Modern Challenges

As a data destruction company, Reclamere handles thousands of terabytes of data. The sensitivity of the data we are tasked to destroy serves as a constant reminder of the vigilance we must have, as data security experts, to ensure no data entrusted to us is ever missed and leaves the security of our building before, during or after end-of-life processing.

Reclamere takes great care in ensuring that our destruction processes are thorough. We verify it by a rigorous quality control process based on the ISO standards for manufacturing quality control and the National Association for Information Destruction (NAID) certification audit criteria. In fact, for the past eight years, all drives overwritten at Reclamere have undergone 100 percent forensic quality control at the bit-level to guarantee that no humanly readable, meaningful data are ever left on a hard drive. This is done through a trade-secret protected process that always accounts for the realities of human error, equipment failure and/or program malfunction. It is a grand amalgamation of people, process and technology that underpin the entire Reclamere way of data destruction.

Before you decide to flip the page thinking this article is simply an advertisement for Reclamere, we beg your indulgence for a few more paragraphs. It is critical that we share with you the “Reclamere Way,” because it provides the foundation for credibility regarding the huge discovery we have made and why readers should take this topic very seriously.

Process Review

The recent evolution of data storage devices and the vast migration to flash storage technologies are challenging the conventional wisdom behind how media are sanitized or cleared for final disposition or repurposing. This evolution has led to in-depth process change management evaluations and intense efforts in research and development of our current and future system needs at Reclamere.

One technology that has been around since 2001 is the ATA (advanced technology attachment) secure erase (SE). This is a set of firmware commands executed directly on the hard drive’s controller chip to erase all of the user-accessible blocks on the hard drive and replace them with zeros. For hard drives built after 2001 and those larger than 15 gigabytes, the SE feature is an option for fast, nonforensically recoverable data destruction. In fact, SE is purported to be so secure as to require no additional quality control measures after execution. As per the NIST (National Institute of Standards and Technology) Guidelines for Media Sanitization, NIST Special Publication 800-88, Section 4.7, verify methods: “Verifying the selected information sanitization and disposal process is an essential step in maintaining confidentiality. A representative sampling of media should be tested for proper sanitization to assure the organization that proper protection is maintained. Verification of the process should be conducted by personnel without a stake in any part of the process.”

Further along in the NIST document’s glossary, SE is defined as: “An overwrite technology using firmware-based process to overwrite a hard drive. Is a drive command defined in the ANSI (American National Standards Institute) ATA and SCSI (small computer system interface) disk drive interface specifications, which runs inside drive hardware. It completes in about one-eighth the time of 5220 block erasure. It was added to the ATA specification in part at CMRR (Center for Magnetic Recording Research) request. ATA drives manufactured after 2001 (more than 15 gigabytes) have the Secure Erase command and successfully pass secure erase validation testing at CMRR.”

SE has introduced tremendous efficiency into the process of destroying data in a way that renders the drives still usable, whereas, previously, data destruction was a matter of overwriting the hard drive with a specific data pattern bit-by-bit over the entire disk’s surface. This process is very time consuming, taking many hours. On today’s larger drives, it can even take days. Since the commands for SE are executed directly on the hard drive’s controller, the process is much faster and believed to be more thorough than simply overwriting the drive with a software-based application.

Our research, however, has shown that this is not true and that SE does not always successfully execute on all hard drives that fit the ATA standard criteria. Because Reclamere is a high-volume ITAM (IT asset management) processor, thousands of hard drives have passed through the SE digital data destruction process, and a troubling trend of failed drives was observed at the inception of the process change from traditional DOD (Department of Defense) 5220.M overwriting to SE.

Of course, good science requires looking first to the processes at Reclamere and how the SE command was executed, the systems upon which it was executed and careful observation for human error. After exhaustive, in-depth analysis of those issues by the forensics experts in the Reclamere data recovery lab, it was clearly established that the SE process and subsequent forensic quality control process were 100 percent functional as designed, built and operated.

Discovered Weaknesses
We have found numerous hard drives where SE did not successfully remove all of the data and actually left all of the data intact, visible by simply plugging in the drive and requiring no heroic or expert forensic techniques. Unfortunately, we have not been able to find an identifiable pattern among the failed drives that we could use to determine if the drive’s SE feature would successfully execute or not. We continue to track every failed hard drive by serial number, manufacturer, manufacture date and drive size and will continue to look for patterns.

Another weakness we found in SE is that it is does not output any status codes or statistics; when the command is executed, the only return from the application is that it completed. This leaves the destruction processors and IT technicians to assume that the drive is purged and ready for reuse with no data intact. However, “complete” and “successful” are two very different words with very different meanings. SE does not indicate if it was successful or not. This is a major weakness because of the trust put behind SE. Reclamere is currently beta testing a way to analyze the limited data that is output by SE so that errors in the output can be used to indicate failure before the forensic quality control step. Failed drives found from our forensic quality control are overwritten by the traditional overwrite and quality control program and continue on through our process.

A lot of destruction companies that are using SE are not using a quality control process to verify that data have, in fact, been destroyed. This is a serious problem in many ways. For the clients who use destruction service providers with no quality control capability, the liability is obvious. For the destruction service providers themselves, this is a serious liability. When we begin to look to the world of highly regulated industries such as health care, where the HIPAA (Health Insurance Portability and Accountability Act) and HITECH (Health Information Technology for Economic and Clinical Health) data breach prevention and notification burden is now on the business associate (BA) doing the destruction, as well as on the data owner, the liability becomes magnified exponentially. For the small business, it becomes potentially catastrophic.

Our findings are not in any way an indictment on the experts at NIST or the CMRR. Reclamere processes thousands of hard drives per week. Multiplied over months, this is in sharp contrast to the volumes of hard drives tested in laboratory environments. In addition, those thousands of hard drives processed by Reclamere span decades and were produced by a myriad of manufacturers. We hope this finding will lead to additional research and/or modifications to the NIST guidelines requiring more rigorous quality control testing for processes using the SE tool.

Researching for Answers
Some research from the Reclamere labs is available to share with you. There are approximately 24 different hard drive manufacturers, and each uses its own unique algorithms to encode data on flash chips sourced from hundreds of chip manufacturers. Flash chips similar to those on a solid state drive also are used in smartphones, tablets, USB portable drives and office equipment. The manufacturers of those devices number in the hundreds. To test whether data still reside on a chip after SE, the only testing that can be done is destructive in nature. The chips must be very carefully removed from the circuit board. This part is hard because heat can damage the chip, as can mishandling the pins. Solid state drives are expensive, and most of the devices that use flash chips are as well. Destructive testing of these devices is expensive simply in the purchase of the gear to be destroyed, let alone all of the equipment necessary to actually remove the chip and subsequently attempt to read the chip.

In light of the expensive nature of the testing, Reclamere conducted testing on four solid state hard drives in our forensic lab. The team doing the work has successfully extracted data from chips for criminal matters and civil litigation. In our admittedly small study, Reclamere found only one of four drives was compatible with state-of-the-art, commercially available chip-reading forensic equipment.

Our process consisted of the engineer filling the drive with known data. In this case, the drive was filled with the word “evidence” and then processed for destruction by executing the SE command. Upon completion of SE, the drive was dismantled. The chip was removed and placed in the chip reader. Forensic tools were then used to search for the data fingerprint. Of the one compatible drive, the search did not return any results. Also, the engineer was unable to find any data remnants or evidence of a file system left on the drive after SE was executed.

Reclamere continues to attempt subsequent research, however, finding drives that have chips compatible with our equipment continues to be a challenge. Recently, we attempted to analyze six drives from five manufacturers. None of the drives were compatible with the chip reader, making testing impossible. Although it hinders data recovery experts and the digital forensics industry, it is only a matter of time until the algorithms of the chips are decoded and it is possible to extract data from more solid state drives’ flash chips to facilitate quality control methodologies.

If you’ve hung on through all of this article’s technical jargon, you may be wondering exactly what all of this means. Here are the two important points that Reclamere has to offer the reader:

1. We believe that SE does not work on 100 percent of all magnetic ATA hard drives larger than 15 gigabytes manufactured after 2001 as has been put forth. It can be an incredibly time-saving, forensically sound data destruction technique; but, without 100 percent forensic quality control capability for verification, the SE method creates risk and liability for those relying on it.

2. SE appears to be an excellent process for the destruction of data on solid state media; however, the seemingly endless variety of chips used in manufacturing them makes development of reliable, cost-effective quality control unreasonable at this time.

In the rapidly growing world of technology, it is important that we are able to trust the claims of manufacturers. However, it is critical that we challenge that trust and conduct our own checks and balances. SE is supported by NIST Special Publication 800-88 and is supported as a sufficient data destruction method for various industries governed by regulations such as HIPAA, Personal Information Protection and Electronic Documents Act (PIPEDA), Gramm-Leach-Bliley Act (GLBA) and Sarbanes-Oxley Act (SOX).

While SE is an excellent tool and can destroy data in hard drive locations that are both user-accessible and not user-accessible, quality control is critical to ensuring that sensitive information does not land in the wrong hands.

Angie Singer Keating is CEO and co-founder of Reclamere Inc., headquartered in Tyrone, Pa., while Kirk Durbin is the company’s data recovery and information assurance engineer. More information on Reclamere is available at www.reclamere.com. This article originally ran in the March 2013 issue of Recycling Today, a sister publication of SDB.