destroys or incapacitates the storage media to attain data destruction. For example, disintegrating the hard drive platter is an approach for obliterating data based on the physical method. Further, shredding is an industrial technique to implement the disintegration approach. Notably, the physical method also comprises approaches that destroy data without disintegrating the storage media but destroying its fundamental physical property. One such commercial technique is called degaussing, and we discuss it later in this chapter.

A defining characteristic of the physical data destruction method is that it renders the storage media useless and turns it into electronic waste.

2. Logical Method
The logical method directly targets the data at the “memory level” by implementing specific techniques on the storage locations, including the user addressable area, Host Protected Area (HPA)[1], and Device Configuration Overlay (DCO)[2]. Typical approaches to the logical data destruction method include data overwriting, block erase, and cryptographic erase.

Overwriting is the prevalent technique to implement the data replacement approach. It destroys the existing information by overwriting it with unintelligible characters like 0s, 1s, etc. The technique is implemented using specialized data overwriting algorithms.

Block Erase is another technique for electronic erasure of the memory blocks in NAND flash-based solid-state drives (SSDs). It involves increasing the voltage levels on each memory block to a considerably higher value than the standard operating value and then suddenly dropping it to zero.

The Cryptographic Erase technique erases or replaces the Media Encryption Key of self-encrypting drives (SEDs), thereby rendering the data in the form of ciphertext, which is illegible. The technique does not destroy the data but only destroys the encryption key. So, its efficacy depends on the robustness of the SED’s encryption algorithm. Cryptographic erase is an efficient technique because it needs to erase only the encryption key; however, it may carry risks like —

Decryption of the sanitized media using a backup key saved elsewhere
Unauthorized access to data that was stored in unencrypted form

In contrast with physical destruction, the logical data destruction method allows reuse of the storage device, making it a more environment-friendly alternative to physical destruction.

Data Destruction: Approaches and Techniques

Since the mid-20th century, various data destruction approaches and techniques have emerged based on the type of storage media. This section outlines these approaches and explains how they shape the data destruction techniques for industrial applications. As an organization, you can choose a technique based on factors like storage media type, internal policy mandates, logistic and financial constraints, technical expertise, environmental impact, etc.

[1] HPA is a hidden area on the memory, which is invisible to the OS but can be accessed using special tools and commands.

[2] DCO is hidden area on HDDs, which is inaccessible through BIOS or OS but it can be accessed using specific commands & tools.

a) Physical Destruction
This approach is based on destroying the storage media such as hard drive platter, flash memory chip, USB flash drives, mobile phones, optical media, IOT devices, point-of-sale devices, etc. The approach uses “brute force” to obliterate the physical hardware, thereby rendering the media and the underlying data inaccessible to recovery methods.

Physical Destruction Techniques:
Shredding is a prevalent physical destruction technique that disintegrates the storage media using specialized equipment such as a shredder. It breaks down (shreds) the storage media like the drive platter along with the electronic and mechanical components into minute pieces, in dimensions as small as 2 mm. The data stored on the media is destroyed as a result of physical disintegration.

Image: Hard drive shredding

Other physical data destruction techniques include the following:

Pulverization: The process involves the application of an external force on the physical media to elastically deform and crack it into small pieces, thereby destroying them.
Disintegration: This is a type of shredding technique where a hard drive is broken down into small pieces of a maximum 4 mm dimension using approved hardware.
Incineration: In this process, the storage device such as hard drives are fed into a licensed incinerator and burned at high temperatures to reduce it to ashes.
Melting: The hard drive is dipped into hydrochloric acid (HCL) or nitric acid (HNO3), which destroys the platter and other components.

Shredding and other physical destruction techniques such as pulverizing are not always feasible onsite on the company premises due to logistic and financial constraints. Further, techniques such as melting and incineration carry significant Environment, Health, and Safety (EH&S) hazards. In addition, the need to ship out the storage media to an off-site shredding facility may pose a threat of data breach due to chain of custody risks while the media is in transit.

Advantages:
Physical techniques can guarantee data destruction if done properly. Also, they can destroy the data stored on all types of storage media, including hard drives, smartphones, tape media, embedded memory on motherboards and adaptors, point-of-sale devices, etc.

Disadvantages:
Physical destruction carries inherent ‘chain of custody’ risks of data leakage. Also, inadequately shredded or melted media may leave faint chances of forensic data recovery and carry data leakage risks. Further, methods like shredding pose a logistics challenge to perform onsite shredding.

b) Demagnetization
This approach is based on neutralizing the magnetic field or polarity of magnetic storage media such as hard disk drives, diskettes, etc., by applying an external magnetic field of opposing polarity.

This approach is based on neutralizing the magnetic field or polarity of magnetic storage media such as hard disk drives, diskettes, etc., by applying an external magnetic field of opposing polarity.

A sufficiently strong magnetic field disorients and demagnetizes the local magnetic domains used for storing data on the media, resulting in data destruction.

Image: How Demagnetization works

Demagnetization Technique:
As mentioned earlier, demagnetization is implemented using a technique called degaussing. It uses a degausser to apply a stronger magnetic field of higher coercivity than the target magnetic media to rearrange or randomize its field orientation. Precise matching of the degausser’s strength vis-à-vis the media coercivity is crucial for effective degaussing.

Image: Degausser

Degaussing is a traditional technique compared to overwriting. It is not considered adequate for destroying the data stored on emerging magnetic media having stronger field strengths. Also, it does not work on flash storage media such as SSDs and hybrid drives as they comprise magnetic and flash media. As per the NIST SP 800-88 Guideline, “Existing degaussers may not have sufficient force to degauss evolving magnetic storage media and should never be solely relied upon for flash memory-based storage devices or magnetic storage devices that contain non-volatile non-magnetic storage.”

Further reading: What is degaussing?

Advantages:
Degaussing can work on non-functional or dead hard disk drives. It can destroy the data stored on all types of magnetic storage devices such as hard disk drives, magnetic tapes, floppy disks, etc.

Disadvantages:
Degaussing does not work on flash memory-based storage devices and renders the device unusable. Also, the degausser needs to be physically present at the facility to sanitize the HDDs. This can pose a logistics challenge if data destruction is needed across multiple locations.

Degausser has a higher operating cost due to factors like high acquisition cost and the need to procure multiple degaussers for different locations. Further, a degausser can degauss a limited number of drives at once. It also needs removing or dismantling of the hard disk drive from PCs, servers, etc. Additionally, maintaining a consistent repository of audit trails might be a challenge due to offline or local operations.

c) Data Overwriting
This mechanism leverages the native “rewrite ability” of reusable media such as hard disk drives, solid-state drives, USB flash drives, etc., to replace or overwrite the existing data with non-sensitive data or binary patterns.

Image: Data overwriting process

Data Overwriting Technique:
The data overwriting approach is implemented using the data erasure technique, which performs a single or multiple overwriting passes to destroy the target data on all user-addressable memory locations of a drive. Data erasure is considered a state-of-the-art technique to attain permanent data destruction.

According to the National Institute of Standards and Technology (NIST) SP 800-88 Rev.1 Guidelines, “a single overwrite pass with a fixed pattern such as binary zeros typically hinders recovery of data even if state of the art laboratory techniques are applied to attempt to retrieve the data.” Data erasure is feasible on any functioning storage device that supports read/write commands from a host computer system through interfaces such as Serial Advanced Technology Attachment (ATA), Parallel ATA, Small Computer System Interface (SCSI), etc.

Data erasure is performed using specialized software that performs overwriting in accordance with data destruction standards such as NIST 800-88 Clear & Purge, US DoD 5220.22-M, etc.

Advantages:
The erased devices can be reused or monetized through reselling. Software-based data erasure can erase a large number of devices together at high speed. Further, as per NIST Guideline, overwriting can destroy the data on floppies, magnetic disks, hard drives including HDDs and SSDs, and smartphones, etc. Professional data erasure provides an easy and largely DIY method to destroy the data and generate tamper-proof audit trails for compliance.

Disadvantages::
Data erasure does not work on damaged or un-rewriteable media such as an optical disk. Also, it is not suitable for tape media due to its prolonged duration.

Overwriting vs. Degaussing vs. Shredding: A Quick Comparison

The following is a quick comparison of the overwriting, degaussing, and shredding techniques for data destruction.

Parameter	Overwriting	Degaussing	Shredding
Mechanism	Overwrites the addressable memory locations on the storage.	Demagnetizes the magnetic storage media.	Disintegrates the storage device.
How is it performed?	It is performed using data erasure software.	A degausser unit is used, which can be a coil degausser, capacitive degausser, permanent magnet degausser.	A shredder is used.
Supported drives	Hard disk drives Solid-state drives Hybrid drives USB flash storage Smartphones	Hard disk drives Magnetic tapes Floppy disks	Hard disk drives Solid-state drives USB flash drive Magnetic tapes Floppy disks Optical drive Integrated memory (Point-of-sale device, motherboard, etc.)
Scalability	High – software can erase thousands of drives and devices simultaneously	Low – A limited number of drives can be degaussed	High – the company can hire a vendor on contract for limited or bulk shredding needs; however, the turnaround time would be higher, considering the transit and process durations.
Efficacy	High – Professional data erasure tool implements the overwriting technique with multiple passes and verification as per International standards like NIST SP 800-88 to ensure failsafe data destruction.	Low – Successful degaussing requires a strong enough magnetic field to neutralize the magnetic media’s polarity, which could pose a challenge to degauss the emerging magnetic storage.	High – Devices, once appropriately shredded in the required dimensions, can guarantee to safeguard against the risks of data retrieval.
Ease-of-use and convenience	Data erasure software with GUI offers an easy way to erase the drives. Does not require special preparations like dismantling or removing the drive from the host machine. Can be performed by an individual familiar with general computer and software usage.	Technical expertise is required to operate a degausser unit. Manual efforts might be needed.	Shredding is a specialized capability available only with IT asset destruction service providers.
Post-processing value of the storage hardware	Overwriting or erasure retains the residual value of the storage hardware to allow further usage or monetization.	Renders the device unusable.	Destroys the device.
Environment, Health, and Safety (EH&S) impact	Environment » No Impact Does not generate any e-waste Health & Safety » No Impact Poses no hazard to the health and safety of personnel.	Environment » High Impact Generates e-waste Health & Safety » Moderate Pulse & Coil degaussers carry health hazard due to exposure to strong electrical charge. Permanent magnet degausser is considered safe.	Environment » High Impact Generates e-waste Health & Safety » Moderate Methods like incineration and melting carry risks of injury.

Conclusion

This chapter covered substantial ground on modern data destruction methods, approaches, and techniques. We also outlined how these techniques stand next to each other regarding their applicability, efficacy, practicality, costs, outcomes, etc., and their advantages and disadvantages. These parameters provide crucial inputs when you need to outline a suitable data destruction strategy.

However, a question remains: how do you adopt these techniques in your organization’s policy framework and make them serve your real-world needs?

A data destruction policy could be the answer.

Read Chapter 4: Data Destruction Policy to understand how you can introduce & practice systematic data destruction in your organization to serve data destruction and compliance goals.

Read Chapter 2: Why is Data Destruction Gaining Eminence? | Read Chapter 4: Data Destruction Policy — Everything You Need to Know

Let's get started

Interested in finding out more about our solutions?

Request Free License

Need help+1-844-775-0101

LATEST UPDATE

Articles, Events, News & Knowledge Series That May Interest You

Knowledge Series

Want to get an in-depth understanding of the data destruction realm? Get an incisive knowledge on data destruction, it's methods & techniques and how organizations can adopt it in their practice.

Residual Data Study

Stellar conducted World's largest residual data study on second hand devices to provide insights on the threat landscape ranging from data privacy & security breaches at the time of disposing of used devices.