While SSDs get all the glory these days, mechanical hard drives are not only still in use, they’re advancing in both speed and capacity. These devices hold huge amounts of data all over the world, but that data is just not likely to be in your house.
Massive data centers all over the world use mechanical hard drives for mass storage, and as you’ve probably realized some of that data is personal information that related to you. Which means that when those data centers and other businesses are done with those drives, they need to dispose of them in such a way that your data cannot be recovered by third parties. But, how effective is that disposal process really?
Deleting files and formatting the drive remove the directions, not necessarily the data
There’s no quick solution
One of the big problems with data on discarded or sold hard drives comes from how these devices work. Data is stored on platters coated with magnetic materials. Powerful magnets change the alignment of magnetic particles on the disk so that they represent either a one or a zero, which is of course the foundation of binary code.
When you “delete” a file on Windows, the only thing that actually happens is an amendment to the index of files on the drive. The area the data resides is marked as available space, but until it’s actually overwritten, the physical data is still there. This is why you can use “undelete” software to retrieve files immediately after accidentally deleting them. There likely hasn’t been enough time to overwrite the information.
In order to properly erase a drive, you need to use a secure-erase process, such as ShredOS. This systematically overwrites every part of the hard drive’s platters to make recovery virtually impossible, but it takes a while. Which is why a business with hundreds of hard drives to dispose of might not go to the trouble.
Don’t think formatting is good enough either, especially a “quick format,” which again leaves all the actual data intact, but just tells the computer to write over it all if it likes.
Drilling or smashing a drive only damages part of each platter
It only looks broken sometimes
Surely smashing a drive would be enough? If the drive is faulty and isn’t going to be resold, then giving it a few decent whacks with a hammer until it looks nice and broken feels like the way to go. Certainly, it’s going to deter the casual person coming across a discarded drive, but anyone with the right skills and parts can recover data from disk platters by rebuilding a drive from spares. If your hammering did not actually damage the platters enough, then data recovery specialists can retrieve that information with the right tools and someone to foot the bill.
Even large intact pieces of a platter can still be read by the pros!
Even degaussing and shredding can fail when the equipment is wrong
Though combining both will probably work!
What about throwing the drive in a specialized crusher? Now we’re talking! However, even then the platter pieces have to be sufficiently small to make any chance of recovery implausible.
Degaussing machines, which use powerful magnets to wipe hard drives, can also fool a company into thinking it’s erased a drive when it hasn’t. If you read the guidance from NIST, you’ll see that while this method was pretty effective in the past, modern hard drives might not be quite as susceptible. Especially since some hybrid drives also cache data on flash chips, which can stand up to those strong magnets.
The issue here is that you can’t just run the magnet over the drive and call it a day, you need to verify that it no longer works, or combine it with another destructive method of disposal.
The drives can survive because nobody confirms where they actually went
While there are obviously technical challenges when it comes to erasing or destroying a hard drive to the point where any reasonable person would say the job was a success, companies might not be actually destroying drives for reasons that have nothing to do with hard drive technology itself.
In the end, when drives are submitted for destruction, they might end up in places they’re not supposed to. The company might get a certificate of destruction, but is anyone checking that the serial numbers of the smashed drives match the ones marked for disposal? This is what happened to the National Health Service in the UK (as detailed by The Guardian) where hard drives containing confidential patient records ended up on eBay.
The off-site disposal service wasn’t secure, and so while the NHS thought the drives had been properly disposed of, someone had diverted them and tried to make a buck online. Ironically, if that reseller had simply used a secure erasing method, no one would have been any the wiser.