Which Common Data Sanitization Myths Do You Believe?
13 / Ocak / 20
If data protection is so critical, what keeps enterprises from completely removing data from drives and devices when it’s no longer needed? In this two-part post, we address 10 data sanitization myths. The five below are some of the most common, and they sabotage the data protection efforts of small businesses and large enterprises alike. Any of these can leave data behind, even if you think you’ve got solid data removal or drive destruction processes in place.
Myth 1 – Deleting Gets the Job Done
It’s easy for users to confuse deleting and erasing files. Even experienced technology professionals commonly believe dragging files to the Recycle Bin on their laptop and desktop computers wipes them clean. In a recent Blancco survey, over half (51 percent) of the respondents believe files are permanently gone when they take it one step further and empty the Recycle Bin.
Part of the problem is that the tech industry hasn’t always made it easy for users to figure out how to delete their information. When emptying the Recycle Bin, Windows first asks, “Are you sure you want to permanently delete these files?” Most users don’t know this merely removes pointers to the data, marks the space as reusable and in fact, leaves the data intact.
Myth 2 – Formatting is Foolproof
In that same survey, another 51 percent believe performing a quick format or full reformat of a computer’s entire drive is enough to permanently erase data. Formatting can indeed remove much of the data on a drive. But relying on formatting as a data sanitization method is lacking in several critical ways. For one, some or most of the data can be recoverable with forensics tools available online.
What can be even more misleading is that several OEMs offer alternatives to formatting that are referred to as “erasure.” These methods also have limitations and do not meet the guidelines for true data erasure, which includes selecting a data erasure standard, verifying that erasure has been successful and certifying the erasure.
Myth 3 – If You Shred, Your Data’s Dead
This is a tricky one.
That’s because physical destruction is indeed one way to achieve data sanitization. However, the devil’s in the details—and in this case, the details make the difference between data being recoverable or not.
For instance, the type of drive matters. Because hard disk drives store data magnetically spread across a spinning platter, physically shredding the drive is actually very effective. There are plenty of industrial shredders that are more than adequate for hard disk drives (HDDs).
However, the larger shred fragments of today’s standard industrial shredders can allow complete solid-state drive (SSD) data chips to slip through.
The data density on SSD and hybrid drives containing SSD components requires a very small shred size to guarantee that no data can be recovered. In fact, the U.S. National Security Agency recommends an SSD shred size no bigger than 2mm—the size of the tip on a new crayon. The larger the shred size, the more chances that data can be recovered from entire chips. So, specifying shredding as your data sanitization method of choice—while a step in the right direction—doesn’t always guarantee that data is irrecoverable.
Myth 4 – Degaussing Works for All Data Storage Technologies
Degaussing has its place. It is very effective for damaged or end-of-life electronic devices that store data magnetically. In fact, we offer the Ontrack Eraser® Degausser as part of our hardware offerings in many geographies. However, the biggest vulnerability with degaussing is that it ONLY works with magnetically stored information. Today’s solid-state drives are immune to degaussing since they store data on semi-conductor chips rather than spinning platters. Optical storage devices are also immune.
What’s more, even with hard disk drives and data storage tapes that store data magnetically, degaussing strength must be enough to overcome the magnetic fields of the devices to be sanitized. It’s not always a match, particularly when older degaussers meet newer drives.
To make sure your data is being securely erased, read “4 Steps to Completely Erase a Hard Drive” for a short description that applies to both HDDs and SSDs.
Myth 5 – Crypto Erase Guarantees Data Protection
Cryptographic erasure (often abbreviated as Crypto Erase) is one of the three methods that can achieve data sanitization. It has proven to be extremely effective at making data unrecoverable if the proper steps are in place and verification and certification are achieved. However, like any data sanitization method, there are advantages and disadvantages to using cryptographic erasure.
For instance, Crypto Erase is an ideal solution when storage devices are in transit. The caveat, though, is that users can impact the success of cryptographic erasure through human error and broken keys.
