CompTIA A+ Core Certification: The Basics of Security - Data Destruction and Disposal

Objective 2.8: Given a scenario, use common data destruction and disposal methods.
Even after computers, mobile devices, and even some types of printers have reached the end of their useful lives, the hard drives inside contain potential security risks. Risks also lie in flash drives, external drives, and optical media. To prevent confidential company or client information from being accessed from a computer or another device that is being disposed of for resale, recycling, or deconstruction for parts, follow the methods described in the next sections.

Note: For the 220-1102 exam, you should understand the importance of these methods:
- Physical destruction methods
- Recycling or repurposing best practices
- Outsourcing concepts

Physical Destruction Methods
Physical destruction turns a mass storage device into small pieces that cannot be reconstructed, making the data inside unrecoverable. Methods include the following:
- Shredder: Some office-grade shredders can destroy optical media. Electronics recyclers use heavy-duty shredders made for hard disks and mass storage devices, to reduce storage devices, tape, or other types of media into small bits.
- Drill/Hammer: Remove the hard disks and destroy their platters with a drill, hammer, or other device; then recycle the scrap.
- Electromagnetic (degaussing): Tools such as electromagnetic degaussers and permanent magnet degaussers can permanently purge information from a disk. The drive is physically intact, but all data, formatting, and control track data is missing. Use this type of physical destruction if you want to use a drive for display purposes.
- Incineration: Incineration of tape and other types of magnetic and optical media is allowed in some areas and available from various companies.
Data-recycling companies that destroy hard drives or other storage devices can provide a certificate of destruction to prove compliance with local laws or institutional policies.

Recycling or Repurposing Best Practices
As long as the data on a hard drive or other mass storage device can be rendered unrecoverable, destroying the media itself is not necessary. The following are some best practices for recycling and repurposing:
- Low-level format vs. standard format: The standard format used in operating systems is a quick format. This type of format clears only the root folder. The rest of the data on the disk can be recovered until it is overwritten. A long format rewrites the disk surface. However, data recovery programs available from many third-party firms can recover data from a formatted drive. A low-level format that creates the physical infrastructure where data will be stored on a disk is performed by the drive manufacturer before the drive is shipped and cannot be performed in the field.
- Overwrite: Some disk maintenance programs from mass storage vendors include options to overwrite a hard disk’s or SSD’s data area with zeros. Data recovery programs can often recover data that has been overwritten in this fashion.
- Erasing/drive wiping: To ensure the complete destruction of retrievable data on a storage device, the data must be overwritten with a program that meets or exceeds recognized data-destruction standards, such as the U.S. Department of Defense (DoD) 5220.22-M (which requires seven passes) or Peter Gutman’s 35-pass maximum-security method. These programs, referred to as drive wipes, destroy existing data and partition information to prevent data recovery or drive forensic analysis. Use this method when maintaining the storage device as a working device is important for repurposing (such as for donation or resale). A variety of commercial and freeware programs can be used for this task, which is also known as disk scrubbing or disk wiping.

Outsourcing Concepts
Countless examples of problems and lawsuits have arisen from the improper handling of data and equipment. Equipment that is simply thrown away or recycled often puts valuable company resources in the hands of complete strangers who can do what they want with the data.

Companies should have data destruction policies in place, including paper shredding and hard drives. It is usually economically beneficial to outsource this destruction task to a third-party vendor who has invested in the proper equipment and training of staff. Outsourcing to a qualified company ensures that the methods used are secure and safe and that the data disposal is legal. Most companies do not dispose of enough equipment or data to warrant investing in destruction equipment or specialized staff.
Another advantage of outsourcing to a qualified company is that the company can certify that the destruction is complete and was done correctly and then issue an official certificate of destruction/recycling to confirm the destruction of the material. This shows business partners and government regulators that care was taken to comply with safety practices and local laws.