Erasing hard drives

[Updated: May 3, 2007 @ 11.25 am] I've just been sent word of an enterprise version of DBAN called EBAN.  More information here.

Having read How to REALLY erase a hard drive by my ZDNet blogging colleague Robin Harris, I though I'd share my views about erasing hard drives.

When getting rid of old PCs or hard drives, people tend to fall into one of three categories:

• Just chuck it out
  These folks just throw out the old PC or old hard drive without giving any though to the data.
• Minimal effort
  These are the people who realize that it's not a good idea to allow PCs or hard drives to fall into the hands of others with the data intact, but either because of a lack of knowledge or a lack of effort they choose to take the simple but ineffective route of formatting the drive instead of getting rid of the data.
• Putting in the effort
  Then there are the people who put the effort into erasing hard drives properly. 

I'm wary of sending drives containing data back to the manufacturer this unless the drive contains nothing more important than shopping lists and a stash of favorite Dilbert cartoonsPersonally, I don't think that anyone can afford to be in the "just chuck it out category" and putting in minimal effort into erasing hard drives is just as bad really.  Anyone getting rid of a PC or hard drive really should put in the time and effort to properly erase the drive.

How to erase hard drives?  Well, the two tools listed in Robin's article - Secure Erase and DBAN - are both up to the job.  If you want to or have to use a NIST 800-88 certified wiper, go for Secure Erase, otherwise flip a coin or try each out and see which you prefer.  They're both easy to use, both quite fast (although Secure Erase is faster because of the way it works) and both do what is says on the tin - wipe your hard drives.

One question that many people seem to have is how do you erase a drive that's either dead or malfunctioning?  After all, a dead drive doesn't mean that the data can't be recovered off of it.  What if you want to send that drive back to the manufacturer for a warranty exchange?  In these circumstances your options are limited:

• Send the drive back, complete with data intact and trust the manufacturer to take care of your data.  Given that people have received drives back containing other people's data, I'm wary of sending drives containing data back to the manufacturer this unless the drive contains nothing more important than shopping lists and a stash of favorite Dilbert cartoons.
• Degauss the drive.  Will probably destroy the drive (if it works - old degaussers aren't that effective on newer drives) but it will also invalidate your warranty too.
• Take a dive on the warranty and just buy a new hard drive.  Given the price of new drives nowadays, It's hardly worth the hassle getting them exchanged.

There is another alternative, but this one requires forethought.  This involves encrypting the entire drive – but you’ve got to do that before your disk develops a fault.  If you've chosen a good, solid product (such as PGP) and taken care to make sure that passwords are strong the data should be good as gone.  Of course, there are times when the risk still outweighs the cost of the drive and it's better to just destroy it.

OK, I've talked a bit about destroying hard drives.  What's the best way to do that?  Well, before I share my thoughts on this, let me share this quote with you from the Tutorial on Disk Drive Data Sanitization by Gordon Hughes, UCSD Center for Magnetic Recording Research and Tom Coughlin, Coughlin Associates (PDF):

Paranoid-level recovery concerns based on hypothetical schemes are sometimes proposed by people not experienced in actual magnetic disk recording, claiming the possibility of data recovery even after physical destruction. One computer forensics data recovery company claims to be able to read user data from a magnetic image of recorded bits on a disc, without using normal drive electronics. Reading back tracks from a disk taken out of a drive and tested on a spin stand was practical decades ago, but no longer with today’s microinch-size tracks.

OK, first off, destruction methods that don't work.  These include any scheme involving large magnets, bulk tape erasers, microwaves and so on.    It might be fun to stick a hard drive in the microwave (wait until you're alone before trying this out - in fact, considering that the burning circuit boards will produce noxious fumes, better not to do it at all!), but it's not a reliable erasure method.

OK, destruction methods that really work.  All these involve destroying the hard drive platters (which are made of aluminum or glass):

• Hammer the drive flat.
• Put it through a press.
• Remove the platters and destroy them through crushing, melting, grinding. (They also make good coffee coasters.)
• Put a few nails through the drive (six inch nails work great - but make sure you're not fixing the drive to your floor while destroying it). 
• Shoot the drive - I don't recommend this, but I've seen some sites that do.

Take your pick or come up with another method that achieves the same end (that is, bend or break the platters). 

Thoughts?