Over at Storage Bits, my new ZDnet blog, I wrote about Secure Erase, a feature that Walter Purvis at Data Mobility Group told me about.
Secure Erase (SE) excited so much attention over there that I thought I’d take a more leisurely stroll through it here.
Free, secure, ATA drive erasure
SE is built into virtually all P/SATA drives built since 2001, when it became part of the ATA standard. It is virtually unknown however, because many BIOSes block the command and some even lock the drive to keep the data safe from Murphy’s-law-abiding citizens. Not to mention evil virus writers.
More secure than external wipers
Since it is internal to the drive, it doesn’t exact much overhead compared to external wipers like the open source Boot and Nuke or similar commercial products. Even better, it is more secure, protecting the data from keyboard (file recovery utilities) attacks and laboratory attacks.
In fact, NIST rates SE’s effectiveness on a par with degaussing a hard drive. Degaussing (strong magnetic field) is losing favor because of a combination of increasing media coercivity and improved magnetic shielding. Once HAMR (Heat Assisted Magnetic Recording) arrives, it may be practically impossible to degauss a drive short of a nuclear weapon’s electro-magnetic pulse. Then we’ll likely be down to Secure Erase and physical destruction as NIST-approved methods of sanitizing disks.
A blunt instrument
SE doesn’t give you many choices: it erases all the user space on the drive, one track at a time. It can erase HPA (Host Protected Area) or DCO (Device Configuration Overlay) areas, if any, as well. Some drives implement an enhanced Secure Erase which instead of writing zeros writes a pattern set by the vendor and that overwrites all bad blocks as well.
When the process is done your drive is empty and ready for OS formatting.
But wait! There’s more!
Check out UCSD’s Center for Magnetic Recording Research to learn more about a leading center of research with the goal of 1 terabit/sq. inch recording. Dr. Gordon Hughes, an IEEE fellow, on the faculty has created a utility that enables SE on Windows machines, available from his CMRR home page. This utility is for experienced storage heads and is not noob-friendly.
Dr. Hughes has also co-authored a paper (pdf) called Data Sanitization Tutorial that gives a brief, 12 page overview of the requirements and options for secure data elimination.
If you are in government, or deal with those who are, you should also check NIST’s special Computer Security publication page. Of special interest is publication 800-88 “Guidelines for Media Sanitization” which covers disks and other media as well.
The StorageMojo take
Secure Erase is an interesting and little known addition to the storage pro’s toolkit. If anyone whips up a tool for using it under Mac OS X or Linux, please let me know.
Comments welcome, as always.