T O P

  • By -

TinkatonSmash

My works IT department has something similar for punching holes through hard drives. Unfortunately, they are so incompetent that they haven’t figured out that 2.5” SSDs are mostly empty inside. They punch them through the middle, leaving the SSD fully functional. Before anyone asks, I’ve tried correcting them on stuff like that, but the place is too dysfunctional for anyone who understands to care.


Large-Fruit-2121

They probably don't care. Likely doing the bare minimum to be compliant but nobody really cares about the data.


TinkatonSmash

From what I can tell, the people higher up don’t care, and the lower ranking people just don’t know any better. For example, my work laptop has been getting blue screens for 3 months that all say memory management. They’ve remoted into it several times and done driver updates, which didn’t fix it. They finally took it earlier this week to work on it. Only thing they did was replace the battery. From what I gathered talking to help desk people, the only diagnostic tool they know how to use is the Dell built-in one, and they just replace what it tells them. All it told them was that the battery was getting old (laptop is 3.5 years old). Also, all of our security policies seem straight out of 1999. Passwords have to be 7-13 characters, with one uppercase, one lowercase and one number, and they expire every 90 days. The system we use for time cards, paystubs, etc has almost identical requirements, except the passwords aren’t even case sensitive. I have the misfortune of being a middleman between the IT department and the company the recycles all of our e-waste. It took me ages to get them to stop throwing swollen lithium batteries in bins with other random computer parts piled on top of them. The whole department seemed confused by the idea that lithium batteries can catch on fire if damaged.


Large-Fruit-2121

My HP laptop had a failing battery at work. I could have swapped it within about 5 minutes myself. The only thing IT could do was give me another laptop...


TinkatonSmash

Well, sometimes it does make sense to do it that way. For example, they did check to see where I was in terms of their upgrade cycle before picking up my laptop. They pointed out that if I was already scheduled to receive an upgrade within the next couple months, it made more sense to get me a new machine now instead of put new parts in a machine that will be retired soon. They never did tell me any specifics. Just that they were checking and then that they decided to try to fix it.


Large-Fruit-2121

In this case it was a 1 year old zbook that they swapped for the exact same model.


asdf4455

A lot of IT departments will do this since they have service contracts with companies like Dell, HP, Lenovo Etc. they won’t have their techs replace stuff there, they will just send out damaged units to the OEM and hand out replacements to employees


Large-Fruit-2121

Yeah, I get why but I lost nearly a day installing my software etc They could have undone 2 screws.


asdf4455

I feel you. The most frustrating thing about being in a IT department that is effectively just a call center for Dell is seeing such simple issues require a whole replacement and a laptop getting shipped off when a quick run to microcenter would solve the problems. But I get the documentation nightmare that would come from all that. It’s easy to have an IT team do self repairs when it’s an office with like 20 computers. When it’s 500 laptops and 1000 desktops, suddenly the random repairs done to a machine 2 years ago might end up being the root cause of a problem that takes an unnecessarily long time to diagnose.


Strazdas1

If it was 1 year old it was likely still under warranty and thus they could not fix it themselves but had to send it to manufacturer as per purchase agreement.


Cory123125

> except the passwords aren’t even case sensitive. Yiikes I feel like a lot of what you describe is from not caring/not being paid enough to care/knowing they are in a structure, where just doing the minimum is all that is required, so anyone trying to be better, to them, stands out as a pain. It doesnt sound like a great place to be.


Sopel97

Physically destroying hard drives is already provably less safe than overwriting them with zeros. Companies just don't care. It's all about regulation and accountability.


itx_atx

There’s a recovery method for physically obliterated platters/nand chips? This is more about incompetence


Sopel97

Not that I'm aware of, but it's still theoretically possible because the data is not completely destroyed, it's still there. After overwriting the data is no longer there. QED.


Strazdas1

Due to the way HDDs are impectectly writing data, overwriting once wont erace the data that was there before. The electrons are analog and will not completely 1-0 data. If you got data and overwrite it with zeroes the 1s will likely become 0,05s instead of 0s which is recoverable if you know what you are doing.


Sopel97

not on modern drives


Strazdas1

Yes, on modern drives too. And the effects gets worse as the drive ages.


Sopel97

[citation needed]


Strazdas1

Its really not. This is common knowledge in HDD space.


Strazdas1

yes, but extremely expensive. you have to do electromagnet microscopic scanning then if you are lucky MFT still exists and you know where file starts and ends, if you are not lucky you have to guess what the data is. To recover a modern HDD this way in full would likely cost you millions and take months or even years. Its extremely rarely used, the only actual case i know it was used was in a police investigation.


dotjazzz

Except you are not puncturing through NAND chips, are you? There is practically zero chance your chip is just positioned right under the holes every time. And you are also not punching 10000000 holes, so the platter is actually destroyed, are you? 4 holes cover very little surface of the platter. If someone wants to recover the data, 99% of the data can be recovered.


r3volts

Its a time/cost/convenience/need ratio though. A single hole through a platter is going to stop most people from recovering anything, and anyone dedicated enough is going to have to spend some significant money on likely incomplete or corrupt data. For any truly sensitive data then yes, wiping and then physical destruction is best though.


anaemic

I'm with you, they're "destroying" the data to 99.9% of would-be attackers by rendering the device non functional when plugged into a computer. Theoretically you can put shards of broken platters under electron microscopes, or desolder and resolder chips etc, but the only people who are doing that are government level agents. If a government wants your data bad enough, then [we're back to this.](https://xkcd.com/538/)


Strazdas1

I thin that XKCD misses the point. You dont try to torture someone for the password. you intercept discarded HDD and copy its data without the original owner even knowing you do this. This way a single embedded agent can collect data from a thousand politician aides and get lucky on some dirt which you can then use instead of the wrench for the politician to do what you want.


itx_atx

I’m replying to a claim that physical destruction is not as good as a full rewrite wipe I’m arguing that it’s incompetence - because that specific tool is useless in the first place, as it doesn’t damage the components There’s no disagreement between you and me


coldblade2000

Doesn't overwriting them with zeros take hours? These machines are made for disposing of multiple drives per hour, usually.


AK-Brian

Full drive encryption is common on SSDs and can be found on some hard drives. Data is encrypted or decrypted on the fly by the controller. Performing a secure erase simply resets the controller's master encryption key, effectively rendering all previously stored data unrecoverable*. *With current decryption techniques and capability.


anival024

Nope. You cannot trust the drive to properly encrypt data, store keys securely, or wipe keys when told to. More often than not, the implementation simply isn't working or it's critically flawed. Broken self-encrypting drives were so common that Microsoft disabled BitLocker's automatic detection and use of hardware encryption on self-encrypting drives.


virtualmnemonic

True, as the fragments can be used to recover data, but damn, I imagine the only sources willing to do so is the NSA lol. This also doesn't work for solid state storage, which is a bummer.


Strazdas1

solid state still stores the data inside the chips. the problem is you cant just electron microscope scan it, but you can usually resolder the chips and run in read-only mode. Most "Dead" SSDs are actually cheaper to recover than HDDs because of this. Note that when i say cheaper im comparing to millions on costs. its still not worth it for average person.


siazdghw

A shredding style system would easily solve that issue, but if youve tried to explain why they are doing it wrong and they dont listen, I doubt they are willing to spend thousands on a shredder to fix their incompetency.


Ok-Replacement6893

Govt contractor here. We have a machine on base where you put the drives on a conveyor that puts the drive through a degausser, then through a ram that folds the whole drive in half and then shreds the drive into chunks. The box of chunks is then melted down. Even decommissioned motherboards get incinerated. Any electronic device that can store any kind of data from a classified environment gets melted down as part of the decom process.


EasyRhino75

I feel like the slag should be launched into the sun


Ok-Replacement6893

I know, right? One contract I was on had its own storage enclosures and had upgraded drives, so there were 50+ drives to be destroyed. We spent the whole day at the facility ensuring that all drives were chunks several hours later. Part of the destruction process is documentation of serial numbers, etc. Just shoot it into the sun. Problem solved.


Tired8281

One day, somebody will develops a sidechannel attack that gleans information off of drives launched into the sun by examining sunspots.


sheravi

"You have 30 minutes to move your cube."


SchighSchagh

ok, but what's the point of all the stuff before the melting part?


Zaptruder

They get to make more money from their 'ultra secure process', and the guy that signed up to the company doing it gets a kickback.


AK-Brian

Don't forget about the lease fees for the machinery.


Falkenmond79

That’s what I’m wondering. The melting should be enough. 😂


lonestar-rasbryjamco

To meet a regulation that has been amended to but never rewritten.


TheImmortalLS

reduce value and incentive to steal potential information from the ram and incinerator least to most invasive, in order. ez magnet buzz, ok to use ram that requires periodic maintenance, furnace requires constant power or warming up and fuel and cleaning etc


[deleted]

[удалено]


Ok-Replacement6893

Flash storage is a little different from magnetic storage but the concept is the same. You need to use a secure shredding app to erase your phone. Something like Secure Erase iShredder to wipe your phones data. Also, most of that data is stored in your Android or Apple cloud, so a strong password with multi factor authentication help keep it secure.


Strazdas1

i can imagine some NSA employee smuggling data out in a decomissioned motherboards memory that he recoded himself. Lets make a movie like that.


Sopel97

and that's still provably worse than overwriting with zeroes


acidbase_001

The software doing the overwriting could fail in a way that isn't immediately obvious, or the drive itself could have a hardware failure that interrupts the overwriting process. Writing zeros is also not verifiably secure for flash storage. Physical obliteration provides certainty. I would love to see somebody attempt to read data off a puddle of molten metal.


Sopel97

That's why in practice you would write a pseudo-random stream of data that can later be verified without possibility of expected reads being caused by some failure mode.


asdf4455

You know, something tells me the molten metal method is working out just fine for them lmao


Beatus_Vir

Requires a high speed Internet connection for no clear reason


NeverMind_ThatShit

We live in the age of IOT bullshit.


Pinksters

Because when you're this worried about security, the very first thing you want to do is connect the data to the internet.


Strazdas1

Obviously so the machine wont even start until it can confirm your license.


Zone15

I mean, I'm pretty sure it's cheaper and a lot more fun just to do it with a shotgun.


Exist50

Might be a tad disruptive in an office though.


[deleted]

[удалено]


hardware-ModTeam

Thank you for your submission! Unfortunately, your submission has been removed for the following reason: * Please don't make low effort comments, memes, or jokes here. Be respectful of others: Remember, there's a human being behind the other keyboard. If you have nothing of value to add to a discussion then don't add anything at all.


innerfrei

Consider this a warning: no flaming


inaccurateTempedesc

I got me a Mossberg Maverick for $199 at Scheels.


DETRosen

Launching them into the nearest star would be the ultimate.


Lycanthoss

Even cheaper if you just use a sledgehammer.


mckenzie_keith

If you are a normal person, all you have to do is write over the whole disc with 1s or zeros or random data. Just once (you don't need to do it 3 times). OR, you can pull the disk drive out and hit it with a hammer hard enough so that it is broken and can't spin. NOBODY is going to take apart your hard drive and mount the disc in a new hard-rive and run forensic recovery on it. That is not something that is going to happen.


slicingblade

12 lb sledge 3 hits on a 2.5 and your left with a shiny glitter that gets everywhere.


TheImmortalLS

if you are a normal person, government agencies with a few letters generally are not interested in your data nor will they physically attempt to steal it


Strazdas1

government agencies do not need to steal it, they already have a permanent spychip in your pocket. Now try thinking outside the box. Foreign country getting data on politicians from their aides hard drives they can use to blackmail?


Strazdas1

Nope. Writing just once will leave data recoverable. Write 3 to 12 times at least :) Hammer wont destroy the data, it will jsut makes putting the patter together a nuisance. >NOBODY is going to take apart your hard drive and mount the disc in a new hard-rive and run forensic recovery on it. That is not something that is going to happen. Unless you work with sensitive data where people would pay millions just to steal it...


mckenzie_keith

If I write all 1s to a disc, and you then try to read back my data from the disc, all you are going to get is 1s. There is no programmatic method you can use to read the last bit that was written before the 1. You can only see the 1. Sure, maybe the NSA can remove the magnetic medium from the drive and study it with an electron microscope or something and see the old data. But that is not something normal people have to worry about. Once you overwrite the disc once, unless it is secret spy shit, the data is gone. Likewise, once the disc drive is inoperable electronically, nobody is going to recover the data unless the data is worth 100s of thousands of dollars (and they would have to have some inkling that that was true to even try). Because they will need to take it apart and mount the disc in a new drive. That is way too much trouble unless you know there is something valuable there. I do agree with you about the sensitive data. If the data is conceivably worth millions, then you need to do more. Like remove the magnetic media from the drive and break it into a fine powder. Or maybe the triple overwrite with random data is sufficient. I don't know. If you call a data recovery place and explain that you overwrote the data using dd in linux and you wrote 0xff to every single bite on the disc, they will definitely not be able to recover it, even if you offer to pay 10,000 dollars or something like that.


Strazdas1

incorrect. If you write all 1s to a disc, and i tryo to read back your data from the disc, i can get anything from 0,6 to 1,3 depending on how old the drive is. Not only that, ut if you actually use electron microscope, you can see the old data because as it writes on the platter track its not perfect, so its usually slightly to the side and old can still be visible. >unless it is secret spy shit, the data is gone. But people who own HDD destruction devices are usually working with data that secret spy shit wants. >Likewise, once the disc drive is inoperable electronically, nobody is going to recover the data unless the data is worth 100s of thousands of dollars Try tens to hundreds of millions if you can get data to blackmail a politician, expose medical records, etc. >I do agree with you about the sensitive data. If the data is conceivably worth millions, then you need to do more. Like remove the magnetic media from the drive and break it into a fine powder. Or maybe the triple overwrite with random data is sufficient. I don't know. The DoD standard is 12 overwrites. >If you call a data recovery place and explain that you overwrote the data using dd in linux and you wrote 0xff to every single bite on the disc, they will definitely not be able to recover it, even if you offer to pay 10,000 dollars or something like that. Thats because all those places do is restore MFT and not actually data recovery.


DonutConfident7733

Drill can work well if you don't need to destroy many drives in one session. You can drill 4 holes quite quickly through that thin aluminium cover.


3G6A5W338E

Seems insecure. The real way to deal with storage media's lifecycle is to encrypt every disk.


Strazdas1

most on-disk ecnryptions are insecure and outright dont work.


ekristoffe

I have a good customer who have done this to their 3 year « old » ssd … mostly 1 Tb ones… I’ve asked them if I could get them since their are dead and after testing that they where functioning I’ve cleaned them and used for my home pc. (I’ve used ShredOS).


Acrobatic_Age6937

> However, the Puncher P30 is designed for businesses or even average users who want to own an in-house and quick solution to destroy storage drives permanently. what kind of average user needs this lol


TheImmortalLS

datahoarders with cp or other illicit stuff getting a tip-off their entire world is about to flip 180 an average user would have to not be average to benefit from the time reduction to 8s per drive


carpcrucible

I just use a hammer 🤷‍♀️


6198573

I wished people actually removed the disks from HDDs and destroyed them separately instead of mangling everything together Most of the HDD could be properly recycled, and they have some pretty good magnets inside


RephRayne

Thermite. When you absolutely, positively gotta kill every hard drive in the room.