Degaussing

Magnetic media stores each bit as the orientation of a region of material. A degausser produces a field that overcomes that material’s resistance to changing orientation and leaves the regions pointing at random. The difference from overwriting matters: overwriting leaves a new pattern on top of the old one, while this leaves no pattern to reconstruct.

It has a side effect worth knowing before you buy the machine. On a mechanical hard drive the field also destroys the servo tracks written at the factory, which are what the head uses to know where it is. The drive stops spinning up and cannot be reused. This is a retirement method, not a recycling one, and that decision has to be made beforehand.

The guidance nearly every procedure we see on audit points at is NIST SP 800-88, “Guidelines for Media Sanitization”, which splits sanitisation into three levels, from lightest to most final: clear, purge and destroy. Degaussing is a purge technique for magnetic media. Which level applies is not decided by the machine, it is decided by the data classification of what was on the drive.

The expensive mistake today is not degaussing badly: it is degaussing something this does not apply to. A solid state drive, a memory card, a USB stick or the soldered storage in a modern laptop holds nothing magnetically. Running a degausser over them erases not one byte, and yet it produces a certificate saying it did. Hybrid drives are the worst case, because the mechanical half is wiped while the flash part survives intact, so the procedure looks like it worked.

The second problem is that you cannot see it. A degaussed drive looks exactly like one that was never touched, so the evidence is never the drive: it is the record. Serial number, who did it, when, and against which asset inventory. Without an inventory there is no way to say how many units left the building, or to notice that one did not.

The third changes the whole approach. If the drive was encrypted at rest from day one, disposal stops being the critical moment: destroying the key renders the contents useless immediately, works for any storage technology and can be done without the device in front of you. Degaussing is still valid for mechanical media, but it cannot be the plan; it is the last step of a plan that starts much earlier.

On an ISO 27001 audit media disposal is reviewed in two moves: first the written procedure, then the record of the last few retirements. What usually turns up in the second is a contract with an external processor whose certificate says “destruction” without naming a method or a serial number, kit marked as retired in the inventory whose physical exit is recorded nowhere, and the drawer: laptops and drives nobody uses, nobody has disposed of, and which still hold data with no owner.

When what was on them is personal data, the question you have to be able to answer is not which machine was used. The GDPR does not mandate a specific erasure method: it requires the data to stop being available and the organisation to be able to demonstrate it. A correct procedure applied to the wrong medium demonstrates nothing, and it is the finding that comes up most often.