The plant I'm working at is shutting down for good, and we are getting all the computer gear ready to go elsewhere. Computers that will be disposed of outside the company need to have their hard drives wiped.
Wiping the drives is absolutely a reasonable precaution. For non-geeks: Merely erasing a drive, or even formatting a drive does not actually delete the data on the drive, it merely marks the place the data was as available for re-use. The right software can recover most of the data. Wiping actually writes new data to the entire drive, so recovery programs can only recover the new data.
A single-pass wipe makes the data unrecoverable for all practical purposes. It is theoretically possible to recover some data from these drives, but only with extreme expense, and (I believe) only on certain types of older drives.
We are required to use a Department of Defense 7 pass method. On a good drive of moderate size for its era, this takes about 2 hours per drive. On an old, worn drive it may take days.
If the data is so sensitive that a single-pass wipe isn't secure enough, then the data should have been protected throughout its life--the computer it was on should not have been connected to the internet, should not have had the ability to make unrestricted copies of data on CD, floppy disk or USB drive, and the computer itself should have been well-protected from theft. Using a 7 pass wipe without other safeguards is essentially like putting a vault door on the front of your house, without reinforcing walls or windows.
Things like this come about in a burocracy when the person mandating standards isn't using their own money or energy--private examples of unfunded mandates.
Good post.
ReplyDeleteJames