What's the best algorithm to secure erase HDD? [closed]

Question

There are a lot of secure erasing algorithms in erasing softwares. What's the best of these algorithms?

Answer 1

Disclaimer: Most of this advice applies to spinning metal (conventional HDDs) with unencrypted data.

How paranoid do you want to be? An unsophisticated attacker is unlikely to be able to overcome even a single pass of zeroes. A three-letter-agency might have the capability to recover some data even after overwrites with patterns or random data. Or not. Who knows, they don't talk about their capabilities that I know of.

Even if you made dozens of passes with a mix of various patterns and random data, you might have some data fragments sitting on reassigned bad sectors. You probably won't be able to wipe those without being able to talk to the drive firmware and help from the manufacturer / custom tools. If sensitive data has ever been on the drive unencrypted, the only way to guarantee it's gone is total drive destruction (mechanical shredding, etc). Outfits that deal with classified data usually have special warranty arrangements with drive manufacturers such that they only have to return the top cover of the drive.

IMHO, the best you can do nowadays for spinning metal is to overwrite with at least one pass of random bits. If full drive encryption has been used, that's probably more than good enough. If sensitive data was on the drive unencrypted and you're worried about a sophisticated attacker, you can consider total destruction.

As folks are pointing out (rob), there is an ATA secure erase command. It's probably fine against an unsophisticated attacker.

SSDs are a totally different type of critter, as Hennes has pointed out. If the software the manufacturer provides has some kind of erase capability, use it (or the ATA command, hopefully they provided a custom implementation suited to their device). Overwriting with patterns is going to eat into the life of the device, and who knows what the heck is actually happening at the physical level, the firmware is going to do what it wants (wear leveling, spare cells, write optimization, etc), so no guarantee you've cleared all the cells.

As for implementations, DBAN (see ioSamurai's post) is probably the easiest cross platform solution, depending on how the target device is attached. On Windows, I've used Eraser (heide.ie), but there are many options. Same for OS X. Linux is a bit more limited, but if nothing else you can get the job done with dd and /dev/urandom on the raw device (or, for increased paranoia, use the RNG of your choice, I've used ISAAC, OS X /dev/random uses Yarrow).

Answer 2

Old drives used to have common faults which is why many legacy security HDD erasing programs include options like 'multiple passes', etc. Drives of today are not prone to this issue and a single pass of zero/random bytes should be sufficient.

Check out boot & nuke: http://www.dban.org/

Answer 3

To my knowledge there is no "best" algorithm. Simply overwrite with random bytes once should be sufficient for hard drives (not necessarily SSD). Even overwriting it several times has not been proven to be any more useful than doing it once. In particular also check out the Criticism article under Gutmann method.

The claim that a disk should be overwritten multiple times stems from the times of tape drives. So this may well be applicable to your backup tapes, still.

You should check out "The Great Zero Challenge" via your favorite search machine. Basically it is true that there is a chance to guess the original contents of a single bit right. But if you are even slightly familiar with probability you know what that means if we're talking about eight bits (i.e. one Byte), let alone Gibibytes of data.

Answer 4

The best possible method is "(enhanced) secure erase" it was developed for that purpose. Since it is part of the ATA feature set it works for HDDs aswell as SSDs. If you are paranoid you can run (enhaced) secure erase multiple times.

The easiest way to use it is to make a Live CD/USB of your favourite Linux distro and then run hdparm. It is quite easy. You can follow this guide: https://ata.wiki.kernel.org/index.php/ATA_Secure_Erase

Note:

Secure erase overwrites all user data areas with binary zeroes. Enhanced secure erase writes predetermined data patterns (set by the manufacturer) to all user data areas, including sectors that are no longer in use due to reallocation.