‘It’s Still There’: Effective Data Wiping for the 21st Century

Back in 2009, a little known story of theft surfaced in the media. This wasn’t ordinary theft however. The “thieves” were actually Vancouver students documenting what happens to e-waste after its shipped from North America and Europe, landing in developing countries in West Africa. The students were able to purchase a hard drive containing sensitive U.S. government information for about $40 from an open air market in Ghana.

It’s no surprise, but it is quite shocking – private information sold on covert black markets or used directly to instigate identity theft and credit card fraud. The practice of criminal hacking has become all too common, but in most cases it takes place through an Internet connection with computers and mobile devices that are still in active use. Data thieves can also target discarded devices, making data wiping and erasure an absolute necessity, even after it’s discarded.

The entire world is data driven. This is not a novel concept, but it is unique because of the way that technology has so quickly developed in the past half century. Technological advancement in both hardware and software, including mobility, has skyrocketed the data driven era, granting it prime position in homes, businesses, basically every public and private space in the world.

While our data driven, technological dependency has created a number of opportunities and changes for the better, it has also created tremendous challenges in terms of privacy and data protection. A compromised hard drive can easily send costs spiraling out of control due to the risk of sensitive information winding up in the wrong hands.

Data wiping, then, plays a prominent role in the way that an electronic device is used and in the way that it should be discarded after it reaches the end of its life cycle. Many may not be aware, but even after a device is taken offline and heading for recycling, the need for data erasure is extremely high.

Data wiping is basically the ability to render a device clean and clear of sensitive information, or any information at all, without rendering the device inoperable. 

Doing so ensures that the device is no longer prone to hacking or other types of data theft. However, when the process is not done effectively or is left incomplete, information may continue to exist on a device even long after its discarded – information that can be retrieved by anyone with the right skills and equipment.

Most data wiping is software-based and simple. The software application simply overwrites all information on a disk using a string of unintelligible letters and numbers or with a simple meaningless combination of 1’s and 0’s. Obviously, this process involves much more than simply deleting files from a computer’s hard drive – a method that leaves information easily recoverable.

Firmware or hardware encryption is more a method of data protection than data erasure. It basically makes information accessible to anyone not in possession of the right encryption key. Information behind the closed doors, so to speak, of an encryption key can even be remotely destroyed when the wrong key is entered. 

“This message will self-destruct” is a familiar motif in spy movies and can help us understand the concept of remote overwriting, too. With remote overwriting, the wrong encryption key acts as a trigger for the overwriting process. This method is just as sophisticated and expensive as it sounds and for some companies and individuals is a highly valuable asset for the protection of extremely sensitive information.

One of the biggest challenges for any data wiping method is data recovery. Data recovery can undo any progress made toward permanent data erasure.  The major goal of any data wiping process after a device is discarded is to prevent data recovery.

This means that simply using an operating system to delete files won’t work. When a user sends a delete command using the operating system of a device, the item may be erased in the list of files on the hard drive, but the actual file can still be recovered with the right tools. That’s because a delete command doesn’t actually overwrite the file data. It simply marks it as unused. 

Data recovery tools are extensive and ubiquitous on the Internet. Much of the software available is completely free and open-source. There’s data recovery hardware, too. Costs for data recovery hardware range from hundreds to thousands of dollars, and there are a variety of methods and company services to choose from.

Just how far can data recovery go? According to the experts, almost any data is recoverable no matter how much precaution is taken to secure the sensitive information it contains. Even though the recovery can be costly and time consuming, anything short of completely shredding the hardware can render a device vulnerable to data recovery methods post discard.

The high vulnerability of sensitive information is one of the key reasons why the most reliable recyclers depend on data shredding and degaussing to ensure data protection during the recycling process. Degaussing renders a device’s drives completely unusable by destroying the magnetic field that holds the devices information together. 

After a discard, physical destruction must involve completely shredding the drives to be most effective. As governments, police departments and corporations that can afford it know, data recovery can be used to recover even drives that have been damaged by fire, water and chemicals. Shredding is, in most cases, the only guaranteed way to completely render data recovery impossible.

Effective data protection for the 21st century must be capable of going beyond basic data wiping in the recycling process. With data recovery tools so extensive and innovative, even the most sophisticated forms of data wiping can leave sensitive information vulnerable. The sure-fire way to protect sensitive data is to rely on an electronics recycler capable of guaranteeing complete shredding of drives and providing a proof of data destruction to boot.