Erasing Hard Disk Drives

As many businesses are into their third or fourth generation of computer systems, the question is how to deal with the unused systems. Sometimes they can be recycled internally as a print server or firewall or sometimes the machine is sold, given away or thrown away.

However, it is increasingly critical that computers being recycled, disposed of, sold, given away or passed on to the grandchildren are properly erased. Merely deleting the files or reformatting is not good enough. Hackers and other criminals routinely scavenge old hard drives to look for information, which can include confidential correspondence and passwords. Deleted data is easily recoverable because it is not overwritten; the space merely becomes available for other data. Deleting partitions and formatting does not delete data. Data is only destroyed if it is overwritten.

How to erase a drive depends on the circumstances. If you wish to make a reasonable attempt to eradicate most data you can use the following procedures yourself. However, we recommend our professional Disk Drive Erasing Service for proper data cleansing.

If you need to leave the operating system intact

• Backup all data you require and then remove it;

• Uninstall programs licenced to you - do not leave programs on the system unless you are also handing over the disks and packaging for those programs (note that some software licences forbid transferring to another party so check the terms of the licence);

• Delete entire contents of TEMP directory;

• Clear internet cache, cookies and internet history;

• Clear recent documents list;

• Delete printers;

• If a member of a domain, reset back to workgroup mode;

• Defragment the drive.

If using Windows NT/2000/XP or above:

• Set the paging file to be cleared on shutdown (see http://support.microsoft.com/kb/182086);

• Delete all user profiles except Administrator;

• Reset Administrator password back to blank;

• If using Windows 2000/XP or above, erase all drives using the inbuilt Cipher program (see http://support.microsoft.com/kb/315672):

  CIPHER /W:C:\

If using Windows 95/98/Me:

• Restart in MS-DOS mode;

• Delete C:\WINDOWS\*.SWP;

• Delete C:\WINDOWS\*.PWL.

If using Windows 95/98/Me or Windows NT 4.0:

• Erase the free space using Cadzow's STRESS tool (available upon request). One of the Stress tool's functions is to write large files filled with zeroes which erases the free space. However, it can only write files up to 2Gb so you must repeat the process until the drive is full, and then delete the temporary files created. The command is:

  STRESS C /W /0 /2 /K

  This instructs Stress to write a 2Gb file (/2) filled with zeroes (/0) to C: in wipe mode (/W) and keep the file when finished (/K). Repeat until the drive is full. Then delete the files created, which are placed in the root directory and named randomly (eg. C:\~GNEM8FH.TMP).

If you are setting the machine to the factory default

If you have the original operating system CDs and you wish to reset the machine back to the default configuration, the drive still needs to be erased although you need not try deleting data beforehand.

• Download Darik's Boot and Nuke (DBAN) and create a bootable floppy disk or CD.

• Reboot from the DBAN media. To run an unattended erase, type autonuke when prompted.

  To perform a custom erase, follow the on-screen instructions.

• Use the vendor-supplied media to reinstate the system.

If you are junking the drives

• Download Darik's Boot and Nuke (DBAN) and create a bootable floppy disk or CD.

• Reboot from the DBAN media. To run an unattended erase, type autonuke when prompted.

  To perform a custom erase, follow the on-screen instructions.

References

• http://www.usenix.org/publications/library/proceedings/sec96/full_papers/gutmann