Hello,

On Fri, Dec 02, 2022 at 03:55:23PM +0100, Patrick Studer via swinog wrote:

We recommend remove them from computers and bring them to a company named XXX (to professional shred them).

As a joke, we now know where to look for your data :)

I am a big fan of encryption and in particular FDE.

But I still tend to disagree on the approach using FDE to "destroy" no longer used data on physical media. There are just too many variables beyond ones control. Just to name a few: - Will the encryption algorithm still be secure in 10, 30, 50, ?? years? (Old data may still be valuable data.) - Is the integration secure? (How do you make sure, that the data on the platters - or in case of SSDs in the memory cells - really IS encrypted the way you expect it?) - Possible backdoors in the algorithm? - Possible backdoors in the integration? - Are the "lost keys" really lost? (Might depend on the integration again and of course the sysadmin.)

I personally see it the other way round: physical destruction is the way to go - FDE is bonus (e.g. for the "my disk got stolen" case). If the data really is high profile, the "disk broke" case should be handled with physical destruction and a new disk should be bought.

Greetz, Mark

Am 04.12.2022 um 13:47 schrieb Jeroen Massar via swinog:

The real answer, net to using it for target practice, shredding and melting down is much easier: Full Disk Encryption.

Just lose the encryption keys and the data is useless. If you then also do one of the above for fun, just added bonus.

FDE helps for the "my disks got stolen" case, but also for the "disk broke" case, and just letting a random remote hands person remove them: one does not have to trust that they are destroyed properly, as nobody, but hopefully the sysadmins, have the FDE keys.

Of course, FDE does not help when the disk is online and one can SSH or otherwise execute code on it, but that is a different problem.

Regards, Jeroen

PS: Food for thought: what is worse, Financial Services or Advertising? [and at least you are not scamming people with ponzi schemes, right...? :) ]

...

On 2 Dec 2022, at 15:51, Martin Ebnoether via swinog swinog@lists.swinog.ch wrote:

Hi all.

As some of you know, I work at a money laund... financial company. Some time ago, the question arose, how to effectively destroy data safely and securely in an easy way?

How does your company deal with hard disks (or any media) that needs to be decommissioned? Do you just dd a few times over it? Or rather let a professional company shred your media to little bits?

CU, Venty

-- 10 PRINT "BASIC programmers don't die." 20 PRINT "They just GOSUB without RETURN." 30 END READY. _______________________________________________ swinog mailing list -- swinog@lists.swinog.ch To unsubscribe send an email to swinog-leave@lists.swinog.ch

---

swinog mailing list -- swinog@lists.swinog.ch To unsubscribe send an email to swinog-leave@lists.swinog.ch

Hi

And this is a problem if you rely on something you can not verify immediately. For example if I use a big hammer I immedialtey see the results. But a degaußed Disk does not looked destroyed - you can not verify it with your eyes.

You see the physical result but does that really reliably mean that the data is not recoverable? I’m just thinking of the work some germans are doing to reconstruct shreddered stasi files: they also seemed completely destroyed, at least enough that the stasi considered it enough, yet they are being reconstructed. I’d imagine that a hammer would not be enough to be _certain_ that reconstruction is _impossible_ (not just more or less convinced that no one will put in the effort to attempt it). Are you sure it is enough? When is it enough? I imagine bent platters are hard but not quite impossible to reconstruct and the effort required would probably not be worth the results in most cases. But that always depends on the significance of the data on the disks … I wouldn’t feel _certain_ with neither hammer nor degausser because I’m not a recovery expert. Melting the platters down with just heat or thermite or something would probably convince me. Shredding them to 1x1mm tiny pieces would leave me reasonably certain enough for most scenarios, as well.

Any data recovery experts on this list who can shed more light?

Thanks

Hendrik

On Wed, 7 Dec 2022 08:25:01 +0100 Klaus Darilion via swinog swinog@lists.swinog.ch wrote:

...

-----Ursprüngliche Nachricht----- Von: Per Jessen via swinog swinog@lists.swinog.ch Gesendet: Dienstag, 6. Dezember 2022 22:40 An: swinog@lists.swinog.ch Betreff: [swinog] Re: How to destroy data effectively?

Martin Ebnoether via swinog wrote:

...

Hi all.

As some of you know, I work at a money laund... financial company. Some time ago, the question arose, how to effectively destroy data safely and securely in an easy way?

When I worked in money laun... finance myself, in the 1980s, we used _large_ electromagnets.

We used to use a "Degaußer" for hard disks. Recently, a colleague put the degaußed disk back into his PC and could read data without problems. So, either the Degaußer is broken or for whatever reasons it did not work. And this is a problem if you rely on something you can not verify immediately. For example if I use a big hammer I immedialtey see the results. But a degaußed Disk does not looked destroyed - you can not verify it with your eyes.

So, we do not rely on degaußing anymore without verifiying (reconnect and test). So we prefer the hammer or commercial services (which still can fail, but then you can sue someone)

regards Klaus _______________________________________________ swinog mailing list -- swinog@lists.swinog.ch To unsubscribe send an email to swinog-leave@lists.swinog.ch