| |
Safe and Secured Disposal
of Data and Media
Computers
(Desktop PCs, Laptops, Servers, etc), and electronic devices
(Handphones, PDAs, etc) are widely used to manage data and
hold confidential information.
Emphasis
and priority has always been given to the protection of
the data within the serviceable lifecycle of the medium
in which it is stored. Many companies often overlooked the
risks associated with proper and secure disposal of the
data and media. In fact, during the retirement phase of
the personal computers, many companies dispose of computers
and electronic devices without properly removing confidential
data.
Deleting
data from the computer hard drive by highlighting the file
and pressing the delete key or dragging a file into the
Recycle Bin merely remove the pointer to the files, the
data remains on the disk. Even after permanently deleting
the data from the Recycle Bin, the data can still be retrieved.
Contrary
to popular belief, formatting the hard disk drives also
does not actually delete the data from your computer. Confidential
information can still reside on your hard drive, and can
be recovered with the right data recovery utility.
According
to a Gartner survey, organizations use outside companies
to dispose of PCs 29% of the time and to get rid of servers
31% of the time. Other methods included donating the hardware,
putting it in storage, selling it to employees, returning
it to the vendor and reselling it to third parties.
|
Real
Case 1: The eBay Fiasco
[May
04, 2006] Idaho Power, a utility company in the
United States found that some disk drives it had
eariler sold to a recycler were being auctioned
on eBay. The company had earlier reportedly disposed
of 230 SCSI drives to a single vendor, which then
sold 84 of them through an online auction. The drives
had not been scrubbed, and the data including memos,
correspondence and personal details of its nearly
half a millio customers, remains.
Typically,
Idaho Power was to have either physically destroyed
the drives or scrubbed them to U.S Department of
Defense standards - which involve degaussing them
or overwritting the data with a miniumum of three
specified patterns - and the salvage vendor was
to have the same.
|
|
|
|
Real
Case 2: The Nigerian Scam
[Aug
14, 2006] BBC news reported that bank account details
belong to thousands of Britons are being sold in
Nigeria, West Africa for less than £20 each.
It was discovered that fraudsters were able to find
Internet banking data stored on recycled PCs sent
from United Kingdom to Africa.
The
information was found on the PC's hard disk. Simply
deleting the files and even formatting the partitions
was not enough. It was suggested that people should
remove their hard disks before giving away their
computers.
Under
United Kingdom's Data Protection Act, companies
now hard a legal requirement to delete people's
personal information from their computers when it
was no longer needed. It is mandatory that companies
have appropriate procedures in place to ensure that
personal records on computer hard drives are rendered
unrecoverable when they dispose of computer equipment.
|
|
|
|
Our Data Erasure and Degaussing Unit |
Our Electric Hydraulic-Powered Disk Crusher |
|
| A
Company's Reputation at Stake
A company's reputation is at stake for not taking proper
care of corporate data and their customers' personal information.
Such confidential information on your sold, donated or
discarded data storage media may cost you or your company
much more money than the proper and secure disposal of
the data and media.
Strong
privacy laws particularly in the United States, like Sarbanes-Oxley
(SOX), the Health Information Portability and Accountability
Act (HIPAA) and the Gramm-Leach-Bliley Act for the banking
industry, and United Kingdoms’ Data Protection Act,
are also forcing enterprises to be accountable for confidential
corporate data, hence more transparent and mindful of
protection of the data, from creation and destruction.
Gartner
also estimated that through 2009, consumers and businesses
will replace more than 800 million PCs worldwide and dispose
of an estimated 512 million. So we have reasons to believe
that the demand for our special data handling services,
in relation to proper and secure disposal of data and
media, to grow in line with tightening government regulations
on privacy laws, especially for emergening economies in
the Asia and Pacific region.
|
| Our
Data Special Handling Services
Our Special Handling Services include Data Erasure
and Degaussing that guarantee that no
one can recover your deleted information from your disposed
storage media to Physical Destruction of the Storage
Media, effectively preventing identity theft
and fraud, particularly if sensitive information such
as financial records, passwords and customer details from
falling into the wrong hands. All erasure transactions
will be recorded, abd certified for Audit and
Tracking.
We guaranteed
that all data previously contained on the magnetic storage
media is permanently erased, destroyed and deemed to be
irretrievable, in compliant with United States Department
of Defense (DOD) 5220-22M standards. Under Section 8-306,
the NISP Operating Manual (NISPOM) included a table for
accepted sanitizing methods for different media.
|
|
Data
Erasure
Microsoft
Operating Systems now comes with a Cipher utility that
allows adminstrators the ability to wipe all deleted (marked
for deletion) data on the hard disk. Effectively, overwriting
all of the deleted data and make the them irrecoverable.
Cipher is included in Windows version 2000, 2003 and XP,
and the latest version can be downloaded at Microsoft
official website. On a tiny 256MB flash disk, it take
approximately five to fifteen minutes to run to completion
(depending on systems' configuration). An internal hard
disk of 100GB may take 3-5 hours to complete. The process
is time consuming and costly, especially when nowadays,
hard disks of 100GB and larger are the norm.
Why not
use the time of your technical support for higher productivity
tasks? Let us handle the chores for you using professional
tools instead? It should be note that although NISPOM
has approved both overwriting and degaussing for purging
data, the former requires that the storage media to be
overwritten multiple times in a prescribed pattern.
Our Data
Erasure strictly follows this protocoll and permanently
erase data from your disk storage media by writting a
series of zeros, ones, then random, glibberish data on
the hard disk making it unreadable. After the random value
overwrite is completed, the disk is read to verify the
overwrites to make sure there is no lingering pattern.
Effectively, remove any data remanence that can make deleted
data forensically recoverable.
We guaranteed
that data will be inaccessible to any commercially available
data recovery software, allowing hard disks to be returned
to vendors or recycled, while remaining confident that
your data has been completely erased.
|
|
Data
Degaussing
Some hard disk drives may contains faults or hidden partitions
that the drive platters prevent overwriting. Combined
with very advanced tools, through exploitation of the
phenomenon of data remanence, it may be still possible
for deleted data to be forensically recoverable. Henceforth,
NISPOM requires that highly confidential information to
be purged by degaussing and physical destruction, and
not by software rewrites.
Degaussing
is a destructive process by which the storage media is
subjected to a powerful magnetic field to remove data
on the storage media. The process is destructive, because
it make the media inoperable; therefore, it is only recommended
if the media is not intended for to be reused or recycled.
The sensitivity of the data stored on the computers and
the feasibility should be weighed before degaussing the
hard drives.
|
|
Data
Erasure Vs Degaussing
Although
there is no private Data Recovery Service currently capable
of reconstruction overwritten data, NISPOM still requires
that highly confidential information to be purged by degaussing
and physical destruction, and not by software rewrites.
Data Erasure
is a relatively more costly and complicated process, but
it is more environmental friendly. it allow the storage
media to be reused after it is overwritten. But limited
to hard disks supported on ATA, SATA and SCSI only, unlike
Degaussing, which can be used for any magnetic media devices.
Data Erasure Vs Degaussing
|
|
Physical
Destruction
More than often, after the storage media is purged (i.e.
erased or degaussed), the media will not be useable anymore
and will be returned to the customer.
Alternatively,
we also offer services to destroy the media by crushing
and shredding. Photos of crushed storage media will be
presented together as evidence with a Certificate of Destruction.
|
|
| |
|
