Nowadays there is plenty of statistical evidence backed by several data destruction companies in countries like Australia, UK, Dubai, Sri-Lanka, Saudi Arabia, Thailand, Malaysia, Singapore, Nigeria, Kenya and South Africa to confirm that two out of three companies have faced data management issues and risks. At the end of the data lifecycle, enterprises can archive it for later use, or can destroy this information. Data destruction is the process of removing information, rendering it unreadable or irrecoverable. There are different kinds of disk wipe services and secure wipe solutions that allow an organization to securely store or remove this data.
According to experts from data destruction company, there are different kinds of secure data erasure procedures. Enterprises need to categorize the data that is supposed to be destroyed according to their storage media, confidentiality levels, as well as the future plans for this devices and resources. Then, with the help of secure data erasure professionals, companies will decide the most adequate secure data destruction procedure. After data erasure, enterprises should employ review process to verify the effectiveness of each solution or service. The most common procedures for secure erase are:
Clear Procedure
In clear procedure experts use hardware & software tools to overwrite the storage space on drives that should be wiped, replacing the files with random data. This method is advised for devices that store non-sensitive data.
Using this procedure for hard drive’s secure erase allows the overwriting of logical storage locations and user-addressable locations. However, hard drive secure data erasure can’t be done if devices are damaged or non rewriteable. For storage media such as mobile phones (which are not storage devices themselves) the clearing procedure involves the device’s factory reset. According to secure wipe solutions experts, some devices do not directly support the ability to rewrite or apply media-specific techniques to the non-volatile storage contents thus only allow deleting the file pointers. Secure wipe solution should ensure that the device interface does not facilitate retrieving the deleted data.
Purge Procedure
Purge procedure for secure data erasure depends on the use of physical or logical procedures that render data recovery infeasible even with the help of state of the art methods. Block erase and cryptographic erase are vital for purge procedure and are very effective for secure erase. Data destruction company’s experts agree on the fact that degaussing is also considered part of purge procedures. Degaussing results in a hard drive with completely secure data erasure, as it renders a magnetic device purged. Disk wipe services professionals should consider the strength of degaussing and make sure it matches with the media coercivity. However, degaussing cannot be used for secure erase of non-magnetic storage media. Companies that are about to hire this kind of services should previously consult disk wipe services specialists.
Destroy Procedure
Destruction during secure data erasure renders data recovery infeasible, as devices can’t be used for data storage anymore. According to data destruction specialists, there are two main storage media destruction procedures:
- Disintegration, Pulverization, Melting, and Incineration: These are methods aiming to definitively destroy any storage media, and they’re carried out by disk wipe service providers at completely secure environments outside the client’s facilities. Disk wipe companies should be able to destroy the storage devices effectively and securely.
- Shredding: Shredders are used to destroy devices so that they can’t be reconstructed. According to data destruction company’s recommendations, the shreds size must be small enough to prevent the storage devices from being reconstructed. To mitigate any reconstruction possibility, the shredded material can be mixed with other non-sensitive material.
Methods to verify secure data destruction
Verify the process of data destruction is an essential step to maintain confidentiality. Personnel not belonging to the secure data destruction company should execute the review. There are two commonly used types of secure data destruction verification:
- Full Verification: In this method the review is applied for each piece of storage media; as a result, the data destruction process check could take very long.
- Sampling Review: In this method the review is applied to a randomly selected sample of the total amount of wiped storage devices. This secure data destruction check takes less time, but is not as detailed as a full verification.
Secure wipe solution devices verification
According to the experiences of multiple data destruction companies, verification doesn’t end with the implementation of one of the methods explained above. If a company has used secure wipe solutions for its devices, it should periodically check and maintain its storage media. Secure wipe solution device verification includes degaussing and any other deletion method.
Secure data erasure competencies verification
Review of secure erase competencies is an important element along with reviewing the secure data destruction service process. Companies should review competencies and expertise of secure data destruction service providers and ensure their staff gets secure data erasure training/course during the implementation of data destruction services.
Secure data destruction services results verification
The aim of secure data destruction services is to ensure that drive’s secure data erasure effectively happened. Normally companies don’t have access to data recovery laboratories infrastructure to check the secure erase. Credibility of secure wipe solutions and data destruction services can easily be reviewed via full reading of all accessible areas on the drive to verify results.
During a full review, the drive should be read completely to verify that no data exists on it. This type of review will take a lot of time and effort, but this method guarantees the effectiveness of secure wipe solutions and data destruction services.
According to disk wipe services experts, companies can also choose sample-reviewing methods for checking credibility of secure wipe software or disk wipe services. However, companies should consider the following points while using the sample reviewing method:
- There are many secure wipe or disk wipe services in the market that only wipe a subset of drive. To avoid incomplete hard drive secure erase companies can review pseudorandom locations on the drive while verifying the credibility of secure wipe solutions or disk wipe services. Along with pseudorandom locations on the drive the sample review method must also select hard drive subsections for verification. The best way to avoid incomplete hard drive’s secure data erasure is to select at least two non-overlapping pseudorandom locations from within every subsection selected. As secure data destruction companies experts instruct, each sample should cover at least 5% of the subsection and should not overlap the other sample in the subsection.
- Another point to be considered while sampling is to select first and last addressable location on the storage device as some secure wipe software don’t delete data from first and last addressable location thus leading to incomplete hard drive’s secure data erasure.
- For encrypted data erasure, the sample verification process should work differently, as the original data content is unknown and comparison is not possible. When cryptographic erase is leveraged, there are multiple options for verification, and each uses a quick review of a subset of the media. Encrypted hard drive’s secure data erasure involves a selection of pseudorandom locations in different subsections for sampling. However, the process involves looking for a file in known locations and thus the percentage of addressable areas is relatively small, mentions a secure data destruction company’s expert.
- During the review of secure wipe software or disk wipe services, it’s also recommended to select a subset of media items to review using a different review tool. As per recommendations from data destruction company experts, during this review at least 25% of wiped media should be considered. This review method will help to compare and validate the effectiveness of the hard drive’s secure data erasure.
With the help of data destruction and disk wipe service companies any enterprise can easily decide what procedure is appropriate for their specific case. Besides, enterprise professionals should get trained in reviewing the data destruction results and processes to verify the credibility of different solutions and services.
Our secure data destruction services, secure wipe solutions and training course helps to identify and resolve risks associated with data management in your organization. Our secure erase methodology is very different from traditional methodology of data destruction companies. Our methodology is based on a process of manual and automated verification procedures using our own scripts, proprietary, commercial and open source tools that identify all types of recoverable data.
With research centers in Mexico, USA and India, International Institute of Cyber Security (IICS) delivers the best destruction services, secure wipe solutions and training courses. We have a partner program that recognizes the effort and investment of strategic allies, offering online courses, classroom courses, services and solutions to achieve sustainable and mutually beneficial business. Our partners / partners program is available in Australia, UK, Dubai, Qatar, Sri-Lanka, Saudi Arabia, Thailand, Malaysia, Singapore, Nigeria, Kenya and South Africa.