Files deleted, and drives formatted do nothing to eliminate stored information. Once hardware is out of your control, so too does your obligation follow it; therefore, the most important factor is choosing a destruction process suitable to the type of media you’re dealing with (overwrite for hard disks, crypto erase for solid state disks) and documenting whatever you choose to provide to whomever requests it.
Once we’ve confirmed that all data that could have been recovered from an old hard drive has been overwritten, then (and only then) can any of our certificates leave the lab.
Files that have been “deleted” remain intact on the original storage device until they are completely rewritten or overwritten. And even when you perform what most call “a quick format,” only the index gets rewritten. So if you’re planning to sell a computer or return it on a lease or send it out for disposal either one is insufficient and both leave data which most recovery software programs will locate.
There are two valid approaches to this problem and as always, the method used would depend upon the type of medium being utilised.
Much of the best-intentioned advice has become outdated here.
With a hard drive you can address and overwrite each sector exposed by the controller; thus, a confirmed overwrite does remove all the data. That’s why the seven- or thirty-five-pass recommendations for older much-lower-density recorders are now obsolete and do not apply; one confirmed pass on today’s equipment is currently acceptable.
With an SSD, overwrites are unreliable due to a different mechanism than with a traditional hard disk. Wear levelling is the process by which the controller determines where data is written in physical terms and includes reserved and overprovisioned areas that the operating system has no knowledge of. Data can be stored within those areas as well. Erasing using a drive’s native encryption (i.e., the drive itself performs the erasure) provides a much quicker (seconds), more thorough and less stressful method of erasing an SSD, which simply disposes of the key to the area to be erased rendering it completely unreadable.
The ease of wiping is not as important as the ability to demonstrate compliance by providing proof of that service.
Whether sold, donated, recycled or returned at the end of a lease, this represents the time in which data protection responsibilities follow the device out of the door.
Personal information must not be retained longer than required; thus, proper disposal is an essential method of proving compliance.
This represents the worst-case scenario, a hard drive that cannot be wiped due to non-functionality. In cases such as these, physical destruction of the unit along with documented evidence will provide the most effective solution.
Many contracts specifically state that “certified” destruction, with serial numbers recorded, is a requirement. Thus, the delivery of that certification, not the wiping process itself, is what ultimately proves compliance.
A quote is given prior to any destruction occurring as once this process begins it can never be reversed.
Secure destruction is priced per device and a quote will be provided based on your request. Pricing is determined by quantity of devices, type of destruction and if certification is required. Prior to commencing destruction, we will verify exactly which devices are being destroyed via their individual serial numbers.
One thing we always ask at the time of a destruction enquiry: Are you positive you do not need this information? Destruction is permanent and it is better to have ten seconds of uncertainty now versus having to answer an enquiry later about recovering this information. In those instances where there may be some level of uncertainty, we will recover first then destroy second.
No. Data deletion simply deletes the index entry and a quick format simply rewrites it. In either case the original data remains on the disk and readily accessible using normal recovery software. Secure destruction requires overwriting every single addressable sector on a hard drive or crypto-erasing a solid state disk.
Only one confirmed pass is required with current hard drives. Passes such as seven and thirty-five were created due to much lower recording densities many years ago and provide no usable benefit today.
Not reliably. Wear levelling allows the controller to determine locations of writes; and reserved and over-provisioned areas are completely unaddressable. The right way to do this is using the drive’s own crypto-erase process, which immediately wipes out the key making the flash memory unreadable.
It cannot be wiped because nothing can address it, so physical destruction with documentation of serial numbers is the best method, and this is also when certificates matter most.
Yes, this record contains serial number, method and date. The typical end-product (deliverable) is this document. Auditors, insurers and clients typically ask to view this document.
Pricing is quoted on request, based upon unit price for each item requested, and will vary depending on the total quantity requested, methods used and type of certification desired. First we will verify each device to be erased via its serial number before erasing it as once erased, there is no going back.