Data Demolition

The IT manager for a multi-site law firm was stumped. As part of a companywide security crackdown, he'd been given orders to ensure any disk drives that were replaced in his data center got destroyed. Overwriting disks with software would not be sufficient. Baffled but eager to please, he asked two of his technicians to bring in hand-drills and sledgehammers. An afternoon's hard work outside the company loading docks, and the job was done.

Sound extreme? Think again. A growing number of IT pros are faced with replacing NAS gear, tape drives, or storage arrays without risking the loss of sensitive data. And depending on their company's position on the matter, they may be going to the shed -- the garden shed -- for the solution.

Options for destroying storage equipment, including magnetic disk and tape drives, encompass hiring a destruction contractor, buying disk-erasing software or equipment, buying equipment to physically destroy the drives -- or taking up cudgels.

In the case above, introduced on an IT technical Web forum, the IT manager's boss wouldn't hear of sending the old drives out to be destroyed, since that involved outsiders who could potentially snatch precious data. Had that been permitted, the manager could have hired firms such as Security Engineered Machinery Co. Inc. (SEM), which offers to destroy your drives for $3 to $7 apiece -- while you watch. Here is a "before/after" view of what SEM promises to do:

Figure 1: Source: SEM

SEM also sells "degaussers" OEM'd from Fujitsu Ltd. (Tokyo: 6702; London: FUJ; OTC: FJTSY). Customers can use these boxes to erase data from hard drives, typically by taking the drives out of the NAS, SAN, or server and feeding them into a drawer or slot on the degausser, which removes all data from the drives using a magnetic field.

Other firms selling degaussers include Data Security Inc. and Garner Products, among others.

Garner's president, Ron Stofan, says that in addition to degaussers ranging in price from $7,600 to $22,500, enterprise customers also can buy machines that degauss and physically destroy the disks by puncturing them. Tape can be degaussed by the same machine that degausses disks, but you need a separate destroyer machine.

Why would a company spend five figures to hammer holes in a disk after you've already degaussed it -- especially if you can do the hammering yourself? The short answer is that it's actually tough to destroy some hard drives with hammers. And any intact pieces may be vulnerable to bad guys with infinite lab resources -- a prospect that's simply too much risk for some organizations.

"Degaussing eliminates data," says Stofan. But, like an etch-a-sketch toy, he notes that degaussed drives contain residual patterns that may be vulnerable to certain kinds of retrieval technologies. Hence, while degaussing may be fine for many applications, if you're the government or military, you'll probably want to hedge your bets with a physical destroyer.

Degaussers aren't always a cinch to use. They often require a person to dislodge drives from a server or array enclosure, and in some instances, a vendor may require the actual disk platter to be removed from the drive itself. On top of that, most degaussers use external power supplies and must power down between each degaussing, slowing up the destruction process.

One researcher is working on an alternative. Michael Knotts, senior research analyst at Georgia Tech Research Institute, has spent months working with technology design firm L-3 Communication on a device capable of swallowing whole hard drives and degaussing them -- without an external power source. (See A Garbage Can for Hard Drives.)

"Our device is for a niche -- military or industry -- where stuff is in server racks and there's no time or desire to use bare disk drives," Knotts says. (Cue a hostile desert environment, where military personnel are rushing to destroy their field server before it can be captured by the enemy.)

L-3 plans to create a product based on the lab work with Knotts's team sometime this year. "We are in the process of doing final production engineering," says Jim Turner, senior staff engineer at L-3's Comcept division. By the end of this week, he expects to have a production plan in place.

Despite this and other progress in magnetic tape and disk destruction, a hole remains when it comes to destroying optical archiving devices and solid-state gear like thumb drives. If the optical gear is DVD-based, some experts say it can be destroyed by a heavy-duty shredder, one that can also be used for CDs. (CDs, by the way, can be destroyed with devices that grind off the external coating, available from vendors like SEM.)

As for thumb drives, they appear to be on the radar screen -- at least for Garner. "Yes, we're interested in that area," says Ron Garner. But he's not saying when or how. "We're always coming out with new products."

— Mary Jander, Site Editor, Byte and Switch