Obliterate Hard-Drive Data with Disk-Wiping Software

Some security experts believe that physically destroying a hard drive is the only way you can truly be sure that your data will not be compromised. While pounding your old hard drives with a sledgehammer will likely deter 99 percent of data thieves (and provide you with some catharsis), it also significantly reduces the usefulness of the computers you're donating.

So unless your organization's computers are too old to be repurposed, it's better to reformat your hard drive or scrub it down with a wiping application so that someone else can put it to use. For tips on prepping your hard drive, reformatting, and different levels of data eradication, read part one of this series, Avoid Data Theft: Clean Your Old Hard Drives.

If a third-party organization — such as a refurbishing or recycling firm — will be handling your nonprofit's old computers before they reach their new owners, it's advisable to employ a secure wiping application when cleaning the hard drive. By overwriting all data contained on the drive with ones, zeros, and random characters, disk-wiping programs do a very thorough job of destroying confidential information, making it nearly impossible for would-be thieves to access your organization's private files. Though the many disk-wiping applications on the market are all designed to perform the same task, keeping a few factors in mind will help you determine which piece of software best fits your organization's needs.

1. Desired level of security. The sensitivity level of the data on the hard drive will probably determine how thoroughly you want to destroy it. For instance, if you suspect that one of the hard drives on a system that you're donating or getting rid of contains information about your nonprofit's finances, you'll want to do everything in your power to ensure that the data is eliminated for good using the most secure method you can.
   
   There are many methods and levels of data wiping, from a quick-pass option to an ultra-safe, ultra-secure method approved by the American Department of Defense. While we won't cover every single one, we will zero in on some of the more frequently used methods.
   
   Just about all disk-wiping programs offer what's commonly called a quick-erase (or one-pass) option, which will overwrite all data on the drive with a single pass of zeroes. While this method does wipe out all of the information (including your files, personal data, and programs), it's generally considered the simplest and least-secure wiping option, as determined individuals with specialized equipment could still potentially recover data remnants.
   
   Many disk-wiping programs also provide several medium-level security erasing options that overwrite data multiple times using a combination of different characters. For instance, if you need to purge information using a medium-security method, you might seek out a product that offers the American Department of Defense Standard 5220-22.M (DoD 5220-22.M) method, which wipes the drive three times using a character (a "1" or a "0"), its complement (the opposite of the first character), and then another random character.
   
   Finally, if you're trying to destroy a drive containing truly classified information, you might want to look for a product that supports the Gutmann method or another extra-thorough wiping scheme. Based on data destruction practices developed by a noted computer scientist, the Gutmann method overwrites information 35 times using a variety of predetermined and random passes. (For a detailed account of how this method wipes data, read Peter Gutmann's paper Secure Deletion of Data from Magnetic and Solid State Memory.)
   
   In addition, some pieces of wiping software will let you create your own destruction scheme by specifying character values and the number of passes. It's important to note that performing one of the more secure wiping methods will consume quite a bit of time, so you'll probably want to start the process as early as possible if you need to get computers ready by a certain date.
2. Hardware compatibility. Just about all disk-wiping programs let you install and run them from either a floppy disk or a burned CD-R/RW disc; many offer both options. Just as some newer PCs and laptops lack built-in floppy drives, many older machines might not have a CD burner. Therefore, make sure that you choose a piece of software that is compatible with the computer hardware your nonprofit is disposing.
   
   If for some odd reason the machines in question have neither floppy drives nor CD burners, your best bet is to order a piece of boxed software that will run from a CD-ROM drive. Also, check to make sure the wiping program supports your hard drive's interface type (such as SCSI, Serial ATA, or IDE), though this shouldn't be an issue in most cases.
3. Number of hard drives you'll be wiping. If your nonprofit is getting rid of a few dozen computers with large hard drives, destroying all that data could eat up a substantial chunk of your workweek. In order to expedite the process of getting those old machines out of your hair, one time saver is to wipe multiple hard drives simultaneously. And if your nonprofit regularly upgrades its technology equipment, you're definitely going to want software that can run on more than one computer.
   
   Some commercial hard-drive wiping applications offer a bulk-pricing deal, allowing your organization to purchase a license to run the software on several machines at once. Many also have an unlimited-license option that will let you purge as many computers as you want at anytime in the future. Different software manufacturers offer different pricing plans, so be sure to conduct thorough research before you drop a pile money.

A Few Popular Disk-Wiping Programs Compared

There is no shortage of applications designed specifically to securely scour your hard drive before you give it away or dispose of it. To help you narrow down your options, we've outlined some of the features and pricing info of a handful of popular programs, all of which offer some sort of trial or free version.

No matter which software you decide to use, remember to keep it in a safe place where staff members don't have easy access to it; and if you choose a program that runs from a floppy disk or CD, clearly label each copy. Precautions like these will help ensure that neither you nor the people who work at your organization make an irreversible mistake by accidentally wiping a hard drive full of important information that hasn't been backed up.

• Acronis Drive Cleanser
  Acronis DriveCleanser, a commercial application for erasing hard drives, supports eight wiping methods of various security levels and will also let you create a custom deletion scheme. If you decide to purchase the program (five licenses cost $250) you can run it directly from a Windows computer's CD-ROM drive or create a bootable floppy to make it compatible with certain versions of Linux. Note that while the free demo will let you get a feel for the product's interface and feature set, it won't actually wipe away any data.
• Active@ KillDisk - Hard Drive Eraser  
  This disk-wiping program comes in both free and commercial variations. The free version can only wipe drives using a single pass of zeroes, however; if you want a more secure method such as DoD 5220-22.M or Gutmann, you'll have to buy the application. Active@ KillDisk runs from either a bootable floppy or a CD, and as such is compatible with both Windows and Linux machines. If you need to scrub down multiple hard drives at once, you'll need to buy several licenses (check out this pricing chart for more details).
• Darik's Boot and Nuke
  Darik's Boot and Nuke (DBAN) is a free, open-source program compatible with all versions of Windows and Linux distributions (a Mac version is also available). DBAN can either be booted from a floppy disk or burned to CD and wipes data using six different methods, ranging from 1 to 35 passes. As a bonus, DBAN doesn't place a limit on how many computers you can clean simultaneously.
• East-Tec DisposeSecure
  East-Tec DisposeSecure can be copied to a floppy disk or burned to CD, then used to wipe machines running Linux or Windows. The application offers 10 secure wiping options. The free demo isn't completely functional, but it will allow you to destroy 25 percent of the data stored on a hard drive. For $200, you can buy a version of DisposeSecure that will clean an unlimited number of drives, though if you want to wipe multiple computers at the same time, your organization will need to pony up extra cash.
• Iolo DriveScrubber  
  Unlike some of its competitors, Iolo DriveScrubber will not allow you to create a bootable CD, so if you happen to be donating newer machines without floppy drives, you'll need to order the actual boxed product. Also, if you want to clean data using more secure methods such as DoD 5220-22.M or Gutmann, you'll need to opt for the pricier DriveScrubber Professional version rather than the Personal edition, though both will work with Windows, Mac, and Linux operating systems. For information on purchasing multiple DriveScrubber licenses, visit Iolo's pricing-matrix page.
• WhiteCanyon WipeDrive
  WipeDrive can be purchased as a CD-ROM or copied to a bootable floppy disk, though the downloadable version of the program cannot be burned to a CD. The application supports PC-based Linux operating systems and provides 10 secure wiping standards, including those approved by the United States military. The Professional version of the program, available for $99, will allow your organization to clean an unlimited number of hard drives; if you also need to wipe a few computers at the same time, you'll need to contact WhiteCanyon for details on its Site Licensing program.

No matter how you decide to cleanse your nonprofit's old hard drives, just make sure you do it. Your organization's private information is simply too important to gamble with, and if you release used computers into the world first without destroying their data, you're definitely pushing your luck. Although wiping hard drives will cost you and your staff some time — and maybe even a bit of money — recovering from the consequences of data theft is certain to be a far more painful affair.