If you don't have a facilities department that is prepared - e.g. with protective gears and an angle grinder or similar power tools, odds are someone will decide it's easier to bypass that process you describe than to get the equipment and do the job properly. It takes firm management by someone who knows and understand the risks and cares about preventing them to ensure it's hard enough to bypass these processes, and hiring someone that takes this seriously just isn't high up on peoples list (e.g. I've never been asked about what approach I'd take to physical security of server infrastructure by anyone wanting to hire me to roles where I'd be responsible for server infrastructure).
At that point, when the platters have been exposed, you're basically done, feel free to scratch them up or smash them with a hammer.
Frankly, having read about this, a once-over pass with dd if=/dev/zero of=/dev/sdX is going to be enough to destroy all data anyway. There is no instance I know of that the theoretical data-recovery techniques proposed to recover after that have been successful in practice, they depended on electron microscopes and 90s platter densities.
Also with defective drives or S.M.A.R.T. failures it’s easier to meet the requirements by physically destroying the medium.
I've run drives with the platters exposed. I've push-started a drive (with a damaged motor) with my fingers and copied data out. You need to destroy the platters properly if you're going to prevent people from getting data out. Even partially damaging platters is insufficient.
> Frankly, having read about this, a once-over pass with dd if=/dev/zero of=/dev/sdX is going to be enough to destroy all data anyway
The problem with that is that you're trusting that people have actually done that, and that nothing went wrong and that the drive firmware was not compromised. If we could trust that people would properly delete the data, then this wouldn't a problem, but the whole point is that we can't. If you're always doing it yourself, and is a low risk enough target to be able to reasonably rule out a compromised system or firmware, then that's a sufficient solution.
That said, a lot of the time, drives are being discarded when they stop working, and people assume they're unrecoverable, and are unable to confirm or overwrite data. Drives like that are a great source of data for anyone prepared to try some repairs.
That surprises me. Recently? And you've done that by transplanting the platters into a new drive? (Assume we wrecked the heads completely when we removed the platters)
> Even partially damaging platters is insufficient.
Really? You've recovered data from part-broken platters that have been removed and scratched or partially shattered?
> The problem with that is that you're trusting that people have actually done that
Sure, but unless the CEO is going to inspect every drive destruction, you're trusting people have actually done the rest too. There's trust here somewhere.
> and that nothing went wrong
You can usually see from the command output if it has.
> and that the drive firmware was not compromised.
If the firmware was compromised all bets are off anyway, the data's already been exfiltrated using spin speed modulation to transmit your data out as audio, as far as you know...
Few years since the last time. I've done that by opening a damaged drive that didn't want to spin up, and "helping" the motor get it started. The first time I tried this was a long, long time ago, and I ran that drive for ~6 months open and exposed, but that time was certainly with far lower densities. I've not tried this with wrecked heads, but given I tried this just by connecting a drive, I'm unwilling to risk assuming damaging the heads is sufficient as well - maybe it is; it certainly would make it harder. I'll happily believe that I've just gotten lucky in getting data out this way, but the point is it's clearly possible whether or not it may be rare for it to work that well, and it's an unnecessary risk.
> Really? You've recovered data from part-broken platters that have been removed and scratched or partially shattered?
Scratches, yes.
Partly shattered I haven't tried; I haven't had a reason to. If you make sure every platter is shattered, then it might well be sufficient. I've yet to see someone enforce shattering plates - most attempts at drive destruction I see tends to be people who haven't even bothered opening the drive, but have just tried destroying it from the outside and ended up damaging PCBs etc. but nothing more (reality is that most IT department in smaller shops don't even have hex tools small enough to open a modern drive); I have never had reason to try to recover data from drives people have made serious attempts at physically destroying the platters properly on.
> Sure, but unless the CEO is going to inspect every drive destruction, you're trusting people have actually done the rest too. There's trust here somewhere.
That's true, but it is easier to enforce visual inspection of a physical object than to try to forensically verify that a drive has been digitally overwritten in a way that is actually meaningful. Of course at some point you have done enough.
More importantly, by insisting on a standard of visual inspection to confirm a drive is destroyed or severely damaged, you ensure the commercial value of the drive itself reduces the incentive to remove drives that may or may not yet have been properly wiped.
> You can usually see from the command output if it has.
Assuming the person doing the destruction cared enough to pay attention.
> If the firmware was compromised all bets are off anyway, the data's already been exfiltrated using spin speed modulation to transmit your data out as audio, as far as you know...
Or it hasn't, and someone replaced it exactly because it's a simple means of bypassing a non-physical destruction process and carry the drives out right in front of security even if someone else needs to sign off on the wipe. It may seem contrived, but replacing firmware is a well enough attack by now that is seems like a pointless risk.
To be clear, I'm not questioning that you can ensure you have wiped the data digitally if you do it yourself and take enough care. But I don't think that is a good basis for a company to set policies around, because it's too hard to enforce once you take into account potential malicious interference and/or profit potential.
Heads are entirely ruined very easily, to the point where I'm not convinced you could insert the platters into a new drive of the same model without wrecking those too.
> Assuming the person doing the destruction cared enough to pay attention.
And we're back to trust. No method works if you have no trust in it being carried out. Including destruction (see the post we're replying to.
Honestly I think, as with most data safety discussions, we're not talking about realistic threat vectors nor about common avenues of attack.
And when we're talking about compromised drive firmware that is smart enough to use one method of exfiltration that neatly suits your argument but not another that doesn't, I think we're not really arguing about anything useful any more.
And yet for that to matter you need to ensure they actually are wrecked. I have no doubt you are able to destroy drives well enough for it to be impossible to get data out. That is not the point.
The point was that a lot of the damage that people think is sufficient to render a drive inoperable isn't. Most drives I've seen that people think they've destroyed does not have destroyed drive heads or shattered plates; most of them have not even been opened.
Maybe you do a proper job at it. But most people don't even know how to do the prerequisite damage.
But when you suggested that just opening the drive is enough, you were wrong.
If I can get data out of a drive that has been opened without any equipment or experience with data recovery, then that's a pretty low bar. Maybe I got lucky, but other people might get lucky too. It's a pointless risk.
Maybe destroying the heads is sufficient - I haven't tried recovering from that, so I don't know, and so I won't claim to know. Unlike when you assumed opening a drive is enough, even though it isn't. But given your assumptions on that are wrong, I don't trust your assumptions about damaging the heads either.
> And we're back to trust
Trust in things that can be verified more easily by less specialized staff matters. Hence why the more thorough physical destruction the better.
> And when we're talking about compromised drive firmware that is smart enough to use one method of exfiltration that neatly suits your argument but not another that doesn't, I think we're not really arguing about anything useful any more.
The one method only requires the drive to return false results that sufficiently convincingly suggests to someone verifying the destruction that the drive is clean. It just requires a pre-prepared firmware update to be downloaded to the drive, pretending to wipe the drive, and walking out with them.
The other is complex and error prone and requires an ongoing communications channel to the outside.
That you even suggest the two are equivalent in complexity is ludicrous.
Truly ensuring their destruction is going to cost, including but not limited to security guards, people to watch those people, searching through or destroying the trash generated in the building, looking through "parts" to see if they're disassembled hard disks etc.
I can easily angle-grind a HDD in two in my garage, where if I fuck it up no-one would be liable. But it would be quite involved to do the same thing in work, where if I fuck up they'd be liable.
Unless of course your rule is "diligently follow all security policies, but ignore and bypass workplace safety policies" which I would say is a confusing message to give your employees.
Of course, there's no excuse not to dd zeros over the entire disk and, (if it's an SSD) trigger a security-erase with hdparm.