· 7 years ago · Sep 22, 2018, 08:00 PM
1Tutorial on Disk Drive Data Sanitization
2
3
4
5Gordon Hughes, UCSD CMRR (gfhughes@ucsd.edu)
6
7Tom Coughlin, Coughlin Associates (tom@tomcoughlin.com)
8
9
10
11Summary
12
13Summary: user data is left on disk drives removed from computers and storage systems,
14creating a data security vulnerability that many users are unaware of. Recent Federal and
15state laws requiring secure erasure of user data expose companies to fines of $250,000
16and responsible parties to imprisonment for 10 years.
17
18
19
20Complete eradication of user data off drives can be accomplished by running data Secure
21Erasure utilities such as the freeware “HDDerase†downloadable here. It executes the
22Federally-approved (NIST 800-88) Secure Erase command in the ATA ANSI standard,
23which is implemented in all recent ATA drives greater than 15-20 GB. A similar
24command in the SCSI ANSI standard is optional and not yet implemented in drives tested.
25Normal Secure Erase takes 30-60 minutes to complete. Some ATA drives also implement
26the standard Enhanced Secure Erase command that takes only milliseconds to complete.
27
28
29
30Table of Contents
31
32
33
34Introduction........................................................................................................................1
35Data Loss is Rampant.........................................................................................................2
36Legal Data Sanitization Requirements................................................................................3
37Data Eradication on Hard Disk Drives...............................................................................5
38Physical Drive Destruction.............................................................................................6
39Disk Drive Degaussing...................................................................................................6
40Nondestructive Data Erasure..........................................................................................7
41Fast Secure Erase...........................................................Error! Bookmark not defined.
42Data Encryption Secure Erase........................................................................................9
43Computer Forensics Data Recovery.................................................................................10
44Secure Erasure Implementation and Certification............................................................11
45Data Sanitization in the Real World.................................................................................12
46About the Authors.............................................................................................................12
47Glossary...........................................................................................................................13
48
49
50Introduction
51
52Data security has risen to be one of the highest concerns of computer professionals.
53Tighter legal requirements now exist for protecting user data from unauthorized use, and
54for both preserving and erasing (sanitizing) records to meet legal compliance
55requirements. This Tutorial document will address concerns and developments in the
56sanitization and protection of user data.
57
58
59
60
61Overall data storage security entails protection at different levels and locations:
62
63• Data at rest - drive data erasure
64
65
66• Secure erase of all data blocks on disk drives
67
68
69• Single file erasure
70
71
72• Drive physical or magnetic destruction
73
74
75• Data in motion - data encrypted during transport
76
77
78• Protection of data and crypto keys during transport
79
80
81• Transparency to users (automatic encryption)
82
83
84• Drive internal encryption (data encrypted by storage device)
85
86
87• Access level dependent upon key or password used to decrypt data
88
89
90• Drive data sanitization
91
92
93• Secure erasure of user data for drive disposal or reuse
94
95
96
97
98
99
100The following table (Table 1) outlines comparative times to execute various approaches
101for data sanitization (erasure) as well as level of data sanitization security.
102
103
104
105Table 1. Comparison of Various Data Sanitization Approaches
106
107
108
109Type of Erasure
110
111Average Time
112
113 (100 GB)
114
115Security
116
117Comments
118
119Normal File Deletion
120
121Minutes
122
123Very Poor
124
125Deletes only file pointers, not actual data
126
127DoD 5220 Block
128Erase
129
130Up to several days
131
132Medium
133
134Need 3 writes + verify, cannot erase
135reassigned blocks
136
137Secure Erase
138
1391-2 hours
140
141High
142
143In-drive overwrite of all user accessible
144records
145
146NIST 800-88
147Enhanced Secure
148Erase
149
150Seconds
151
152Very high
153
154Change in-drive encryption key
155
156
157
158
159
160Data Loss is Rampant
161
162The cardinal rule of computer storage design has been to protect user data at all costs.
163Disk drives supply primary mass storage for computer systems, designed to prevent
164accidental erasure of data. Techniques such as “recycle†folders and “Uneraseâ€
165commands are common ways that operating systems try to prevent accidental sanitization
166of user data. Deletion of file pointers is standard to speeds data writing, because actual
167overwriting of file data is far slower. Drives use elaborate error detection and correction
168techniques to make sure that they don’t return incorrect user data.
169
170
171
172All this means that true computer data erasure is an abnormal event. These measures
173taken to protect and speed access to user data can make that data vulnerable to recovery
174by unauthorized persons.
175
176
177
178
179Following are some statistics on computer loss and theft1:
180
181• Statistics show that 1 of every 14 laptops is stolen, and over 2,000 computers are
182stolen every day in this country. ((Information Week)
183
184
185• A computer is stolen every 43 seconds
186
187
188• Over 98% of stolen laptops are never recovered. (FBI)
189
190
191• A survey of 769 corporate IT managers revealed that 64% had experienced laptop
192theft. (Tech Republic)
193
194
195
196
197
198
199When a computer is lost or disposed of, active and discarded data typically remains
200stored on its hard disk drive. Even if users “delete†all their files, they can be recovered
201from “recycling†folders or by special utility programs such as Norton Unerase.
202
203
204
205If data is not erased beyond recovery, data on disk drives that leave the physical control
206of owners can and often does fall into the hands of others. Data can be recovered with
207little effort, from discarded, warranty repaired, or resold disk drives. Many reports have
208been written on data recovered from discarded disk drives.2,3 Each year hundreds of
209thousands of hard disk drives are retired. Some of these hard disk drives find their way
210back into the market and their data can be recovered unless it is erased securely.
211
212
213
214There is an urgent need for a capability to reliably erase data and prevent access to data
215from retired computer hard disk drives for security and privacy reasons. Data sanitization
216needs arise differently depending upon the user application. Even consumer drives could
217use data sanitization to protect user privacy or for DRM purposes.
218
219
220
221Data Sanitization Legal Requirements
222
223While most people are aware of legal compliance regulations requiring long term
224retention of data, the same regulations also specify the need for protection of data for
225privacy and other reasons. Many of them also specify conditions and requirements for the
226sanitization of data. Strict local, state and Federal legislation protecting investors,
227consumers and the environment specify that organizations must be extremely careful
228when disposing of IT equipment that has outlived its usefulness.
229
230
231
232There are several laws and regulations that relate to data retention and data sanitization
233on data storage devices like hard disk drives. Some US requirements are listed below:
234
235
236
237Health Information Portability and Accountability Act (HIPAA)
238
239Personal Information Protection and Electronic Documents Act (PIPEDA)
240
241Gramm-Leach-Bliley Act (GLBA)
242
243California Senate Bill 1386
244
2451 The U.K. Times Information Security Supplement, 27March2007
246
2472T. Coughlin, Rumors of My Erasure Are Premature, Coughlin Associates,
248http://www.tomcoughlin.com/Techpapers/Rumors of my erasure,061803.pdf (2003)
249
2503 J. Garfinkel, A. Shelat, A Study of Disk Sanitization Practices, IEEE Security and
251Privacy, Jan.-Feb. 2003.
252
253
2544 NIST Special Publication 800-88, Guidelines for Media Sanitization, August 2006
255
256Sarbanes-Oxley Act (SBA)
257
258SEC Rule 17a
259
260
261
262The Federal Health Insurance Portability and Accountability Act (HIPAA) sets goals on
263keeping personal information secure in the health industry. If a company is found in non-
264compliance of HIPAA data security practices, the company may be exposed to a
265maximum fine of $250,000 and the responsible party can face a maximum of 10 years
266imprisonment.
267
268
269
270There are several approved methods for data sanitization that satisfy these legal
271requirements or meet even more stringent corporate or government secrecy requirements.
272Many of them physically destroy disk drives to prevent any future use. Another data
273security measure is encryption of user data.. Secure data encryption from creation to
274destruction is approved by some regulatory compliance legislation to protect sensitive
275information. Its security level is determined by Federal document FIPS 142-2.
276
277
278
279According to newly released data sanitization document NIST 800-884, acceptable
280methods include executing the in-drive Secure Erase command, and degaussing. These
281data sanitization methods erase data even against recovery even using exotic laboratory
282techniques. Such sophisticated techniques are threats to data privacy using specific drive
283technology knowledge with specialized scientific and engineering instrumentation, to
284attempt data recovery outside of the normal drive operating environment. They involve
285signal processing equipment and personnel with knowledge of specific drive engineering
286details, and can even involve removing the components from the hard disk drive for spin
287stand testing.
288
289
290
291Secure erase is recognized by NIST 800-88 as an effective and secure way to meet legal
292data sanitization requirements against attacks up to laboratory level.
293
294
295Gramm-Leach-
296Bliley Sarbanes-Oxley FACTA HIPAA
297
298
299
3005 From Ensconce Data Technology, Inc
301
3026 G. Hughes, CMRR Secure Erase Protocols, http:/cmrr.ucsd.edu/Hughes/
303
304
305
306Legal Penalties for Failure to Sanitize Data
307
308The following table5 summarizes the fines and jail penalties for violation of the data
309security laws.
310
311
312Data Sanitization in Hard Disk Drives
313
314
315
316Four basic sanitization security levels can be defined: weak erase (deleting files), block
317erase (overwrite by external software), normal secure erase (current drives), and
318enhanced secure erase (see below). The CMRR at UCSD has established test protocols
319for software secure erase6.
320
321
322
323Block erase is most commonly used. While it significantly better than no erase, or file
324deletion, or drive formatting, it is vulnerable to malware and incomplete erasure of all
325data blocks. Examples are data blocks reassigned by drives, multiple drive partitions, host
326protected areas, device configuration overlays, and drive faults.
327
328
329
330Normal secure erase is approved by NIST 800-88 for legal sanitization of user data up to
331Confidential, and enhanced secure erase for higher levels. Enhanced level has only
332recently been implemented, initially in Seagate drives, and these drives are under
333evaluation by the CMRR.
334
335
336
337These four erasure protocols exist because users make tradeoffs between sanitization
338security level and the time required. A high security protocol that requires special
339software and days to accomplish will be avoided by most users, making it little used and
340of limited practical value. For example, the old data overwrite document DoD 5220 calls
341
342
343for multiple block overwrites of Confidential data, which can take more than a day to
344complete in today’s large capacity drives. So users make tradeoffs between the time
345required to erase data and the risk that the next drive user may know and use recovery
346techniques which can access weakly erased data. Figure 1 shows tradeoffs in security
347level vs. speed of erasure for various erasure options.
348
349
350
351Figure 1. Security vs. Speed of Completion of Various Modes to Erase Data on Hard
352Disk Drives
353
354
355
356
357SecuritySpeedDoD5220
358Physical
359DestructionDoD5220
360Multiple
361Block
362OverwritesFast Secure
363EraseSecure
364EraseUsual
365Computer
366EraseSecuritySpeedDoD5220
367Physical
368DestructionDoD5220
369Multiple
370Block
371OverwritesFast Secure
372EraseSecure
373EraseUsual
374Computer
375Erase
376
377
378For all but top-secret information, users will usually turn to erasure methods that take
379minutes rather than hours or days. They will select a method that gives them an
380acceptable level of security in a reasonable time window.
381
382Physical Drive Destruction
383
384To positively prevent data from recovery, disks can be removed from disk drives and
385broken up, or even ground to microscopic pieces. (Actually, simple disk bending is
386highly effective, particularly in emergency situations.) Obsolete government document
387DoD 5220.22M required physical destruction of the storage medium (the magnetic disks)
388for data classified higher than Secret. Even such physical destruction is not absolute if
389any remaining disk pieces are larger than a single 512-byte record block in size, about
3901/125†in today’s drives. As linear and track densities increases, the maximum allowable
391size of disk fragments become ever smaller Destroyed disk fragments of this size have
392been studied by the CMRR2. Magnetic microscopy is used to image stored recorded
393media bits.
394
395
396
397Some storage products are more easily destroyed than hard disk drives, such as magnetic
398disk data cartridges, tape cartridges, secure USB drives, and optical media.
399
400
401
402Disk Drive Degaussing
403
404Degaussers are used to erase magnetic data on disk drives. They create high intensity
405magnetic fields that erase all magnetic recordings in a hard disk drive, including the
406sector header information on drive data tracks (information necessary for drive head
407positioning and data error recovery). In addition, track and disk motor magnets are often
408
409
410also erased by degausser magnetic fields. Like physical destruction, when a disk drive
411has been successfully degaussed it is no longer useable.
412
413
414
415The CMRR evaluates commercial degaussers for data sanitization.
416
417
418
419Drive designers continually increase the linear density of magnetic recording to create
420higher data storage capacity per disk. This raises the disk magnetic coercivity, the field
421required to write bits on the magnetic media. As the magnetic coercivity increases, the
422fields required to erase the data on recorded disks increases. Thus an older degausser may
423not fully erase data on a newer hard disk drive. New perpendicular recording drives may
424not be erasable by present degaussers designed for past longitudinal recording drives.
425
426
427
428Future generations of magnetic recording media may use very high magnetic coercivity
429disks to achieve areal densities greater than 500 gigabits per square inch. These drives
430may have technology using laser light in the magnetic write element of the disk drive, to
431raise the temperature of a spot on the magnetic medium in order to lower the magnetic
432coercivity to the point where the write element can record a bit on the very high
433coercivity magnetic media. For disk drives using this Heat or Thermally Assisted
434Magnetic Recording (HAMR/TAMR) technology the degausser field required to erase
435the disk drive at room temperatures may be impossible or impractical to achieve. In this
436case the drive may have to be physically destroyed.
437
438
439
440“Hybrid drives†are now being introduced for notebook or laptop computers that have
441flash memory write cache on hard disk drive circuit boards. Magnetic degaussing would
442not affect any resident data on such semiconductor memory chips. Data on these non-
443volatile semiconductors would have to be sanitized using some other technique. For all
444these reasons degaussing of all the data on hard disk drives will become increasingly
445impractical.
446
447
448
449Nondestructive Data Erasure
450
451Sanitization of data on a hard disk drive is not a simple task. Deleting a file merely
452removes its name from the directory structure’s special disk sectors. The user data
453remains in the drive data storage sectors where it can be retrieved until the sectors are
454overwritten by new data. Reformatting a hard disk drive clears the file directory and
455severs the links between storage sectors, but the user data remains and can be recovered
456until the sectors are overwritten. Software utilities that overwrite individual data files or
457an entire hard drive are susceptible to error or malicious virus attack, and require constant
458modifications to accommodate new hardware and evolving computer operating systems.
459
460
461
462It is difficult for external software to reliably sanitize user data stored on a hard disk drive.
463Many commercial software packages are available using variations of DoD 5220, making
464as many as 35 overwrite passes. But in today’s drives, multiple overwrites are no more
465effective than a single overwrite. Off-track overwrites could be effective in some drives,
466but there is no such drive external command for a software utility to move heads offtrack.
467And even three overwrites can take more than a day to erase a large capacity hard disk
468
469
4707 NIST Computer Security Resource Center, Special Publication 800-88: Guidelines for Media Sanitization,
471August 2006
472
473drive. In busy IT facilities, such time is often not available and IT personnel are likely to
474take short cuts.
475
476
477
478DoD 5220 overwriting has other vulnerabilities, such as erasing only to a drive’s
479Maximum Address, which can be set lower than its native capacity; not erasing
480reallocated (error) blocks; or miss extra partitions. External overwrites cannot access the
481reallocated sectors on most drives, and any data once recorded is left on these sectors.
482These sectors could conceivably be recovered and decoded by exotic forensics. While
483enterprise-class drives and drive systems (SCSI/FC/SAS/iSCSI) allow software
484commands to test all the user blocks for write and read ability, mass market drives
485(PATA/SATA) cannot read, write, or detect reassigned blocks since they have no logical
486block address for a user to access.
487
488
489
490The Secure Erase (SE) command was added to the open ANSI standards that control disk
491drives, at the request of CMRR at UCSD. The ANSI T13.org committee oversees the
492ATA interface specification (also called IDE) and the ANSI T10.org committee governs
493the SCSI interface specification.
494
495
496
497Secure erase is built into the hard disk drive itself and thus is far less susceptible to
498malicious software attack than external software utilities.
499
500
501
502The SE command is implemented in all ATA interface drives manufactured after 2001
503(drives with capacities greater than 15 GB), according to testing by CMRR. A
504standardized internal secure erase command also exists for SCSI drives, but is optional
505and not currently implemented in SCSI drives tested.
506
507
508
509Secure erase is a positive easy-to-use data destroy command, amounting to “electronic
510data shredding.†Executing the command causes a drive to internally completely erase all
511possible user data record areas by overwriting, including g-list records that could contain
512readable data in reallocated disk sectors (sectors that the drive no longer uses because
513they have hard errors).
514
515
516
517SE is a simple addition to the existing “format drive†command present in computer
518operating systems and storage system software, and adds no cost to hard disk drives.
519Because the Secure Erase command is carried out within hard disk drives, no additional
520software is required either.
521
522
523
524Secure erase does a single on-track erasure of the data on the disk drive. The U.S.
525National Security Agency published an Information Assurance Approval of single pass
526overwrite, after technical testing at CMRR showed that multiple on-track overwrite
527passes gave no additional erasure.
528
529
530
531Secure erase has been approved by the U.S. National Institute for Standards and
532Technology (NIST), Computer Security Resource Center7. NIST document 800-88
533
534
5358 G. Hughes, “Wise Drivesâ€, IEEE Spectrum, August 2002
536
5379 e.g. Seagate Momentus 5200 drives
538
53910 Storage magazine, October 2006
540
54111 Storage magazine, December 2006
542
543approves SE at a higher security level than external software block overwrite utilities like
544as Norton Government Wipe, and it meets the legal requirements of HIPAA, PIPEDA,
545GLBA, and Sarbanes-Oxley.
546
547
548
549Software overwrite utilities running in protected execution environments (e.g. running
550inside file system hardware like RAID arrays or inside secure computers) could be
551verified secure under NIST 800-88. For the most sensitive data, the government requires
552physical destruction of drives.
553
554
555
556Drive manufacturers today are pursuing higher security secure erase (including secret
557data), via in-drive data encryption (see below)
558
559
560
561Data Encryption Secure Erase
562
563Recently, 2.5-inch hard disk drives for laptop computers have been introduced which
564encrypt user data before recording—internal full data encryption8,9 Such drives provide
565protection of data should the laptop or drive be lost or stolen, and even provide high
566protection from forensic data recovery. These drives also offer a new, instantaneous way
567to sanitize data on a hard disk drive – by securely discarding the encryption key.
568
569
570
571Why encrypt data at rest in drives instead of in computers, such as by user application
572programs that access the data? Because computer level data encryption defeats the
573purpose of many important data management functions, such as incremental backup,
574continuous data protection, data compression, de-duplication, virtualization, archiving,
575content addressable storage, advanced routing, and thin provisioning10. Defeating these
576operations causes significant penalties to enterprise storage companies in data access
577speed and cost,. Each of these operations exploits the structure of user data, and needs to
578inspect the data. They become inefficient or nonfunctional if the data has been
579randomized by encryption. For example, data compression ratios may fall from more than
5802:1 to less than 1:1, because compressing random data can expand it instead. De-
581duplication won’t find identical data sets if they are encrypted by different users.
582
583
584
585Computer level encryption could be employed with in-drive encryption as well, the
586double encryption does no harm and provides additional security. In-drive encryption
587can relieve encryption key management problems inherent in removable storage, like
588laptop disk drives or tape backups. In fact, hardware-based tape drive encryption may
589become widespread11 by 2007 due to widely publicized losses of backup tape reels
590containing identity theft data on millions of people.
591
592
593
594
59512 www.actionfront.com
596
597Full Disk Encryption (FDE) Enhanced Secure Erase,†(“FDE-SEâ€), securely changes the
598internal drive encryption key, to render encrypted user data on disk indecipherable. This
599is enabled via the Enhanced SE command in the present ATA ANSI specs.
600
601
602
603FDE SE encryption needs to be tested for protection against advanced forensic analysis.
604The results will determine the erasure security data level - Confidential, Secret, Top
605Secret, or higher. The US Commerce Department prohibits most 256-bit and higher
606encryption export overseas, limiting FDE E-SE to AES-128-bit encryption (since disk
607drives are a global industry).
608
609
610AES-256 bit encryption in FDE drives could allow FDE SE at a somewhat higher
611security level. Note that a FDE E-SE operation amounts to double AES-128, because the
612data encrypted by the discarded key is decrypted by the new key, and AES is a symmetric
613encryption scheme. It would appear that a brute force attack on double AES-128 requires
614the same computational effort as single AES-256.
615
616
617
618For paranoid-level security, the cypt-text in an FDE disk drive could be eliminated by a
619Normal OW SE done after the FDE E-SE.
620
621
622
623An open industry standard for FDE is being worked on by the Trusted Computing Group
624overall specification (the Storage Working Group in trustedcomputinggroup.org). Drive
625members of the TCG include Seagate, HGST, Fujitsu and WD. SE via encryption may be
626included, consistent with the ANSI open standards for ATA drives (t13.org)
627
628
629
630CMRR has begun testing FDE-SE drives. They take less than 15 milliseconds to
631complete an Enhanced SE; while a 750 GB ATA-interface HDD can take over an hour to
632erase using conventional Secure Erase (or many hours using external overwrite software).
633
634Computer Forensics Data Recovery
635
636Forensics recovery uses exotic data recovery techniques by experts with advanced
637equipment. Its normal purpose is to recover data from failed hard disk drives, and for
638legal discovery. Forensic companies can successfully recover unerased but protected data
639in a disk drive using electronic instrumentation. However, the secure erase commands
640discussed above erase all user data on the disk drive beyond physical disk drive forensic
641recovery. Drives old enough to permit such attack are too old to have the Secure Erase
642built-in command.
643
644
645
646Paranoid-level recovery concerns based on hypothetical schemes are sometimes proposed
647by people not experienced in actual magnetic disk recording, claiming the possibility of
648data recovery even after physical destruction. One computer forensics data recovery
649company claims to be able to read user data from a magnetic image of recorded bits on a
650disc, without using normal drive electronics12. Reading back tracks from a disk taken out
651of a drive and tested on a spin stand was practical decades ago, but no longer with today’s
652microinch-size tracks.
653
654
65513 T. M. Coughlin and G. F. Hughes, “Secure Erase of Disk Drive Data,†IDEMA Insight Magazine, pp.
65622-25, Summer 2002
657
65814 See white papers at http://www.actionfront.com/ts_whitepaper.aspx
659
660
661
662The time required by exotic technologies is itself a barrier to data recovery and increases
663data security. Also, accessing data from magnetic images requires overcoming almost a
664dozen successive magnetic recording technology hurdles. Even if these hurdles were
665overcome, about an hour would be required to recover a single user data block out of
666millions on a disk. Recovering substantial amounts of data in less than months requires
667that the disk be intact and undamaged, so that heads can be flown over it to obtain data
668playback signals; then overcoming these technology hurdles. Simply bending a disk
669makes this nearly impossible, so physical damaging drives to warp their disks makes
670recovery practically impossible.
671
672
673
674Other “experts†claim that limited information can be recovered from unerased track
675edges. But this has been shown to be false by tests at CMRR13. Such recovery also
676presumes detailed technical knowledge of the drive’s magnetic recording design. Charles
677Sobey at ChannelScience.com wrote an illuminating article on drive-independent data
678recovery, showing how difficult these hurdles are.14
679
680Secure Erasure Implementation and Certification
681
682CMRR has studied secure erase for the Federal Government for many years, and its
683research4 demonstrates three distinct protocols for user data deletion:
684
685
686
687Weak deletion by users deleting files in public operating systems such as Windows or
688Linux (“usual computer erase’ in Figure 1). This deletes only file directory entries, not
689the user data itself.
690
691
692
693Block overwrite utilities overwrite all user accessible blocks (at the time of overwriting).
694It gives a higher level of deletion confidence than file erase, and these utilities claim to
695meet Federal Government requirements in DoD 5220. Today’s hard drive technology has
696obsoleted this document, and NIST 800-88 should be used instead.
697
698
699
700Disk drive Secure Erase is a drive command defined in the ANSI ATA and SCSI disk
701drive interface specifications, which runs inside drive hardware. It completes in about 1/8
702the time of 5220 block erasure.
703
704
705
706CMRR provides verification and certification of data erasure effectiveness for the
707government as well as drive companies and may be the most experienced organization in
708the world on disk drive data erasure. It is one of the few public organizations with
709detailed knowledge of drive internal technology. CMRR requested the SE command now
710in the T13.org ATA specification. For Normal Erase mode the spec requires that the
711SECURITY ERASE UNIT command write binary zeroes to all user accessible data areas.
712Note that ATA reassigned blocks are not user accessible because they have no user
713address. CMRR verification testing shows that the erasure security is at the Purge level of
714NIST 800-88, because drives having the command also randomize user bits before
715
716
71715 Digital Shredder, Ensconce Technology, ensconcedata.com
718
719storing on magnetic media. The erasure verify DoD 5220 requires (which is often
720forgotten), is via in-drive internal write fault detection hardware, which takes no
721additional time. This reduced execution time increases user willingness to erase drives.
722CMRR measured test times were up to days for DOD 5220 but the drive normal Secure
723Erase can complete in 15-45 minutes.
724
725Data Sanitization in the Real World
726
727The security erase command is available to all users, the Federal government, and in
728commercial drive erasure products15. In a typical recent 2006 month there were 622
729downloads of the freeware secure erase utility from the CMRR web site
730(http://cmrr.ucsd.edu/hughes/SecureErase.html). This is significantly higher than the
731historic past average of 109 downloads per month, arguably caused by increasing interest
732in Secure Erase. (Downloads in early 2006 averaged in the middle three hundreds per
733month.)
734
735
736
737The Department of the Navy licensed secure erase to erase data from disk drives. Some
738commercial vendors are also selling products using Secure Erase, such as Esconce Data
739Technology15.
740
741About the Authors
742
743
744
745UCSD CMRR does certification of secure erase and other data sanitization procedures.
746Contact Gordon Hughes of UCSD CMRR for more information. See
747http://cmrr.ucsd.edu/hughes
748
749
750
751Coughlin Associates provides data storage consulting and market and technology analysis
752of the data storage industry. Visit www.tomcoughlin.com or call 408-871-8808 for more
753information.
754
755
756
757
758Glossary
759
760
761
762ANSI T-10 ANSI standards committee overseeing SCSI interface
763specification
764
765
766
767ANSI T-13 ANSI standards committee that overseas the ATA interface
768specification
769
770
771
772ATA Advanced Technology Attachment, also known as IDE this
773interface was developed to connect disk drives in which the
774drive controller is integrated in the disk drive. This interface
775is moving from parallel (PATA) to serial (SATA) interfaces
776
777
778
779CMRR Center for Magnetic Recording Research at UCSD provides
780research on various magnetic recording topics as well as
781related technology
782
783
784
785Delete A command that moves a file to a recycle folder where it is
786kept with its links intact until the recycle folder is emptied.
787
788
789
790Degauss To apply a high enough magnetic field to a magnetic
791recording device to erase all the magnetic data stored on it.
792See magnetic coercivity.
793
794
795
796FDE Full Disk Encryption is a method to do encryption of the data
797on a hard disk drive where the encryption and code keys are
798managed by the internal drive electronics
799
800
801
802FDE-SE Data sanitization performed by throwing away the key for the
803encrypted data. Without the encryption key decoding the data
804is difficult
805
806
807
808DoD 5220 Actually DoD Directive 5220.22M, “National Industrial
809Security Program Operating Manual," January 1995 specifies
810the use of 3 overwrites to erase data on a hard disk drive
811
812
813
814Encryption To encode data. Hard disk drives are often
815encrypted to
816
817protect the data they contain from unauthorized access
818
819
820
821GLBA Gramm-Leach-Bliley Act
822
823
824
825HAMR Heat Assisted Magnetic Recording (also known as Thermally
826Assisted Magnetic Recording, TAMR)
827
828
829
830
831HIPAA Health Information Portability and Accountability
832Act
833
834
835
836
837
838Longitudinal Recording Magnetic recording in which the magnetized regions of the
839recording medium have their magnetization pointing in the
840plane of the medium
841
842
843
844Magnetic Coercivity A technical measure of the external magnetic field necessary
845to cause the magnetic state of a recording medium to half
846erase. Completely erasing a magnetic recording requires
847applying a field of about twice the magnetic coercivity. In
8481980, disk media coercivity was about 300 Oersted; today it
849can exceed 4000 and an effective degausser must be thirteen
850times as powerful.
851
852
853
854NIST SP800-88 National Institute of Standards and Technology Guidelines
855for Media Sanitization, released August 2006
856
857
858
859PATA See ATA
860
861
862
863Perpendicular Recording Magnetic recording in which the magnetized regions of
864recording medium have their magnetization pointing out of
865the plane of the medium
866
867
868
869
870
871PIPEDA Personal Information Protection and Electronic Documents
872Act
873
874
875
876Recycle Folder A computer location where “deleted†files are kept until the
877recycle folder is emptied
878
879
880
881SATA See ATA
882
883
884
885SBA Sarbanes-Oxley Act
886
887
888
889SE Secure Erase is data sanitization by overwriting the data on
890the hard disk drive. This usually included overwriting the
891data left in the reallocated defect sectors. Enhanced SE is
892done by changing or eliminating a disk drive encryption key.
893
894
895
896SCSI Small Computer System Interface, an interface originally
897used by Apple and UNIX computers to connect hard disk
898drives to computers. Also widely used for storage arrays.
899SCSI commands are used in Fibre Channel disk drives for
900
901
902array applications. Serial Attached SCSI or SAS is displacing
903the older parallel SCSI interfaces.
904
905
906
907Secure Erase (SE): A technique for sanitizing all the data stored on a hard disk
908drive using internal commands. The data erased can include
909reallocated defect sectors
910
911
912
913TAMR See Heat Assisted Magnetic Recording (HAMR)
914
915
916
917TCG Trusted Computing Group. This group works on data
918security standards and is in charge of the FDE specification
919
920
921
922Unerase To recover data “deleted†from a drive, possible because
923only file pointers to drive data are normally erased, not
924actual user data
925
926
927
928
929
930
931
932