topic Re: Verification of clearing or purging of storage media in Tech Talk

Verification of clearing or purging of storage media

ericgeater — Thu, 17 Aug 2023 17:46:34 GMT

This particular thread shed some light on the subject of data removal from storage media, and as I am currently evaluating software removal (with simple tools like Disk Wipe and sdelete from SysInternals), the whole thread is interesting to me.

But I'm also curious to know what software tools y'all might recommend to verify that a drive was successfully cleared, purged, or encrypted. At present, I'm evaluating DiskView (another SysInternals freebie), but felt like I'd ask if ya'll have a preferred method of clear/purge validation.

Thanks!

eric

Re: Verification of clearing or purging of storage media

Caute_cautim — Fri, 18 Aug 2023 04:57:58 GMT

HI All

NIST 800-

One technique: https://www.bitraser.com/ppc/data-eraser-software.php?gad=1&gclid=CjwKCAjwivemBhBhEiwAJxNWN-6ghwcG4jUFzw7iIGU-Fi7FIBay-nHikqfDfo9HSgftH2RgGT4uZRoCN-wQAvD_BwE

NIST 800-88

https://www.youwipe.com/

https://www.youwipe.com/certificates/

Regards

Caute_Cautim

Re: Verification of clearing or purging of storage media

Caute_cautim — Fri, 18 Aug 2023 06:45:29 GMT

Translated this becomes:

To bring an element of optimism and encouragement to your wishes, you can say "Happy Birthday! May All Your Dreams Come True", which Happy Birthday means "Happy Birthday! May all your dreams come true". This expression captures your desire for your aspirations to come true.

Looks like spam to me? Anyone else concur?

Regards

Caute_Cautim

Re: Verification of clearing or purging of storage media

Steve-Wilme — Fri, 18 Aug 2023 08:17:57 GMT

Maybe it's a suggestion on what your should overwrite your data with. A bit unconventional, but I'm sure you could give it a try.

Re: Verification of clearing or purging of storage media

Early_Adopter — Fri, 18 Aug 2023 09:32:52 GMT

No way!

How could you be so cynical?

They are wishing me happy in several months time!

Re: Verification of clearing or purging of storage media

Early_Adopter — Fri, 18 Aug 2023 09:34:14 GMT

Massive big shredder.

It’s the only way to be sure, if you can’t take off and nuke the site from orbit…

Re: Verification of clearing or purging of storage media

JoePete — Fri, 18 Aug 2023 12:52:47 GMT

"Happy Birthday! May All Your Dreams Come True"

... must be a reference to yesterday's birth of the ISC2 ... or are we just going by "2" now?

@ericgeater I don't have a specific recommendation. For awhile, it was a 4-lbs sledge hammer (safety glasses are an essential). My guess is any advertised product will re-format and zero out the media. If you're really paranoid, do it multiple times. If I have access to the media, I'm still physically destroying it. When you look at the declining cost of storage, you're probably not re-using it anyway.

The larger issue, however, may be where is the data. In this day and age, it can be in many places and cached on many devices. This gets to SOC reports and SLAs. But there are some policy and training issues at work here. One thing I try to impress on people is write locally and then move your document to your cloud environment. The premise that we classify first and then create may make sense from a security standpoint but very few people actually work that way. We create, then we classify. It can takes months in some cases for someone to identify or recognize that a sensitive nugget of information entered a document.

Re: Verification of clearing or purging of storage media

ericgeater — Fri, 18 Aug 2023 13:36:48 GMT

Thanks to everyone who responded, incluido esa persona que me deseaba un feliz cumpleaños... a pesar de ni siquera era mi cumpleaños. Gracias a usted!

Clearing and purging are easy, but ensuring that clearing and purging have occurred is the goal. I think I may employ BitLocker with truly random keys as the next step after clearing and purging... then move on to reuse (when warranted) or physical destruction.

And physical destruction is the end game anyway, but clearing-purging-encryption is the insurance.

(Reportaré el mensaje)

Re: Verification of clearing or purging of storage media

denbesten — Fri, 18 Aug 2023 17:10:45 GMT

Explosives are fun :-).

With respect to "sanitization" if the drive had been earlier bitlocker-ed I might swap it to a new machine (to disassociate it from the private key in the TPM) and then reformat and re-bitlocker so I am confident that it has a new bitlocker key.

However, if not previously encrypted, I now feel that capacities have gotten so large that wiping is too-expensive (time-wise), leaving physical destruction as my preferred avenue. An interesting thought. Cut the drive in half; discard one half today and the other half in 6 months.

Re: Verification of clearing or purging of storage media

denbesten — Fri, 18 Aug 2023 17:33:00 GMT

@JoePete wrote:
My guess is any advertised product will re-format and zero out the media. If you're really paranoid, do it multiple times.

Adding to this, if "formatting" takes only a few moments, only the first portion of a hard drive was overwritten, making it "look empty", but not actually overwriting all the data. Secret files are still there and can often be recovered with specialized tools. Proper "overwriting" takes hours/days.

One thing I try to impress on people is write locally and then move your document to your cloud environment.

This is a very good point. Our efforts to prevent accidental loss do make intentional destruction more difficult. Destroying media is all well-and-good if the goal is media destruction. But if the goal is data-destruction, don't for get the backup, archive and sync locations.

Re: Verification of clearing or purging of storage media

Caute_cautim — Sat, 19 Aug 2023 02:29:55 GMT

All

Lets do it like the professionals do: https://www.maxxeguard.com/

It is the only high security hard disk shredder of its kind. With minimum noise MAXXeGUARD easily destroys hard disks (hard drives) up to the highest security levels as well as other digital data carriers like SSD’s, LTO’s, USB’s, CD’s, PDA’s etc . With the MAXXeGUARD you can vary the cut length from 70 – 1 mm. This allows you to choose the correct cut length for each product type and in accordance with the security classification of the stored data ( classified / non-classified ).

Watch the youtube video and be enthralled..... Why waste time, energy, safety etc.

Plenty of other choices to consider, a thing of beauty - just make sure you ensure the audit team have signed off the material as this is a one way trip.

Regards

Caute_Cautim

Re: Verification of clearing or purging of storage media

Caute_cautim — Sat, 19 Aug 2023 02:49:50 GMT

@ericgeater

What is the difference between clear and purge?

Purge applies physical or logical techniques that render target data recovery infeasible using state-of-the-art laboratory techniques. Purge provides a more thorough level of sensitization than Clear and is used for more confidential data.

NIST Clear
Clear applies standard read/write commands, techniques, and tools, to overwrite data found in all user-accessible storage locations. It overwrites data with nonsensitive data (binary 1s and 0s) on media such as Advanced Technology Attachment (ATA) hard drives and SSDs.

Security level: Official
Level of data protection: Moderate, protecting against simple, noninvasive data recovery techniques
Can be used for: Floppy disks, disk drives, ATA hard drives, SCSI drives, flash media (USB sticks, memory cards, SSDs)
Pros: The storage media can be reused, reducing e-waste, and most devices support some level of Clear sanitisation.
Cons: It does not address data found in hidden or inaccessible areas.
Sustainability: Favorable outcomes, as assets can be reused (internally or externally, depending on the classification level of the overwritten data).

NIST Purge
Purge refers to a physical or logical technique (while Clear only uses logical techniques) that renders target data recovery infeasible using state-of-the-art laboratory overwrite, block erase, and cryptographic erase methods. It provides a higher level of media sanitisation than Clear and is thus used when handling more confidential data.

This then depends on the host country government security standards and related policies.

Regards

Caute_Cautim

Re: Verification of clearing or purging of storage media

Early_Adopter — Sat, 19 Aug 2023 04:11:24 GMT

Will it blend…?

Most assuredly… 😄

Re: Verification of clearing or purging of storage media

ericgeater — Mon, 21 Aug 2023 13:01:04 GMT

BTW, @Caute_cautim, while I was slightly disappointed that the Maxxeguard appliance was not the Blend-O-Matic™ that I expected, I was truly enthralled at its sheer (little joke there) effectiveness. Now I want one.

Also, the end goal for every drive has always been physical destruction. The clear-purge-encrypt angle prior to destruction is for defense-in-depth purposes, mainly because the industry never stopped evolving.

Case in point: our production PCs currently have a variety of drive technologies: rotational 3.5" and 2.5", solid state replacements which fit the 3.5" and 2.5" form factors, NVME and M2 chip drives, and on. Most of those fitting old form factors have barcoded serial numbers, useful for some tracking. The chips only have serials which get tracked by software.

Hard drives with serial numbers are a lot easier to track their destruction. Not to mention, their form factor is just more conspicuous because they're so easily identifiable. NVME and M2 chips could easily go into pockets, or get lost, or neglected, or misidentified. So they need a preventive solution, too.

Re: Verification of clearing or purging of storage media

Caute_cautim — Mon, 21 Aug 2023 20:35:17 GMT

@ericgeater

Education mode for the masses: I learnt something too.

Non-volatile Memory Express (NVMe) is a host controller interface that increases the data speed of laptops, PCs, and gaming consoles. It is a substitute for the Small Computer System Interface (SCSI) standard and the Advanced Technology Attachment (ATA) standard. NVMe is a super-fast way (900% faster than the AHCI equivalent) to access non-volatile memory. Built on a high-speed PCIe interface, NVMe is also known as NAND flash memory that comes in several forms including SSDs, PCI Express (PCIe) add-in cards, M.2 cards, and U.2 connectors. NVMEs have been specifically designed for SSDs and hence they are fast becoming popular storage choices for laptops, PCs, and servers in data centers. NVMe-based SSDs work with all major operating systems, irrespective of their form factor.

M-dot-2 or M.2 is the Next Generation Form Factor (NGFF), a dynamic form factor SSD used in internally mounted storage expansion cards. It endures high data storage in thin, power-constrained devices like Ultrabook laptops and tablets. The size of M.2 SSD is smaller than other mini Serial Advanced Technology Attachment (mSATA), but it can process data at a much faster speed than SATA or SAS SSDs.

How to securely destroy:

https://www.bitraser.com/kb/how-to-wipe-nvme-and-m.2-drives.php

https://www.ibm.com/docs/en/linux-on-systems?topic=devices-secure-data-deletion-nvme-drive

https://www.bitraser.com/ppc/ssd-data-erasure-software.php?gad=1&gclid=EAIaIQobChMIjbGgocrugAMVgg97Bx2MKQwAEAMYASAAEgLJp_D_BwE

https://nvmexpress.org/about/

Regards

Caute_Cautim