Ram & Reason: Erasing a Dead Hard Drive
By Rob Rice August 2006
You will have a hard drive fail. If you have been around computers
for any length of time, you probably know this already. Nothing in this
world lasts forever and hard drives are no exception. But let’s say you have
a hard drive keel over unexpectedly with all of your data still on it. Lots
of folks dutifully take the computer back to Best Buy, CompUSA, or wherever
for repairs, trusting that they will keep your personal information secure.
Yes, the hard drive is dead, but the data isn’t! Hank Gerbus found this out
in a most alarming way.
According to an article at MSNBC,
One year ago, Hank Gerbus had his hard drive replaced at a Best Buy store in
Cincinnati. Six months ago, he received one of the most disturbing phone
calls of his life.
"Mr. Gerbus," Gerbus recalls a stranger named Ed telling him. "I just bought
your hard drive in Chicago."
In June 2005, when Gerbus took his computer to Best Buy for repairs after a
hard drive crash, he knew the drive was a potential hot potato. So when a
clerk there told him it had to be replaced, he asked for the damaged
hardware back.
No dice. The replacement was done for free, under warranty, and Gerbus was
told the old drive had to be sent to a repair center in Chicago to fulfill
warranty terms.
"I asked in the store on two or three occasions. ... I was very concerned,"
he said. "But they said 'we can't give you the old one because it's under
warranty.'"
Gerbus said he was assured that, after verifying the warranty, workers in
Chicago would drill holes through the drive and make it unusable. . .
('I JUST BOUGHT YOUR HARD DRIVE'
Posted: Monday, June 5 at 03:00 am CT by Bob Sullivan;
http://redtape.msnbc.com/2006/06/one_year_ago_ha.html
The Best Buy service center did not destroy the drive but instead sold it. A
fellow named Ed bought it at a flea market for $25. Social Security numbers,
account numbers, and retirement/ investment information was on the drive. Ed
tracked down Mr. Gerbus at his winter home in Florida (from information
obtained on the hard drive) and fortunately returned the drive. Best Buy is
said to be investigating and has offered Mr. Gerbus a $250 Best Buy Gift
Certificate for his troubles.
I have seen for myself the information left on hard drives. I have gone to
computer shows and bought used hard drives, never paying more than $7 a
piece. I recovered data on 5 out of seven drives during one such show;
however, none of the drives that I bought had sensitive or personally
identifiable information on them. All of the drives were erased and were
used for data storage.
In 2002-2003 Simson Garfinkel, an MIT researcher picked up a number of used
hard drives from various sources. He examined 129 drives; only 12 had been
completely cleared of data. One drive had 3,722 credit card numbers on it!
http://www.computer.org/portal/cms_docs_security/security/v1n1/garfinkel.pdf
So how do you deal with a dead hard drive? We will assume that the drive has
very sensitive data that you do not want others to have access to.
If taking it back to the retailer or in to a shop for repair, call them
first. Explain the situation. Hopefully, they will have a more realistic
policy than Best Buy. Some manufacturers will allow you to keep the drive in
your possession, but require you to sign a form stating that you have
physically destroyed the drive. They will then replace or send you another
hard disk. But don’t look for this policy on their website, for obvious
reasons they do not advertise it.
You could also ask the repair shop or retailer to destroy it on the spot and
in your presence. Drilling holes through it would work, so will smashing it
with a heavy hammer.
The best way to destroy the drive is to melt the discs that contain the data
located inside the drive, but this is not always possible, again for obvious
reasons. I prefer to take the drive apart and physically remove the platters
and file the surface or run a powerful magnet over both sides of each
platter or disc. Hard drives typically have strong magnets located inside of
them. These may be able to do the job.
Of course the problem with taking the drive apart is that you void the
warranty. But it may be worth it if it means protecting your data.
If the company insists having the drive intact and the warranty seal
unbroken then you can avoid Mr. Gerbus’ situation with a powerful magnet,
like the ones found in some hard drives. Rubbing it over both sides of the
drive, top and bottom, at least ten times should hopefully do it. But
beware, MOST magnets people have available to them are not strong enough to
penetrate the shielding of the hard drive case. Simple iron magnets,
including the big ones, just cannot do it. Electro magnets used for erasing
floppy disks and video tapes are also too weak. As a loose rule of thumb: if
you can, without much difficulty, move the magnet over the drive in a
circular motion, it is too weak. The proper magnet should be VERY difficult
to move in a circular motion over the drive because it is forcibly sticking
to it.
The only magnet I have seen that worked (after trying many!) is a Neodymium
magnet. These are the strongest magnets made. They come in various grades
such as N28, N35, N38 and N40. An N40 of sufficient size, say 1" W x 3/4"
thick x 2" long, would probably work. A 1-1/2" Diameter x 3/4" ring might
also, which may be easier to handle. These will cost around $25 from an
industrial supply, hobby store, or specialty store. Using one of these
magnets should render the hard drive data very difficult if not practically
impossible to recover. You can then pop the drive back in the computer and
ship it off for warranty repair with reasonable confidence.
I have verified that they work. After taking a Neodymium magnet that was
roughly 2" x 2" x 1/4" to a working hard drive I was unable to recover any
data afterwards. Unfortunately, it also wrecked the drive, rendering it
useless.
My company is actually using neodymium iron-boron magnets in its development
work on a magnet powerful enough to erase U.S. intelligence-gathering
aircraft’s hard drives in emergency situations - like that which took place
near China several years ago,
http://gtresearchnews.gatech.edu/newsrelease/erase.htm.
A note of caution: these magnets are not for kids to play with. They are
very strong, even the small ones, and should be kept away from all
electronic devices including pacemakers, security badges, monitors etc. Size
matters! Two magnets in the same proximity can slam together and splinter or
shatter. Larger examples, such as 2” x 1” disk, can crush fingers if in the
presence of another. And do not stick the magnet anywhere near your
computer! Remove the hard drive first.
Of course, this method has its disadvantages. You have to remove the hard
drive, you have to find or buy a magnet that is sufficiently powerful, there
is no easy way to verify that the data is erased and because of the magnets
strength, it can be an irritation to work with. Still, you can sweat it out
like Mr. Gerbus did, only to find out that your sensitive information was
sold at a flea market, or you can have some measure of confidence that your
data is safe. It’s up to you.
Rob Rice is a member computer specialist in Anchorage, Alaska and a
graduate of the Candler School of Theology, at Emory University, Atlanta GA.
Rob can be contacted at articles@isp.com.