Your Old Hard Drive Must Die! Secure Data Destruction

As we were discussing in the last article, the goal is to make the data on your old drive useless or unrecoverable by anyone who might get ahold of your computer after your are done with it.  Lets take a look at several methods from easy and weak to irretrievably strong and secure.

  • Quick reformatting using Windows.  You can make Windows reformat the drive on a reboot, which will render the computer unusable on completion.  The quick reformat process on removes the file allocation table, or the index the computer would use to find data on the drive.  It does not destroy the data, which can still be recovered using commercially available software.  This method is the weakest.
  • Full reformatting of the drive.  This method actually overwrites the entire disk one time.  While not as weak as Quick Format, the data can still be recovered by someone skilled with forensic recovery tools.
  • Drive wiping.  This overwrites the drive several times, from one to thirty-five times depending on the method chosen.  Overwriting may use all ones, all zeros, or a random pattern of ones and zeros, or a combination of methods.  This method is considered very secure.  Standards include:
    • NIST or National Institute of Standards and Technology – one pass is considered sufficient.
    • DOD or Department of Defense requires 3 passes – ones, zeros, and random.
    • Bruce Schneier’s Algorithm – 7 passes of ones, zeros, and five random passes.
    • Peter Gutman’s Algorithm – 1 to 35 passes combining all methods.  Developed in 1996 for a type of drive that is now obsolete, so not commonly used.  plus takes a long time to complete.
  • Magnetic degaussing.  Subjecting a hard drive to a strong magnetic field will demagnetize the platters, removing all the data.  This is quicker than drive wiping and is also considered very secure.
  • Physical drive destruction.  Hard drives can be destructively rendered useless in any number of ways.  I have friends who like to take them to the gun range.  Not recommending this (ricochets anyone?)  Physical destruction pretty completely renders any data irretrievable, and is also considered very secure.
    • Drill bit.  Running a couple of 1/4” holes into the drive case with a standard drill bit works.  Make sure you hear the platters break.
    • Hydraulic press.  Some data destruction companies do the same thing with a hydraulic press.
    • Shredder.  Some companies, such as Renovo, use a high powered hammer mill shredder to chop the entire thing into small chunks less than half an inch in size.
    • Acid.  Some companies will dissolve the drive in hydroiodic acid.

Some of these procedures you can undertake on your own, and some are best done by professionals.  My favorite product for drive wiping is Acronis True Image, which is also a great drive imaging and backup tool.  Clients who recycle with our company have their drives wiped, and then shredded.  Whatever you do, be sure your files are gone before you toss or give away your old computer.


About the Author:

I am a cybersecurity and IT instructor, cybersecurity analyst, pen-tester, trainer, and speaker. I am an owner of the WyzCo Group Inc. In addition to consulting on security products and services, I also conduct security audits, compliance audits, vulnerability assessments and penetration tests. I also teach Cybersecurity Awareness Training classes. I work as an information technology and cybersecurity instructor for several training and certification organizations. I have worked in corporate, military, government, and workforce development training environments I am a frequent speaker at professional conferences such as the Minnesota Bloggers Conference, Secure360 Security Conference in 2016, 2017, 2018, 2019, the (ISC)2 World Congress 2016, and the ISSA International Conference 2017, and many local community organizations, including Chambers of Commerce, SCORE, and several school districts. I have been blogging on cybersecurity since 2006 at

Add a Comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.