What Standards Do Data Erasure Software Use?
Keeping sensitive data safe is more important than ever before. It's not just companies whose information gets leaked; it also affects individuals. So, it's important to erase data before handing a device to anyone as a gift or selling it. That's why you need erasure software to remove all traces of data.
Data wiping software makes it more difficult for third parties to get their hands on deleted data. It erases data from hard drives, phone memory, and other storage media several times to prevent the leakage of sensitive information. This type of software yields better results than a factory reset on mobile devices.
Meanwhile, erasure standards like DoD 5220.22-M and NIST 800-88 provide guidelines on how the data wipe process should work. They lay down the rules regarding erasure patterns, the minimum number of overwriting passes, and verification methods used by the software.
This article discusses how the data erasure software works, data destruction benefits, types of data erasure standards, and the DoD data wiping process. You’ll also learn how Phonecheck Pro Secure Erase improves information security.
Data erasure software
Overwriting sensitive data has never been easier, thanks to advanced data erasure software. You can count on it to overwrite sensitive information from data storage devices like solid state drives (SSDs), flash memory, and hard disk drives (HDD). The best IT asset disposition (ITAD) solutions available on the market follow erasure verification methods to ensure your information is gone for good.
Software like this gives you peace of mind knowing your data is irrecoverable. It's even more effective than the physical destruction of a storage device. The process uses one of several data erasure standards to ensure the complete removal of confidential information. Once the deletion process is complete, the software checks that the overwriting worked correctly.
For individuals, one of the benefits of using software to erase data is protecting personally identifiable information (PII). Erasure prevents unauthorized access to your identity number, credit card details, health information, physical address, and bank account numbers. It also protects passwords, videos, call logs, emails, and photos from falling into the wrong hands.
Meanwhile, you can count on data wipe software to help improve data protection measures for your business. Data thieves are always looking for ways to get their hands on sensitive data. By deploying this type of software, you prevent leakage that could expose your company to unwanted risks.
Another key advantage is ensuring regulatory compliance if your organization must adhere to specific standards, such as HIPAA. Thankfully, Phonecheck simplifies your ability to comply with these requirements with twice the speed of other solutions, and the only erasure backed by certification.
How does data erasure software work?
Erasing data from mobile devices and desktop computers works in several ways, depending on the software's type of data wipe standards. How you erase the data depends on your chosen erasure standard. It involves removing the content index (or address) to the files stored in a storage device. Then, the software overwrites the files several times to ensure permanent deletion.
There's also the option of creating a new encrypted file system over the deleted version, making the data irrecoverable. Your device will no longer host any user data, not even the junk files. If you don’t delete data correctly, it could still be retrieved by hackers using data recovery software and used maliciously.
Advanced data wipe software replaces existing data with random characters since all digital devices store data based on a binary code consisting of ones and zeros. The National Institute of Standards and Technology (NIST) came up with this data destruction method to protect sensitive IT assets and maximize data security on laptops and other computing devices. Although the minimum number of overwrite passes is three, some data erasure methods like the Gutmann Method prescribe up to 35 passes.
Which standard is often referred to as the source for data sanitization?
Data sanitization methods or standards like DoD 5220.22-M and NIST SP 800-88 provide a basic framework to erase data from hard drives, phone memory, and other storage media. So, data wipe software permanently erases sensitive information based on the prescribed processes, such as the number of overwrite passes, type of patterns, and validation methods.
These processes make it easier to leave no traces of information when planning to sell, reallocate, or dispose of a device for recycling. Although DoD 5220.22-M still plays an important role in data erasure, NIST Special Publication 800-88 is increasingly the leading standard or data wipe method. It extends coverage to mobile devices and flash memory, which aren’t covered by the DoD process.
What is the DoD 5220.22-M standard?
To ensure permanent results, this standard outlines specific secure data erasure processes. The U.S. Department of Defense introduced it to ensure that organizations that store classified information comply with data erasure requirements. It determines how the overwriting and verification processes work.
A key component of the DoD standard is that it uses binary characters (as in zero and one). On the other hand, you'll also find other variations that use the number 97 for the last overwriting pass instead of the traditional random character. Based on the DoD data wipe algorithm, these characters erase the content index or address to file locations on storage devices.
Phonecheck Pro Secure Erase is an example of professional software that uses the DoD 5220.22-M standard. You can rely on the solution to overwrite your hard drive storage locations according to the recommended procedure. Once the data gets erased, the software generates a tamper-proof certificate to show that you erased sensitive information as specified.
Also known as National Industrial Security Program Operating Manual (Nispom), the standard addresses sanitization processes for hard drives and other storage media except for flash memory (like SSD) and mobile device storage systems.
The DoD data wiping process
Data storage devices undergo three overwrite passes before the software checks whether all files are clean. The ECE version of the standard runs seven passes, including two DoD 5220.22-M passes.
With the traditional three-pass process, the software first writes a binary code (1) on file locations and verifies the entry before writing the code (0) in the second pass and verifying it. Then, it runs the third pass by writing another random digit and confirming the entry. This pattern clears data on hard disk drives (HDDs) to achieve 100% permanent erasure.
Your hard drive's storage capacity and interface type determine the amount of time the data wipe process takes. Once the process is complete, it becomes virtually impossible for any file recovery software to retrieve the erased data from the drive. To employ the DoD standard, get a reliable data wipe software: Phonecheck Pro Secure Erase.
Why use the DoD standard?
This data destruction method can help reduce the time it takes to erase sensitive information from high-capacity hard drives. It's also useful when you've got too many drives to wipe. The DoD standard takes less time because it only runs three overwrite passes instead of methods like the Gutmann standard, which requires more than 30 passes to complete an erasure.
Another important benefit of using the DoD 5220.22-M is verifying an overwrite with each pass. That way, you can guarantee that the existing data is really gone. On the other hand, this data wipe standard overrides the file locations using a combination of zeros and ones plus random characters. This approach helps reduce the possibility of data recovery using advanced software.
Other data wiping and erasure standards
Here are some data erasure standards you may also want to consider.
- NCSC-TG-025. This data sanitization method was previously part of the US National Security Agency (NSA) standards to prevent data breaches. Its data wipe process is similar to the DoD 5220.22-M in that it runs three overwrite passes and verification steps.
- AFSSI-5020. The USAF introduced this method, which also runs three overwrite passes. However, unlike the DoD method, it only verifies the write in the last pass. In the first and second passes, it writes zero and one, respectively, before writing a random character and then validating the entry in the third pass.
- HMG Infosec Standard 5. It involves overwriting storage devices with binary codes and a random character. This standard only verifies entries in the third and last pass. You can implement one of two versions of this method: the baseline or enhanced standard.
- RCMP TSSIT OPS-II. This method provides data wipe guidelines for removable magnetic media like discs, cartridges, and tapes. It runs passes using an approved tape degaussing tool or bulk eraser. You can also use it to erase data from non-removable magnetic media. The six-pass process involves overwriting sensitive information using alternating binary patterns consisting of ones and zeros. If your storage devices also include magnetic core memory, the data gets overwritten a thousand times with binary code. Meanwhile, optical disks require physical destruction (shredding).
- CSEC ITSG-06. This method replaced the RCMP TSSIT OPS-II data wipe standard. With this method, you erase data entry in three passes, and verification only takes place in the third pass.
- Verschlusssache IT Richtlinien (VSITR). This standard runs seven passes, with the first six entries being alternating binary patterns (ones and zeroes) before entering a random character in the seventh pass. Some VSITR versions run three passes, while some enter the letter A in the last pass instead of a random character. Another version enters alternating binary patterns in the entire drive as part of the final pass.
- The Gutmann method. This algorithm uses more complex binary patterns that it runs over 35 passes. It enters random characters in passes one and four and then 32 to 35. Random patterns appear in passes five to 31. Although some of its encoding techniques are no longer viable for modern hard drives, it still works on some drives. So, you may not need to perform all 35 passes, depending on the compatibility of specific encoding technology to the drive you want to wipe. A few passes may be enough for most modern drives.
- The Schneier method. This standard runs seven passes involving a combination of ones and zeroes plus random characters. It enters one in the first pass and then writes zero in the second. On top of that, it writes random characters in passes three to seven. Some versions of this method verify the first and last passes.
- The Pfitzner method. Depending on your specific requirements, you can erase data in 33 or fewer passes. This standard allows you to random characters between the first and 33rd passes.
Get advanced data security and exceptional speed with PhoneCheck Pro Secure Erase
To get rid of sensitive data, use erasure software — it's fast and accurate. The ideal sanitization solution provides a secure way to clean your storage devices. What's great is that you get certified data wipes, so you comply with regulatory requirements.
Phonecheck Pro Secure Erase is a multi-layered solution capable of performing DOD3 level and cryptographic wipe processes at scale. To check out Phonecheck and decide for yourself, request a demo today.
Never buy a used phone without checking its history. Consider purchasing a history report on phonecheck.com for about the cost of a cup of coffee to avoid costly hidden problems.
