Secure data erasure

Secure erasure is the set of techniques and processes designed to remove stored information permanently and verifiably, so that it cannot be recovered by anybody who should not have it.

It matters whenever confidential or personal data has to be disposed of, on physical storage such as hard drives and flash media, and in virtual environments too.

The objective is simple to state and easy to get wrong: make recovery impossible, protect privacy, and be able to show that you did.

What it involves

Overwriting. The basic method is writing over the existing data on the storage medium, using random data or defined patterns, so that the original content is no longer there to be read.

Regulatory compliance. Secure erasure is a requirement, not an optional tidy up, in sectors that handle sensitive information: finance, healthcare, government. Meeting obligations under the GDPR or HIPAA means having a disposal practice that works and that is documented.

Virtual and cloud storage. The same requirement applies to data held on remote servers and in virtual environments, where the storage is not yours to physically destroy and the erasure has to be provided as a service or achieved another way.

Mobile devices. When phones and tablets are disposed of or change hands, making the stored information unrecoverable is what stops personal data walking out with the hardware.

The part that catches people out

Overwriting was designed for magnetic disks, where a sector rewritten is a sector gone. Solid state storage does not work that way: the controller distributes writes across the medium, so an overwrite has no guarantee of landing on the physical cells that held the original data.

On modern media the reliable answers are the drive’s own secure erase command, which tells the controller to do it properly, or cryptographic erasure: encrypt everything from the start and destroy the key, at which point the ciphertext is not worth recovering.

That is why encryption at rest belongs in a discussion about disposal. It is the cheapest way to make erasure certain, and it has to be in place before the data is written, not after.

Where to read more

NIST, “Guidelines for Media Sanitization”: detailed guidance on media sanitisation, including which method is appropriate for which medium and which level of assurance.

UK National Cyber Security Centre, “Secure erase”, part of its device security guidance.

A worked example

A company decides to dispose of an old storage unit holding confidential customer information.

Before the unit leaves the building, the information security team runs a secure erasure process.

Using dedicated software, the storage is subjected to multiple overwriting passes with random data.

The process is then verified, because an erasure nobody checked is an assumption rather than a control.

After that the unit can be disposed of or reused without the risk that somebody recovers what was on it.