Blog | G5 Cyber Security

Securely Erase Data: Quick Format vs. Proper Disposal

G5 Cyber Security

TL;DR

Quick formatting does not securely erase data. It simply removes the file system’s pointers, making files appear gone but leaving the actual data intact on the drive. To properly dispose of encrypted data, you need to overwrite it multiple times or use a secure erasure tool.

Understanding Quick Format

When you quick format a drive, the operating system doesn’t actually delete the files. Instead, it creates a new file system table, marking all sectors as available for reuse. The old data remains on the disk until overwritten by new information. This is fast but insecure.

Why Quick Format Fails to Securely Erase Encrypted Data

Even with encryption, remnants of the encryption keys or patterns within the encrypted data can potentially be recovered using forensic techniques if the underlying data isn’t overwritten. Quick formatting leaves these traces intact.

Secure Data Disposal Methods

  1. Full Format (Slow but Better): A full format overwrites every sector on the drive with zeros or random data. This is more secure than a quick format, but still not foolproof against advanced recovery methods.
    • In Windows: Right-click the drive in File Explorer, select ‘Format…’, and ensure ‘Perform a full format’ is checked.
    • In macOS: Use Disk Utility and choose an option that overwrites the data (see step 3).
  2. Data Overwriting Tools (Recommended): These tools overwrite the drive multiple times with different patterns, making recovery significantly harder.
    • DBAN (Darik’s Boot and Nuke): A free, bootable tool for wiping entire drives. Download DBAN
    • Eraser: A Windows-based tool that allows you to securely delete files and folders or wipe entire drives. Download Eraser
  3. Encryption with Key Destruction (Best for SSDs): If the drive is already encrypted, destroying the encryption key renders the data unreadable.
    • For BitLocker drives in Windows: Use manage-bde -forcerecoverykey to remove the recovery key.
    • For FileVault drives in macOS: Disable FileVault and securely erase the associated keychain.
  4. Physical Destruction (Most Secure): Physically destroying the drive (shredding, degaussing) is the most reliable method.

Step-by-Step Guide to Securely Erasing with DBAN

  1. Download DBAN from DBAN’s website and create a bootable USB drive.
  2. Boot your computer from the DBAN USB drive (you may need to change the boot order in your BIOS settings).
  3. Select the drive you want to erase carefully! Warning: This will permanently delete all data on the selected drive.
  4. Choose a wiping method. ‘Zero Out’ is a basic option, while ‘Gutmann Method’ or ‘Pseudorandom Data’ are more secure but take longer. 
    # Example DBAN screen selection (may vary slightly)
  5. Start the process and wait for it to complete. This can take several hours depending on the drive size and wiping method.

Step-by-Step Guide to Securely Erasing with Disk Utility (macOS)

  1. Open Disk Utility (Applications > Utilities).
  2. Select the drive you want to erase.
  3. Click ‘Erase’.
  4. Choose a security option:
    • ‘Fastest’: Similar to quick format, not secure.
    • ‘Standard’: Overwrites the drive once with random data.
    • ‘Secure Erase (7-pass)’: Overwrites the drive seven times with different patterns – more secure but slower. Note: This option may not be available on all SSDs.
  5. Click ‘Erase’.

Important Considerations

Exit mobile version