1

Context: I want to store data in digital format, and then destroy it. Let for the moment put physical destruction of the drive (hammer/degausser) aside.

Question: which non-volatile drives will be most suitable for storing the data so that it can then be completely destroyed? Note: crypto-shredding isn't enough, I want to erase the encrypted data as well. These are to be chosen between USB, HDD, SSD, SD.

What I think that this choice should break into:

General philosophy.

EDIT A: I strongly prefer open-hardware (and an open-source firmware, so that I know what it's doing).

First thing to do is choose a type of disk.

  • Benefits of SSD over USB/SD: some useful ATA instructions for data erasure should be implemented by the manufacterer.

  • Drawbacks of SSD: ATA instruction might be wrongly implemented by the firmware.

  • Benefits of HDD over SSD: digital sanitize the drive by physically writing over every block, and this wouldn't rely on a possibly wrong implementation of ATA instructions by the manufacturer.

  • Drawbacks of HDD over SSD: Sanitization by the OS might be ineffective because of inaccessible areas of the drive (see end of page 7 and beginning of page 8 in [0]). Also, in case of an external drive connected to the USB port, ATA instruction might have a hard time being delivered: From [1]:

some "intelligent" interfaces such as USB or firewire to PATA/SATA bridges, SAS controllers or hardware RAID controllers may try to reset devices which they have decided are no longer responding. WARNING: Do not attempt to do this through a USB interface!

  • Benefits of SSD over HDD: The ability to self-encrypt.

Second thing to choose is the manufacturer.

Depending on the choice of the type of disk, in case the firmware is non-opensource hence non-verifiable, the manufacturer should either implement correctly all useful ATA commands (trim, sanitize, secure erase, opal, ATA Password, enhance security erase) and their verification in case we're relying on ATA instructions for sanitization, or the properties of the disk make sanitization by physical rewriting effective in case we rely on this method.

EDIT B: In both cases, particular attention should be given to hidden data areas like the host protected area (HPA) and device configuration overlay (DCO), spare sectors, all drive firmware settings etc, especially in case wear leveling is implemented by the firmware.

Third: Verify that sanitization is completed successfully

The drive should enable to user to verify that the sanitization process (of the data, even in encrypted form) is successfully completed.

References

[0] https://cmrr.ucsd.edu/_files/data-sanitization-tutorial.pdf [1] https://ata.wiki.kernel.org/index.php/ATA_Secure_Erase [2] https://tinyapps.org/docs/ata_sanitize_hdparm.html [3] https://groups.google.com/forum/#!msg/qubes-users/A1-MiQwR7D4/8RPw7nWjAQAJ [4] http://www.hddoracle.com/viewtopic.php?f=59&t=1214#p5839 [5] https://tinyapps.org/docs/wipe_drives_hdparm.html

Improve this question
3
  • How long would you need to store your data? If it's just short term, you could create a RAM disk which irreplaceable looses any data present if power is lost to the device (volatile).
    – Bennett Yeo
    Apr 1, 2019 at 3:20
  • Does this have to be a drive which you can connect to a PC? And what amounts of data?
    – jaskij
    Apr 6, 2019 at 22:45
  • How often will you wipe it? If often, remember that SSD has limit on the number of times that each sector can be written.
    – Mawg says reinstate Monica
    Nov 21, 2020 at 22:38

1 Answer 1

Reset to default
1

I created the question but I cannot modify it nor comment. Thanks for the comment, but the drive has to be non-volatile. Can you please modify the question as follows (and then fix this into a comment)?:

Context: I want to store data in digital format, and then destroy it. Let for the moment put physical destruction of the drive (hammer/degausser) aside.

Question: which non-volatile drives will be most suitable for storing the data so that it can then be completely destroyed? Note: crypto-shredding isn't enough, I want to erase the encrypted data as well. These are to be chosen between USB, HDD, SSD, SD.

What I think that this choice should break into:

General philosophy.

EDIT A: I strongly prefer open-hardware (and an open-source firmware, so that I know what it's doing).

First thing to do is choose a type of disk.

  • Benefits of SSD over USB/SD: some useful ATA instructions for data erasure should be implemented by the manufacterer.

  • Drawbacks of SSD: ATA instruction might be wrongly implemented by the firmware.

  • Benefits of HDD over SSD: digital sanitize the drive by physically writing over every block, and this wouldn't rely on a possibly wrong implementation of ATA instructions by the manufacturer.

  • Drawbacks of HDD over SSD: Sanitization by the OS might be ineffective because of inaccessible areas of the drive (see end of page 7 and beginning of page 8 in [0]). Also, in case of an external drive connected to the USB port, ATA instruction might have a hard time being delivered: From [1]:

some "intelligent" interfaces such as USB or firewire to PATA/SATA bridges, SAS controllers or hardware RAID controllers may try to reset devices which they have decided are no longer responding. WARNING: Do not attempt to do this through a USB interface!

  • Benefits of SSD over HDD: The ability to self-encrypt.

Second thing to choose is the manufacturer.

Depending on the choice of the type of disk, in case the firmware is non-opensource hence non-verifiable, the manufacturer should either implement correctly all useful ATA commands (trim, sanitize, secure erase, opal, ATA Password, enhance security erase) and their verification in case we're relying on ATA instructions for sanitization, or the properties of the disk make sanitization by physical rewriting effective in case we rely on this method.

EDIT B: In both cases, particular attention should be given to hidden data areas like the host protected area (HPA) and device configuration overlay (DCO), spare sectors, all drive firmware settings etc, especially in case wear leveling is implemented by the firmware.

Third: Verify that sanitization is completed successfully

The drive should enable to user to verify that the sanitization process (of the data, even in encrypted form) is successfully completed.

References

[0] https://cmrr.ucsd.edu/_files/data-sanitization-tutorial.pdf [1] https://ata.wiki.kernel.org/index.php/ATA_Secure_Erase [2] https://tinyapps.org/docs/ata_sanitize_hdparm.html [3] https://groups.google.com/forum/#!msg/qubes-users/A1-MiQwR7D4/8RPw7nWjAQAJ [4] http://www.hddoracle.com/viewtopic.php?f=59&t=1214#p5839 [5] https://tinyapps.org/docs/wipe_drives_hdparm.html

Improve this answer
3
  • Another potential down side to a hard drive could be magnetic echos. Meaning yes you overwrote the data, but maybe a laser or other exotic equipment running across the surface might be able to pick up and decode faint traces of previous data. If something like this wasn't happening a single pass would effectively erase a drive, but since DOD and etc does 7+ passes something like this must be possible. Capacitors found in SSD to my knowledge don't have these types of echos.
    – cybernard
    Apr 2, 2019 at 19:21
  • but maybe a laser or other exotic equipment running across the surface might be able to pick up and decode faint traces of previous data this is dumb
    – ron
    Apr 12, 2020 at 14:20
  • Not if you are the CIA ;-) BUT, if the OP is up against three letter agencies, he should be asking Q, and not us.
    – Mawg says reinstate Monica
    Nov 21, 2020 at 22:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.