Re: Quick Survey: How do you "dispose" of outbound hard drives??

["Doty, Timothy T." <tdoty () MST EDU>]

DBAN is what we have recommended and I believe what is in general use for
wiping drives. I don't recommend it (I'm a mildly paranoid guy) but I
believe we have relied on Dell's assertion of wiping in at least some cases.

I recently tested out secure erase using the ATA command. It has a couple of
advantages over DBAN, including that it will resume if interrupted, the
drive is locked until the command completes and it can wipe areas that are
normally inaccessible (think remapped sectors). It is fast because
essentially no data is moved across the drive interface, the wipe (once
initiated) is done by the drive itself.

I found three caveats to this approach:

1. older drives do not support it. The one I tested with did, but when I
surveyed an additional six SATA drives one did not support secure erase and
two did not implement "enhanced" erase (without which reallocated sectors
are not overwritten).

2. apparently most (all?) system BIOS "freeze" all drives on boot which
prevents execution of any security commands such as secure erase. With some
controllers pulling and replugging the live drive will unfreeze it (this
worked for me on a Dell laptop) though doing so has a risk of physical
damage. Preliminary testing indicates an eSATA interface avoids the drive
being frozen when it is not attached at boot.

3. initiating a wipe was not as painless as doing dd or using DBAN. The
various linux live CDs I had were too old and unable to successfully set a
user password on the drive (the first step) due to having an old version of
hdparm (Ubuntu 10.04 cd suffices). Wiping consists of at least two steps:
set user password and start erase. Due to varied drive support for secure
erase and controllers freezing drives additional steps may be required.

Still, for anyone using DBAN it is IMO worth considering wiping with the ATA
secure erase command where possible. The drive I wiped had ~3600 reallocated
sectors (and was still "good" according to SMART) which represents ~1.8MB of
data DBAN would not have erased.

Tim Doty

> -----Original Message-----
> From: The EDUCAUSE Security Constituent Group Listserv
> [mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of SCHALIP, MICHAEL
> Sent: Sunday, September 26, 2010 11:27 PM
> To: SECURITY () LISTSERV EDUCAUSE EDU
> Subject: [SECURITY] Quick Survey: How do you "dispose" of outbound hard
> drives??
>
> Hi Folks....
>
> We're looking for efficiencies (who isn't?) - What process do you
> follow to securely dispose of old hard drives?  Do you sanitize
> them?...what process/software do you use?  Do you allow them to be
> sold/donated?  Do you grind/shred them?  Do you degauss them?
>
> We are sanitizing them, but we're wondering if it would just be cheaper
> to use a secure recycling service?  (I know DOE/DOD does some of
> that....depending on the "level"....)
>
> Looking forward to hearing what everyone is doing....
>
> Thanks,
>
> Michael
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.

Attachment: smime.p7s
Description: