How do you completely delete data from hard disks and solid-state drives? Do you simply hit Delete and then empty your computer’s recycle bin? Or do you take things a step further and format your drive? Either way, the information you’re trying to get rid of is likely still retrievable. In fact, it’s almost impossible to ever delete anything entirely, and for businesses and other organisations, that can easily spell trouble.
Computers and servers are used by businesses to store everything from staff and customer records to product designs, business strategies and more. All of this data can have real value to other parties. Criminals, for example, might find information that helps them circumvent your cyber security. Or they might discover something they can use as blackmail material – like threatening to publicly share important product roadmaps.
Competitors can be a threat too. For the average SME, industrial espionage may not be a likely problem, but it does happen, and data retrieval from storage devices is one of many methods used to steal information. Others include hidden microphones and cameras, and simply digging through bins to find sensitive documents.
In either case, the consequences of data theft can be hugely damaging, not only financially but also in terms of a business’s reputation. Furthermore, it can attract the attention of regulatory bodies like the ICO, if personal data is lost or stolen.
In an increasingly digital world, there are more and more ways to store data. Not only can hard disks and SSDs be found in computers and servers; they’re also in network-attached storage (NAS) drives and even photocopiers and printers. On top of that, files may be stored on USB flash drives, SD cards, CDs and DVDs, phones and tablets, and online via cloud storage services like OneDrive and Dropbox.
It’s beyond the scope of this article to look at all of these, particularly cloud storage, so our focus is on hard drives and SSDS, which are where most typical businesses will store the majority of their data.
All businesses have to upgrade their IT solutions from time to time, or replace faulty systems with new ones. That means getting rid of old storage drives, which may be full of valuable data. It’s, therefore, important that what's stored on them can't be accessed when they're disposed of.
Normally, when you delete a file from a computer, all you’re doing is removing a kind of reference to where that file is stored on the drive. The actual data remains where it is, until that part of the drive is written over to store something else. Exactly how this works differs between hard drives, which store information on spinning, magnetic plates, and SSDs, which rely on a technology without moving parts, but the basics are essentially the same. This means that when you delete something, and even when you format a drive, the data stored on it can still be recovered with ‘undelete’ software. There are many different tools that can do this job, including the free-of-charge Recuva.
A more thorough way to delete files is to not only format drives, but to also completely fill them with random data or zeroes, thereby overwriting any residual data. There are a number of free applications created by hard drive manufacturers that will do this job.
For most of us, this technique will likely be sufficient, stopping anyone from simply using an undelete application to gain access to deleted files. But it’s not perfect; even files on drives that have been filled with zeroes multiple times over can still be recovered, using specialist, forensic techniques and technologies. These are expensive, though, and are usually used by law enforcement and security agencies. It’s possible that forensic recovery could also be used for industrial espionage or crime too, though, and that’s why some experts recommend the only sure way to make data inaccessible: by physically destroying the drives themselves.
If you’re a DIY fan with only a few hard disks to get rid of, that might mean simply taking a hammer or drill to them. But if you have large numbers of disks to dispose of or you just want to make sure the job is done properly, a drive-destruction service may be worth paying for. For example, ShredIt and ShredStation (chosen at random from Google) can crush or shred old hard drives, rendering them 100% useless.
Which method you opt for ultimately depends on your budget, your security needs and the value of the information that could potentially be recovered from old storage drives. Whatever you do, though, don’t just hit 'format' and assume everything is gone.
Is cyber security important to your business? TMB has decades of experience in supplying security solutions to SMEs. Give us a call on 0333 900 9050 to find out more.