41–50 of 61 posts
Earlier quoted context omitted.
Depending on your threat model, a drill isn't even the right tool. This will significantly complicate data recovery and render data where the drill impacts it destroyed, but it will in theory still be possible to decap/analyse platters or nand with a SEM microscope and reconstruct data off the surviving parts of the storage medium. The cost may not be worth it even to some state actors, but such a cost is peanuts to…
Would thermite be enough?
Earlier quoted context omitted.
SSD stores your data on flash chips. They are coated and only the connectors are exposed. You are not destroying anything you just make it hard to access
So I don't believe the NSA are out to get me, if I did I'd want something a bit more thorough. My main "threat model" is someone picks up the drive from the trash and tries to read it. However you're wrong about this. As we know from when capacitors and batteries leak, the acid or alkali in those can get inside chip packaging by being wicked through the leads, which will destroy them thoroughly from the inside as wel…
The mild phosphoric acid in your cola beverage is nowhere near strong enough to cause corrosion inside of chip packaging, lol. I doubt that it is even enough to remove a significant quantity of the anodic plating on the chip leads to permit the base metal to be attacked.
I’ve never tried one of these but I have one of their paper shredders and they are far better built than the usual semi-disposable made-in-China junk.
I hate to imagine how much ewaste is produced from destroying these drives, rather than simply wiping them and reselling them as refurbs.
Earlier quoted context omitted.
Those aren't hard drives, they're solid state drives in the SATA form factor which was originally designed for hard drives. SSDs are much more compact than HDDs, so the components are usually all bunched up at one side near the connectors and the rest is just air, thus punching a hole in them at random probably won't achieve anything. Punching a hole through the PCB might not destroy the data either depending on wher…
Thank you for a clear and courteous answer to my silly question. (I am so used to not thinking about spinning hard disks that I didn't even notice that I'd used the term to refer to SSDs.)
Better to encrypt your drives. Like ZFS encryption. No need to destroy the hardware in this case and you're also save from someone stealing the server.
This isn't necessarily sufficient unless you encrypt the drives before any data is written to them. If any potentially sensitive data has been written to the drive prior to encryption, the only 100% method is physical destruction. Of course, this clarification only matters if your threat model involves dealing with top-secret data and/or nation-state enemies.
As someone whose job in the past was mass destruction of HDDs and SSDs (thousands on weekly basis) for a major cloud provider this is pretty much useless. If you wanna do it efficiently on scale then something like this is much better option: https://m.youtube.com/watch?v=iqU9QSwHcNg And for SSDs you'd want something like this: https://phiston.com/product/mediadice-ssd-disintegrator-2c/
* https://www.nsa.gov/Resources/Media-Destruction-Guidance/NSA...
Earlier quoted context omitted.
This isn't necessarily sufficient unless you encrypt the drives before any data is written to them. If any potentially sensitive data has been written to the drive prior to encryption, the only 100% method is physical destruction. Of course, this clarification only matters if your threat model involves dealing with top-secret data and/or nation-state enemies.
Format, then sdelete x 10 passes writing random data, then secure erase for good measure, will take care of it for 99% of use cases out there.
But if your threat model is that relaxed, you can just encrypt the whole drive, toss the key, and then format the device. This would likely be quicker than doing 10x write passes.
As a note, write passes are really only good for HDDs due to wear-leveling algorithms in every SSD.
Earlier quoted context omitted.
I'm not saying there are many (any?) modern standards that would allow physical destruction without cryptographic erasure. As far as I know, physical destruction requirements are usually accompanied by cryptographic erasure requirements. I'm also not saying that all compliance standards related to data security require physical destruction; just that these absolutely exist, mostly in defense and similar areas.
Most standards (e.g. ISO 27001, NIST 800-88) do allow for physical destruction without cryptographic erasure if the device is being shredded or incinerated (to the applicable shredding/incineration standard of particulate size/temperature). Especially because cryptographic erasure is effectively pointless (at high data-sensitivity levels) if the device wasn't encrypted immediately and prior to data being written. Not…
I didn't explicitly say this in my original comment since it seemed implicit given the context.