- "Do I Know This Already?" Quiz
- Physical Security Measures
- Logical Security Concepts
- Wireless Security Protocols and Authentication
- Malware Removal and Prevention
- Social Engineering Threats and Vulnerabilities
- Microsoft Windows OS Security Settings
- Security Best Practices to Secure a Workstation
- Securing Mobile Devices
- Data Destruction and Disposal
- Configuring Security on SOHO Networks
- Exam Preparation Tasks
- Review All the Key Topics
- Define Key Terms
- Answer Review Questions
This chapter is from the book
This chapter is from the book
This chapter is from the book
Data Destruction and Disposal
220-1002: Objective 2.9: Given a scenario, implement appropriate data destruction and disposal methods.
Even after computers, mobile devices, and even some types of printers have reached the end of their useful lives, the hard drives inside contain potential security risks. Risks also lie in flash drives, external drives, and optical media. To prevent confidential company or client information from being accessed from a computer or another device that is being disposed of for resale, recycling, or deconstruction for parts, the methods in the following sections should be used.
Physical Destruction Methods
Physical destruction renders a mass storage device into small pieces that cannot be reconstructed, making the data inside unrecoverable. Methods include the following:
Shredder: Some office-grade shredders can be used to destroy optical media. Electronics recyclers use heavy-duty shredders made for hard disks and mass storage devices to reduce storage devices, tape, or other types of media into small bits.
Drill/Hammer: Remove the hard disks and destroy their platters with a drill, hammer, or other device; then recycle the scrap.
Electromagnetic (degaussing): Other tools such as electromagnetic degaussers and permanent magnet degaussers can also be used to permanently purge information from a disk. The drive is physically intact, but all data, formatting, and control track data is missing. Use this type of physical destruction if you want to use a drive for display purposes.
Incineration: Incineration of tape, floppy, and other types of magnetic and optical media is allowed in some areas and available from various companies.
Data-recycling companies that destroy hard drives or other storage devices can provide a certificate of destruction to prove compliance with local laws or institutional policies.
Recycling or Repurposing Best Practices
As long as the data on a hard drive or other mass storage device can be rendered unrecoverable, it is not necessary to destroy the media itself. The following are some best practices for recycling and repurposing:
Low-level format vs. standard format: The standard format used in operating systems is a quick format. This type of format clears only the root folder. The remainder of the data on the disk can be recovered until it is overwritten. A long format rewrites the disk surface. However, data recovery programs available from many third-party firms can recover data from a formatted drive. A low-level format that creates the physical infrastructure where data will be stored on a disk is performed by the drive manufacturer before the drive is shipped and cannot be performed in the field.
Overwrite: Some disk maintenance programs from mass storage vendors include options to overwrite a hard disk’s or SSD’s data area with zeros. Data recovery programs can often recover data that has been overwritten in this fashion.
Drive wipe: To ensure the complete destruction of retrievable data on a storage device, it must be overwritten with a program that meets or exceeds recognized data-destruction standards, such as the U.S. Department of Defense (DoD) 5220.22-M (which requires 7 passes) or Peter Gutman’s 35-pass maximum-security method. These programs, referred to as drive wipes, destroy existing data and partition information in such a way as to prevent data recovery or drive forensic analysis. Use this method when maintaining the storage device as a working device is important for repurposing (such as for donation or resale). A variety of commercial and freeware programs can be used for this task, which is also known as disk scrubbing or disk wiping.