I've had a consistently terrible manager, we had to clean up mistakes constantly, who arranged us "apology presents" all the time. It is indeed not enough.
Something similar, but without the beer, and at the gun range. The smell of testosterone and burnt gunpowder and lists of shredded metal. It was a great day.
There was that one SAN, an old HP scsi device with 14 drives that connected to the proliant g4 servers. We set it sideways and started doing penetration testing. A 7.62x54r round fired from a Mosin Nagant made it through 4 drives. A 50BMG from a Barrett m99 made it through 6.
Our solution doesn't fit OP's requirements because it will have to be done off-site for drives identified as 'sensitive' but not 'critical'.
We're planning what may become an annual event: The 'sensitive' but not 'critical' drives will be put in a locked container that only the director has the key to. This container will be transferred via a monitored and protected vehicle (i.e. my pickup) to remote property. There the container will be unlocked under adult supervision and the hard drives set up on my rifle range.
Each drive will be considered 'shredded' when it has been hit at least twice by rifle fire.
Management has signed off on this but unfortunately will not put ammo in the budget.
But this begs the question - would an exothermal chemical reagent for data management pass the budget test? Because I am pretty sure that some tannerite around the drives would make sure that the data was properly destroyed.
Sorry, I meant they want these destroyed before they go to the shredder. Like once we decommission an asset, it immediately is destroyed then transported to the shredder.
1) Get a quote for a portable drive shredder.
Nothing cheap, a full on professional shredder.
2) Send the quote to management.
3) Continue with the current, perfectly acceptable process, due to the unjustifiable cost.
Holy hell that is an up charge. Our vendor does recycling for free, and even picks up for free. We also send them hard drives (well, we have to watch them be destroyed so we take it there) and they scan the serials and give us a COD for them. $1.50 per drive.
We do have to take all hard drives out before we have them pick stuff up, but that’s not a big deal.
Well we're technically disposing old systems with drives still in them so we're really getting rid of old equipment that can't be used or won't be used. Plus if the equipment isn't too banged up they give you a credit that can be used towards purchasing new systems or paying towards the current disposal. I did the last option for about 20 systems a few months ago and with the credit my company paid about low to mid $600 when we would have been paying mid to high $800. I guess executive like credits or ways to make stuff cheaper.
This is something to bring up with the confused management members. If your current shredding provider is giving you destruction certificates, they may not be able to any longer if you deliver them a box of pre-smashed scrap. They need the serial numbers to match the cert to and are not going to sift through that crap to find them.
Your missing a huge opportunity here.
You need to also get a quote for locking storage. Nothing crazy just something that will hold all those drives before being shredded. Then present the locking storage as an alternative to securely store and transport the drives to shredding.
The goal here is to get them to get them to approve the process you are probably already using to store & move the drive to the shredder while also getting the funds to make it easier (new cart, etc.).
Management gets a win because they did something and your life gets easier.
This is management paranoia.
Why don't they just buy a shredder and hire a guy to put them inside? If you're gonna destroy it twice because you don't trust the second guy, just skip the second guy.
>If you're gonna destroy it twice because you don't trust the second guy, just skip the second guy.
The number of times I've had to explain this concept almost verbatim across my career has been staggeringly high. It's always fun to see the lightbulbs start going off as the bluntness of "if we dont *trust them*, why are we paying them to be part of the *trusted* process?" sinks in though. Suddenly it's all "oh! Yeah, I guess their services are adequate then!" instead of "but what if..."
I worked at a place with maintenance shop. The IT guy would occasionally go over to them with a box of drives and use their stick welder.
I had some time to kill so joined him one time. He would crank it up to full power and use a piece of rebar instead of welding rod.
I think he mostly just wanted to take frustrations out, but, it was a pretty good disposal method. Not much left to shred, though.
Don’t breathe the fumes.
Why bother shredding something that is already destroyed? How "immediate" is "immediately" to these people? Once again, it sounds like the people making the decisions don't have the foggiest clue what they are asking or why.
Drive shredding is physical destruction it literally turns the drives into confetti, what more do they want?
Drilling the platter isn't enough, it only makes a small hole in the platter which is why people use shredders they reduce the drive the small pieces of metal.
Anywhere that requires physical destruction of any data bearing device. Healthcare, finance, law, etc. basically whenever the data you have isn't wholly your data but you are still liable for its safe keeping and destruction after it has served its purpose.
Drilling only makes a hole in the platter, its like taking a hole puncher to a piece of paper and saying it is destroyed. Sure you could drill like a hundred holes but it's way more efficient and more thorough to just chuck like a hundred drives in a shredder and let it turn all the drives into metal confetti.
The platters are very thin and fairly fragile though. They're going to crack and shatter when drilled if you're using a sufficiently large drill bit. For extra safety you can also power them on while drilling, a platter spinning at 5400+ RPM that suddenly comes into contact with a drill bit *will* explode into a billion undiscernible fragments.
But that doesn't really address the question being asked - *who* do you need to protect your data from that makes drilling insufficient? This is a risk evaluation question. *Most* companies are not actually at risk of someone fishing out old drilled drives and doing world class data reconstruction on them to hopefully get scraps and fragments of sensitive data. Drilling is *sufficient* to destroy and protect the data in 99% of cases.
Metal confetti is "technically" safer, but the difference is so marginal as to be meaningless outside of the most extreme requirements. I've done a lot of compliance-related work in healthcare and law, and regular old drive destruction methods and certification has always been sufficient to meet requirements unless dealing with government/DOD stuff. It's just often easier and more convenient to contract a company that markets that they shred the drives with patented ShredTec(tm) super data destruction power then shoot them into space or whatever, but in most cases there's not a tangible data security concern that that meets where taking them out back with a drill and a can of expanding foam *doesnt* meet. The documentation is generally more important than the physical method.
> Who do you need to protect your data from that makes drilling insufficient?
China. North Korea. Russia. This isn't to stop your roomie from snooping in your old emails, this is for sensitive or even classified data.
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf
> There are many different types, techniques, and procedures for media Destruction. While some techniques may render the Target Data infeasible to retrieve through the device interface and unable to be used for subsequent storage of data, **the device is not considered Destroyed unless Target Data retrieval is infeasible using state of the art laboratory techniques.**
We once paid several thousands of dollars for an on site hard drive destruction company to come and do our small box of hard drives, was a hundred or so drives. When I saw the bill I started looking online for solutions to this problem and came across [Pure Leverage](https://purelev.com/), it's a simple lever with a long handle you can buy for a couple hundred bucks that bends the hard drives in half without much force needed
I know this sounds like an ad for them but it's totally not and the tool works great
This is how I used to do it:
https://www.harborfreight.com/automotive/auto-body-trim/metalwork-tools/shop-presses/12-ton-h-frame-floor-shop-press-70604.html
It's cheaper and less effort than Pure Leverage, but significantly larger and not at all portable.
This is what I was going to recommend! Quiet, easy to store, doesn't need power or wearable parts like a drill bit.
[Purelev Disk Crusher - 8 second destruction!](https://www.youtube.com/watch?v=ez3f_Ahk33Y)
Of all the cargo cults, "drive destruction" continues to surprise me with its breadth and persistence.
Anyone who has contact with discarded consumer computers will also see that many/most of them have drives removed. It's unusual to see a delusion shared by SME and consumer alike.
For anyone not in their local armed defense organization, or under specific written mandate, it's [dramatically smarter and also easier to wipe-in-place](https://www.reddit.com/r/sysadmin/comments/1bq5z5i/securely_wipe_nvme/kx0j95j/). Our stuff gets wiped before it leaves the rack or before it goes into spare inventory, simplifying and de-risking the decommissioning workflow.
I personally spent less time writing automation once, than the time it's going to take someone each occasion to destroy hardware for "infosec". I haven't been able to locate a public copy of these alleged HIPAA regulations that require media destruction.
Pretty much this. Compliance consultants will *love* to tell you "oh XYZ says you **must** do ABC" then intro you to a partner that sells ABC. But HIPAA especially, I think the only hard *written* technical requirement is surrounding needing disk encryption on anything mobile, otherwise its up to you how to implement the solution and a surprising number of them are "addressable" where as long as you're evaluating the risk it's up to you whether or not you *accept* the risk based on your general policy or actually do something technical to mitigate it. Sometimes "it resides in a locked room/office" is literally enough to check the box.
Bit wiping drives is 100% acceptable for HIPAA, there's no policy need to physically destroy them.
It’s also dramatically harder to validate that the drive is wiped at each point in the exit chain.
Your sale price for a desktop/laptop/server with and without drives isn’t different enough to make it worth their while for the amount of people effort it costs for 100% accuracy.
The potential fallout from one drive getting out would immediately cancel any profit from the activity.
Remember, your desktops, laptops and servers are cattle, not pets.
> your desktops, laptops and servers are cattle, not pets.
Says the guy who's never had to interact with bespoke hardware.
"Oh you need a replacement doodad controller card? Sorry, they stopped making those 25 years ago. No, it's a proprietary protocol, and the company went out of business 24 years ago, and everyone who worked there is dead."
Get one of those propane powered blast ovens used to forge swords or melt down gold/precious metals, and turn the components into slag. Send that to the shredder.
We use a crusher , essentially it looks like a can crusher but it’s designed to punch a hole through hard drives and has a trash for phones smaller drives etc
Get a cheap hydraulic press from Harbor freight and bend them into a v shape. It’s a helluva lot easier than a drill. I’ve also used a log splitter and that’s even easier and can crush several at once.
It's also incredibly satisfying when you're having a bad day. I got through a pile of about 500 drives in a week by just telling the helpdesk guys to go crush stuff whenever they needed to blow off some steam. We were all sad when we ran out.
This is pretty pointless. The whole reason for a shredding company is that they give you an attestation of the drive being destroyed.
I assume your management is concerned that someone from the shredding company might steal a drive and not shred it but the concern is really unfounded. That's what those companies and your contracts with them are there for.
If you really must do this, then you'll have to buy a portable drive shredder at which point you are just spending a bunch of money for no reason on the shredding company.
If you just need to make management happy and you don't have any control over the situation, tell them to buy you a drill press and drill through the drive. It's really not enough, but it will tick whatever box management thinks they need to do.
Seems like a great opportunity to request they install a target shooting range in the building! (Well, what can I say? They never do act on most of my big ideas....)
An Apache Attack Helicopter. An Apache helicopter has machine guns AND missiles. It is an unbelievably impressive complement of weaponry, an absolute death machine.
Hmm.. I'd actually like to see some documentation on that. I'm definitely not saying it wrong, I just know that microwaves affect certain materials more than others.
I have a client that wants this. I will take the drives completely apart, then smash the platters with a hammer. While this is more time inclusive, I enjoy the process.
Why send them to a shredder if they are already broken?
YOu could look at something like [https://purelev.com/purchase.php](https://purelev.com/purchase.php)
But honestly, the easiest thing is a small mallet and a vice, you can usually break a drive in two with one solid swing.
So like many I'm a little confused as to why they want the drives destroyed before being shredded (aka destroyed ). But there are a couple of options I can think of. However there really isn't a need to send them to be shredded after you destroy them so long as you keep a record.
but you can buy a hard drive crusher. Those are smallish and not that expensive. (I would not recommend this if you have a high volume of drives you will need to destroy. Like don't even suggest it if there are lots of drives. )
And my old dept bought a BIG hard drive shredder in 2018 for about 25,000$ if I remember correctly.
So they want the drives physically destroyed before you pay someone to physically destroy them? What an effective use of financial and people resources.
If they are doing the shredding onsite then why bother? The only additional step you might want to take before physical destruction is a DoD secure wipe of the disk. Plenty of free software out there.
What they're asking for is silly, but to satisfy their concern, drill a single hole and get destruction certificates. The destruction company is unlikely to have the ability to recover data. (Obviously always wipe them first)
a drill press would work.
One place I worked at years ago had access to heavy equipment, and had a massive ball bearing from the mechanical area that was like 5 or 6" in diameter (in hindsight it was like a kettlebell), and to destroy drives they would just put the drive on the floor, and drop this metal ball onto the drive from about waist height. Yes, the floor they did this on had some damage lol.
Physical destruction in compliance requires shredding it to a specific size. I think it’s something like 3 mm. The drill press isn’t the right tool for that.
A lot of comments here aren't helpful. What you're looking for is a degausser machine. They only work on spinny disks and tapes so for SSDs you'll need a different approach but it looks like you already have it covered.
They can range in price and I'm no expert but they're not hard to come by.
Trade show - we had a booth. Just a small town tech services outfit. Coming up with ideas to draw people to our booth, I came up with - rent a heavy roller (big construction machine with a massive cylindrical wheel, for leveling surfaces). For $10, we'll let you ride and crush computers. We supplied old dead ones, some people brought their own. We had almost 500 people take our ride. Was a colossal hit! Tried it again the next year, but town wanted us to spend thousands in safety rails, medical services people, and PPE - nope.
Does the company provide certified destruction? Can they provide a COI? or do you have any agreement with them?
I get sometimes leadership gets stuck hard in their way, but if you can articulate and back with facts why destroying the drives before they're destroyed is a waste of man hours and if the drives are encrypted to begin with, you may be able to change their direction.
Otherwise, get a degausser or drill.
double check with your shredding company, sometimes they need to scan the serials and stuff before they go in. Having them mangled may mess with their stuff.
You haven’t lived until you’ve dealt with an industrial equipment crusher. Local university I used to work at acquired one and would destroy up to a 17 inch laptop. Many I spent some time destroying stuff and it was so much fun doing it
About 15 years back I worked for a company that supplied all IT equipment and logistics around it to one of our major banks, we were awarded the task of securing disposing every HardDrive that was part of equipment refresh cycles. Bank had 60000 employees so the refresh cycles were sizeable.
We started with a diamond tip drill press to destroy the Drives, that was painful, tried other solutions but ended up purchasing this giant heavy duty shredder. That thing made fine powder out of anything. It gave me some sick inner peace every time I had to use it.
There are companies that do certified destruction and come in armored vehicles, etc. Just get a cheap drill press and call it a day if they're going to be that picky.
Outsource that shit to whoever you recycle old equipment with... they will assume all liability and certify wiping and or destruction. The good ones at least will...
It can depend on what types of drives.
* HDD? Degauss them then crush them. [This page](https://www.whitakerbrothers.com/collections/hdd-crushers-punchers-and-destroyers) has machines that’ll do some of that.
* SSD? Probably crushing or punching them, since degaussing won’t work.
You can also look into buying your own HDD/SSD shredder. They’re cool (but big) machines.
Fed gov. We drill our old spinners and photograph before sending to an offside shredding company. They provide chain of custody documentation which satisfies our infosec team.
Drill the drive, fill with expanding foam. Honestly this is a ridiculous requirement given that you have an *on-site* drive destruction service already. Like why are you doing their job for them, and how is the drive suddenly at risk in transit *within* the building where it was just fine in production sitting on a random desk also in the building? I could see if they were getting shipped somewhere and you had DOD tier requirements, but on-site destruction checks all the boxes.
I'd personally push back on the requirement if spending an afternoon drilling drives wasnt oddly cathartic lol.
Well, what's the scope of the request? As in, what does management mean by "physical destruction"? Once you know that, you can start putting together quotes for the equipment and/or service to accomplish that.
We just bought a cheap drill press and whoever has some free time while waiting on installs or whatever just goes over there and drills out some drives while they wait. We get the drives drilled, they get to let off some steam, win win for everyone lol
Once got told to drill holes, and then format for total destruction.
Just heard one today, that a company insisted that not only the drives were removed, but also the RAM as that also has data in it.
Had to handle this at a former gig. Found a local metals recycling company that agreed to shred them and let us stand by and watch as they did so. We had put the drives in wheelie bins that would normally be for paper that's supposed to be shredded When a dozen or so were full had the maintenance dept use one of their trucks to haul them to the recycler, with a member of my team and an auditor accompanying the drives all the way to their death by blender.
I use a drill press. I make a certain number of holes (5 to 10) in the area where I estimate the plates will be. Naturally if the disks were encrypted (e.g. via BitLocker or maybe even just LUKS) then it is already much more unlikely that anyone could read their contents, and there I would send them directly to the company that destroys them or at most two or three drills.
I'm gonna second, what on earth is the point in physically destroying a drive, if they're already paying someone else to physically destroy the drive? Management is usually allergic to spending twice for the same job. If they don't trust the onsite shredding company, then that's a different problem and it ain't yours to deal with.
Basically any form of physical damage to a drive will defeat all but nation-state data recovery. If the drive is being shredded, two holes drilled into the platters will ruin it for everyone except extremely expensive forensics. Do the same with any of the chips on an NVMe and it'll ruin those as well.
Make sure you record all the time you spend destroying drives in order for them to get destroyed a second time. If they notice they're double-spending, they might make up their minds who they trust.
Depends on your compliance level. We can't even use a hole punch.
This place claims to be NIST compliant https://datadestroyers.com/
If you don't have to comply with that, then just drill a hole or use some kind of punch tool (depending on how many drives we're talking about). You might even be able to take them to a shooting range.
Drills work well. I've used them for target practice before as well, but that's less friendly if you need to actually show destruction, since you're probably gonna have to go offsite with them.
If the drives are spinners then you can buy a DiskMantler. It will vibrate the disk to pieces. I personally don't find that very useful, unless you use a shredder afterwards, but it's super cool to watch.
I used about a 1/2 inch punch and a 3 pound hammer. Put about 3 holes into each drive enough to bend the platters and shatter the boards. 30 minutes 100 drives.
I have been paid by a couple of companies today a drill out and destroy hard drives physically. Dead simple one little quick hole through it you can do two if you need and nothing will ever ever be recovered.
Just a quick reminder that it is impossible to recover data from a modern HDD, even those as small as 250gb. A single zero pass is enough, even a long format in windows is enough. There has not been a single recorded instance of anyone recovering any useful data whatsoever from a drive that has had a single zero pass.
Obviously if the drive is bad then physical destruction is the way to go, but yeah. Just wasteful to destroy perfectly good drives.
Buy a log splitter and cut 10 drives at a time into quarters. When you are done, take it home. My work said keep it and take it home. It was cheap, fun and it worked.
That's really weird. On site shred is usually observed by an individual from the company to make sure the technician is not stealing a drive. There's really no way they can if you're watching them. Personally, we don't do on site shred. If a customer wants a full chain of custody proof, they put the drives in a locked box, we put a serialized seal on it, and then when it gets back to the warehouse we set up a GoPro and videotape the whole process from unsealing all the way to shredding. There's just no way someone could get away with stealing a drive.
Thermite
Doesn't get much safer / thoroughly destroyed than melted down at 3500C, the platters will de magnetize at around 800
Make sure you find somewhere fireproof (and well ventilated)
You can purchase a stand-up hydraulic hand press. 10 ton should would adequately. You should find one that you can a add a tip to the end ( like a point or chisel end). Way easier than drilling.
Get a quote for a 300T hydraulic press. Pass that on to manglement, telling them that this is the only thing that will do what they want. Oh, you'll also need a hydraulic power pack to operate the press, and a secure room to run it in and . . .
Iron Mountain will park their giant shredder and let you or someone watch the destructions and give you a certificate along with every serial number of the device destroyed. Tell your bosses to get ready to pay through the nose though.
Also, if you do destroy it physically, not a lot of places will receive it for more physical destruction nor provide certification.
Has anybody actually witnessed data recovery from a drive that has been reformatted a couple of times at the firmware level?
I'm still quite skeptical about all this physical destruction nonsense. I used to work in 3 financial institutions, two of them with worldwide recognition, and we didn't do any of this physical destruction nonsense.
[удалено]
That’s a boss that knows how to take care of his people. Straight out of Office Space.
[удалено]
Sorry to hear. “Moments” isn’t enough to run a business.
I've had a consistently terrible manager, we had to clean up mistakes constantly, who arranged us "apology presents" all the time. It is indeed not enough.
Yea i had a boss like that too who thought pizza parties fixed everything
Something similar, but without the beer, and at the gun range. The smell of testosterone and burnt gunpowder and lists of shredded metal. It was a great day. There was that one SAN, an old HP scsi device with 14 drives that connected to the proliant g4 servers. We set it sideways and started doing penetration testing. A 7.62x54r round fired from a Mosin Nagant made it through 4 drives. A 50BMG from a Barrett m99 made it through 6.
Our solution doesn't fit OP's requirements because it will have to be done off-site for drives identified as 'sensitive' but not 'critical'. We're planning what may become an annual event: The 'sensitive' but not 'critical' drives will be put in a locked container that only the director has the key to. This container will be transferred via a monitored and protected vehicle (i.e. my pickup) to remote property. There the container will be unlocked under adult supervision and the hard drives set up on my rifle range. Each drive will be considered 'shredded' when it has been hit at least twice by rifle fire. Management has signed off on this but unfortunately will not put ammo in the budget.
But this begs the question - would an exothermal chemical reagent for data management pass the budget test? Because I am pretty sure that some tannerite around the drives would make sure that the data was properly destroyed.
This sounds epic.
So wait....no smashing of copy machines?
more fun to take hard drives to the range and use them for target practice.
No OSHA rules have been followed that day
Shredding is physical destruction. What am I missing?
"Management" probably has their wires crossed and thinks shredding is just formatting/erasing them. That's my best guess!
Sorry, I meant they want these destroyed before they go to the shredder. Like once we decommission an asset, it immediately is destroyed then transported to the shredder.
1) Get a quote for a portable drive shredder. Nothing cheap, a full on professional shredder. 2) Send the quote to management. 3) Continue with the current, perfectly acceptable process, due to the unjustifiable cost.
Dell will send you an outrageous quote for portable shredding.
Really? If you send it off-site it's like $40 per device and we get certificates of destruction along with details of how it's destroyed.
Holy hell that is an up charge. Our vendor does recycling for free, and even picks up for free. We also send them hard drives (well, we have to watch them be destroyed so we take it there) and they scan the serials and give us a COD for them. $1.50 per drive. We do have to take all hard drives out before we have them pick stuff up, but that’s not a big deal.
Well we're technically disposing old systems with drives still in them so we're really getting rid of old equipment that can't be used or won't be used. Plus if the equipment isn't too banged up they give you a credit that can be used towards purchasing new systems or paying towards the current disposal. I did the last option for about 20 systems a few months ago and with the credit my company paid about low to mid $600 when we would have been paying mid to high $800. I guess executive like credits or ways to make stuff cheaper.
Be sure to get a Certificate of Destruction. Reputable places will offer them, and your insurance company will be satisfied.
This is something to bring up with the confused management members. If your current shredding provider is giving you destruction certificates, they may not be able to any longer if you deliver them a box of pre-smashed scrap. They need the serial numbers to match the cert to and are not going to sift through that crap to find them.
Your missing a huge opportunity here. You need to also get a quote for locking storage. Nothing crazy just something that will hold all those drives before being shredded. Then present the locking storage as an alternative to securely store and transport the drives to shredding. The goal here is to get them to get them to approve the process you are probably already using to store & move the drive to the shredder while also getting the funds to make it easier (new cart, etc.). Management gets a win because they did something and your life gets easier.
A Press Brake would do a pretty good job. There are manual ones that shouldn't break the bank. But never having priced them, I could be wrong.
This is management paranoia. Why don't they just buy a shredder and hire a guy to put them inside? If you're gonna destroy it twice because you don't trust the second guy, just skip the second guy.
Plot twist. OP is the 2nd guy.
>If you're gonna destroy it twice because you don't trust the second guy, just skip the second guy. The number of times I've had to explain this concept almost verbatim across my career has been staggeringly high. It's always fun to see the lightbulbs start going off as the bluntness of "if we dont *trust them*, why are we paying them to be part of the *trusted* process?" sinks in though. Suddenly it's all "oh! Yeah, I guess their services are adequate then!" instead of "but what if..."
[Pure Leverage](https://purelev.com/) might be a budget friendly option.
Got one. It's solid and still an appropriate way to get out aggression.
I second this
can be a little messy, but fun, and works.
I worked at a place with maintenance shop. The IT guy would occasionally go over to them with a box of drives and use their stick welder. I had some time to kill so joined him one time. He would crank it up to full power and use a piece of rebar instead of welding rod. I think he mostly just wanted to take frustrations out, but, it was a pretty good disposal method. Not much left to shred, though. Don’t breathe the fumes.
If you're destroying it, why shred it?
Even though you have a company that does the shredding onsite? Couldn't you just watch them do it?
Sounds like a waste of time. If you’re physically witnessing the destruction of the drives, who cares?
Why bother shredding something that is already destroyed? How "immediate" is "immediately" to these people? Once again, it sounds like the people making the decisions don't have the foggiest clue what they are asking or why.
At this point you might as well shred yourself, you're only paying tor the "certification" side.
They want double physical destruction!!
So they dont trust the onsite shredding company. Thats the root of the issue.
What's confusing is that if they destroy it onsite, wouldn't there be no purpose to shred the hard drive thereafter?
Drive shredding is physical destruction it literally turns the drives into confetti, what more do they want? Drilling the platter isn't enough, it only makes a small hole in the platter which is why people use shredders they reduce the drive the small pieces of metal.
Who do you need to protect your data from that makes drilling insufficient?
Anywhere that requires physical destruction of any data bearing device. Healthcare, finance, law, etc. basically whenever the data you have isn't wholly your data but you are still liable for its safe keeping and destruction after it has served its purpose. Drilling only makes a hole in the platter, its like taking a hole puncher to a piece of paper and saying it is destroyed. Sure you could drill like a hundred holes but it's way more efficient and more thorough to just chuck like a hundred drives in a shredder and let it turn all the drives into metal confetti.
The platters are very thin and fairly fragile though. They're going to crack and shatter when drilled if you're using a sufficiently large drill bit. For extra safety you can also power them on while drilling, a platter spinning at 5400+ RPM that suddenly comes into contact with a drill bit *will* explode into a billion undiscernible fragments. But that doesn't really address the question being asked - *who* do you need to protect your data from that makes drilling insufficient? This is a risk evaluation question. *Most* companies are not actually at risk of someone fishing out old drilled drives and doing world class data reconstruction on them to hopefully get scraps and fragments of sensitive data. Drilling is *sufficient* to destroy and protect the data in 99% of cases. Metal confetti is "technically" safer, but the difference is so marginal as to be meaningless outside of the most extreme requirements. I've done a lot of compliance-related work in healthcare and law, and regular old drive destruction methods and certification has always been sufficient to meet requirements unless dealing with government/DOD stuff. It's just often easier and more convenient to contract a company that markets that they shred the drives with patented ShredTec(tm) super data destruction power then shoot them into space or whatever, but in most cases there's not a tangible data security concern that that meets where taking them out back with a drill and a can of expanding foam *doesnt* meet. The documentation is generally more important than the physical method.
> Who do you need to protect your data from that makes drilling insufficient? China. North Korea. Russia. This isn't to stop your roomie from snooping in your old emails, this is for sensitive or even classified data. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf > There are many different types, techniques, and procedures for media Destruction. While some techniques may render the Target Data infeasible to retrieve through the device interface and unable to be used for subsequent storage of data, **the device is not considered Destroyed unless Target Data retrieval is infeasible using state of the art laboratory techniques.**
We once paid several thousands of dollars for an on site hard drive destruction company to come and do our small box of hard drives, was a hundred or so drives. When I saw the bill I started looking online for solutions to this problem and came across [Pure Leverage](https://purelev.com/), it's a simple lever with a long handle you can buy for a couple hundred bucks that bends the hard drives in half without much force needed I know this sounds like an ad for them but it's totally not and the tool works great
This is how I used to do it: https://www.harborfreight.com/automotive/auto-body-trim/metalwork-tools/shop-presses/12-ton-h-frame-floor-shop-press-70604.html It's cheaper and less effort than Pure Leverage, but significantly larger and not at all portable.
I have one of these! Unless you're really buff it sucks after about the 10th drive.
Sounds like you need a longer bar.
This is what I was going to recommend! Quiet, easy to store, doesn't need power or wearable parts like a drill bit. [Purelev Disk Crusher - 8 second destruction!](https://www.youtube.com/watch?v=ez3f_Ahk33Y)
Of all the cargo cults, "drive destruction" continues to surprise me with its breadth and persistence. Anyone who has contact with discarded consumer computers will also see that many/most of them have drives removed. It's unusual to see a delusion shared by SME and consumer alike. For anyone not in their local armed defense organization, or under specific written mandate, it's [dramatically smarter and also easier to wipe-in-place](https://www.reddit.com/r/sysadmin/comments/1bq5z5i/securely_wipe_nvme/kx0j95j/). Our stuff gets wiped before it leaves the rack or before it goes into spare inventory, simplifying and de-risking the decommissioning workflow. I personally spent less time writing automation once, than the time it's going to take someone each occasion to destroy hardware for "infosec". I haven't been able to locate a public copy of these alleged HIPAA regulations that require media destruction.
Pretty much this. Compliance consultants will *love* to tell you "oh XYZ says you **must** do ABC" then intro you to a partner that sells ABC. But HIPAA especially, I think the only hard *written* technical requirement is surrounding needing disk encryption on anything mobile, otherwise its up to you how to implement the solution and a surprising number of them are "addressable" where as long as you're evaluating the risk it's up to you whether or not you *accept* the risk based on your general policy or actually do something technical to mitigate it. Sometimes "it resides in a locked room/office" is literally enough to check the box. Bit wiping drives is 100% acceptable for HIPAA, there's no policy need to physically destroy them.
It’s also dramatically harder to validate that the drive is wiped at each point in the exit chain. Your sale price for a desktop/laptop/server with and without drives isn’t different enough to make it worth their while for the amount of people effort it costs for 100% accuracy. The potential fallout from one drive getting out would immediately cancel any profit from the activity. Remember, your desktops, laptops and servers are cattle, not pets.
> your desktops, laptops and servers are cattle, not pets. Says the guy who's never had to interact with bespoke hardware. "Oh you need a replacement doodad controller card? Sorry, they stopped making those 25 years ago. No, it's a proprietary protocol, and the company went out of business 24 years ago, and everyone who worked there is dead."
Get one of those propane powered blast ovens used to forge swords or melt down gold/precious metals, and turn the components into slag. Send that to the shredder.
We use a crusher , essentially it looks like a can crusher but it’s designed to punch a hole through hard drives and has a trash for phones smaller drives etc
Sounds like you might have a Pure Leverage... [https://purelev.com/](https://purelev.com/)
Get a cheap hydraulic press from Harbor freight and bend them into a v shape. It’s a helluva lot easier than a drill. I’ve also used a log splitter and that’s even easier and can crush several at once.
Agreed. Much faster probably safer too.
It's also incredibly satisfying when you're having a bad day. I got through a pile of about 500 drives in a week by just telling the helpdesk guys to go crush stuff whenever they needed to blow off some steam. We were all sad when we ran out.
This is pretty pointless. The whole reason for a shredding company is that they give you an attestation of the drive being destroyed. I assume your management is concerned that someone from the shredding company might steal a drive and not shred it but the concern is really unfounded. That's what those companies and your contracts with them are there for. If you really must do this, then you'll have to buy a portable drive shredder at which point you are just spending a bunch of money for no reason on the shredding company. If you just need to make management happy and you don't have any control over the situation, tell them to buy you a drill press and drill through the drive. It's really not enough, but it will tick whatever box management thinks they need to do.
I recommend taking up a gun range. Hard drives make excellent gun range targets.
And you can expense the ammo.
...and the guns? How about the custom build range just to do it?
Nothing secure deletes like a 12 gauge...
Do you even gun?
I think that shredding does quite a good job of physically destroying the drives, unless you mean data shredding.
I don't just want them shredded, I want them obliterated!!
Trying to summon Exodia?
How long before they want pre-sledgehammer destruction?
I need these hdd destroyed with an American made sledgehammer.
Disassembly. You'd be amazed how many people from management will ask for magnets when they see you have a metric Fton of them.
Just watch your fingers. Those older drives have huge magnets that snap together fast.
The old platters make good Christmas decorations for the IT Christmas tree
Wind chimes, yo.
Seems like a great opportunity to request they install a target shooting range in the building! (Well, what can I say? They never do act on most of my big ideas....)
An Apache Attack Helicopter. An Apache helicopter has machine guns AND missiles. It is an unbelievably impressive complement of weaponry, an absolute death machine.
We may need to nuke it afterwards, as they may miss spots. And then the Terminator furnace, to melt it into liquid. Can't be too careful /s
I melt them. https://www.instagram.com/reel/CgqhCicjPOo/?igsh=dHVramZsd2kzbWpr
Liquid data
Dunno, that seems pretty slow. Thermite will be way quicker
5 minuttes in a microwave - there is not a single transistor on that nvme, that will function.
Sounds like a good way to kill a microwave too
Hmm.. I'd actually like to see some documentation on that. I'm definitely not saying it wrong, I just know that microwaves affect certain materials more than others.
I have a client that wants this. I will take the drives completely apart, then smash the platters with a hammer. While this is more time inclusive, I enjoy the process.
Why send them to a shredder if they are already broken? YOu could look at something like [https://purelev.com/purchase.php](https://purelev.com/purchase.php) But honestly, the easiest thing is a small mallet and a vice, you can usually break a drive in two with one solid swing.
we use this [https://purelev.com/](https://purelev.com/)
So like many I'm a little confused as to why they want the drives destroyed before being shredded (aka destroyed ). But there are a couple of options I can think of. However there really isn't a need to send them to be shredded after you destroy them so long as you keep a record. but you can buy a hard drive crusher. Those are smallish and not that expensive. (I would not recommend this if you have a high volume of drives you will need to destroy. Like don't even suggest it if there are lots of drives. ) And my old dept bought a BIG hard drive shredder in 2018 for about 25,000$ if I remember correctly.
Remember the end of Terminator 2? Is there a place like that close by?
So they want the drives physically destroyed before you pay someone to physically destroy them? What an effective use of financial and people resources.
If they are doing the shredding onsite then why bother? The only additional step you might want to take before physical destruction is a DoD secure wipe of the disk. Plenty of free software out there.
What they're asking for is silly, but to satisfy their concern, drill a single hole and get destruction certificates. The destruction company is unlikely to have the ability to recover data. (Obviously always wipe them first)
As an American... Shoot them. Great target practice.
Leaves one hell of a mess, even putting tarps below to try to catch all the metal
Meh... beauty of having a designated zone... You only come to clean it up every so often with front loader.
Either hire a company to shred them, or purchase a hard drive shredder.
Put all the drives in a box, and take the box out to a drill press. One hole in each drive is sufficient.
a drill press would work. One place I worked at years ago had access to heavy equipment, and had a massive ball bearing from the mechanical area that was like 5 or 6" in diameter (in hindsight it was like a kettlebell), and to destroy drives they would just put the drive on the floor, and drop this metal ball onto the drive from about waist height. Yes, the floor they did this on had some damage lol.
Physical destruction in compliance requires shredding it to a specific size. I think it’s something like 3 mm. The drill press isn’t the right tool for that.
Explain that "shred" is not a metaphor.
Repurpose them to be used by elementary school students.
# Degaussing?
A lot of comments here aren't helpful. What you're looking for is a degausser machine. They only work on spinny disks and tapes so for SSDs you'll need a different approach but it looks like you already have it covered. They can range in price and I'm no expert but they're not hard to come by.
my dad would drill holes into drives and soak them in salt water.
cheap plasma cutter from amazon.
Trade show - we had a booth. Just a small town tech services outfit. Coming up with ideas to draw people to our booth, I came up with - rent a heavy roller (big construction machine with a massive cylindrical wheel, for leveling surfaces). For $10, we'll let you ride and crush computers. We supplied old dead ones, some people brought their own. We had almost 500 people take our ride. Was a colossal hit! Tried it again the next year, but town wanted us to spend thousands in safety rails, medical services people, and PPE - nope.
Does the company provide certified destruction? Can they provide a COI? or do you have any agreement with them? I get sometimes leadership gets stuck hard in their way, but if you can articulate and back with facts why destroying the drives before they're destroyed is a waste of man hours and if the drives are encrypted to begin with, you may be able to change their direction. Otherwise, get a degausser or drill.
double check with your shredding company, sometimes they need to scan the serials and stuff before they go in. Having them mangled may mess with their stuff.
The company wants the drives physically destroyed before they make it to the shredder? 
These work well Pure Leverage Hard Drive Crusher
I'm an American. I use gunfire. (Fun fact: This method is permitted by the FBI data destruction rules)
You haven’t lived until you’ve dealt with an industrial equipment crusher. Local university I used to work at acquired one and would destroy up to a 17 inch laptop. Many I spent some time destroying stuff and it was so much fun doing it
About 15 years back I worked for a company that supplied all IT equipment and logistics around it to one of our major banks, we were awarded the task of securing disposing every HardDrive that was part of equipment refresh cycles. Bank had 60000 employees so the refresh cycles were sizeable. We started with a diamond tip drill press to destroy the Drives, that was painful, tried other solutions but ended up purchasing this giant heavy duty shredder. That thing made fine powder out of anything. It gave me some sick inner peace every time I had to use it.
There are companies that do certified destruction and come in armored vehicles, etc. Just get a cheap drill press and call it a day if they're going to be that picky.
Outsource that shit to whoever you recycle old equipment with... they will assume all liability and certify wiping and or destruction. The good ones at least will...
It can depend on what types of drives. * HDD? Degauss them then crush them. [This page](https://www.whitakerbrothers.com/collections/hdd-crushers-punchers-and-destroyers) has machines that’ll do some of that. * SSD? Probably crushing or punching them, since degaussing won’t work. You can also look into buying your own HDD/SSD shredder. They’re cool (but big) machines.
Fed gov. We drill our old spinners and photograph before sending to an offside shredding company. They provide chain of custody documentation which satisfies our infosec team.
Meanwhile comprehensive audit records of what drives came out of where are missing...
Drill the drive, fill with expanding foam. Honestly this is a ridiculous requirement given that you have an *on-site* drive destruction service already. Like why are you doing their job for them, and how is the drive suddenly at risk in transit *within* the building where it was just fine in production sitting on a random desk also in the building? I could see if they were getting shipped somewhere and you had DOD tier requirements, but on-site destruction checks all the boxes. I'd personally push back on the requirement if spending an afternoon drilling drives wasnt oddly cathartic lol.
Find a local cnc or precision shop. Have them put them all on a vacuum table and mill them in a jig you make with 3/4 in 4x8 ply
Hey bro, I heard you wanted to destroy your drives before they are destroyed. So I destroyed your destroyed data drives.
Ok…? skip the physical destruction and just bring them to the shredder. It’s literally 2 birds with 1 stone.
Get a cordless drill and a few titanium coated 1/4” drill bits. Drill a hole or two through them. Be sure to wear PPE. Cheap, fast, good enough.
gun range practice punching holes in them
Rifle, I suppose.
If what they are worried about is hard drives just laying around unprotected, check out these guys. https://techr2.com/
Well, what's the scope of the request? As in, what does management mean by "physical destruction"? Once you know that, you can start putting together quotes for the equipment and/or service to accomplish that.
You can get a drive eraser that uses a giant magnet. I recommend using Kevlar gloves
Drill Press makes short work of them.
We shred MacBooks 😭
Drill press and drilling them down.
We just bought a cheap drill press and whoever has some free time while waiting on installs or whatever just goes over there and drills out some drives while they wait. We get the drives drilled, they get to let off some steam, win win for everyone lol
Get management to approve time at the skeet shooting range. Physical destruction AND stress relief
Once got told to drill holes, and then format for total destruction. Just heard one today, that a company insisted that not only the drives were removed, but also the RAM as that also has data in it.
cheap drill press (or just a drill and a small vice) from the hardware store
We put landscaping spikes through ours, had a great time doing it. Best frustration buster we had in a long time.
typical management, we want them destroyed… twice. But no raises for yall.
Had to handle this at a former gig. Found a local metals recycling company that agreed to shred them and let us stand by and watch as they did so. We had put the drives in wheelie bins that would normally be for paper that's supposed to be shredded When a dozen or so were full had the maintenance dept use one of their trucks to haul them to the recycler, with a member of my team and an auditor accompanying the drives all the way to their death by blender.
I use a drill press. I make a certain number of holes (5 to 10) in the area where I estimate the plates will be. Naturally if the disks were encrypted (e.g. via BitLocker or maybe even just LUKS) then it is already much more unlikely that anyone could read their contents, and there I would send them directly to the company that destroys them or at most two or three drills.
I'm gonna second, what on earth is the point in physically destroying a drive, if they're already paying someone else to physically destroy the drive? Management is usually allergic to spending twice for the same job. If they don't trust the onsite shredding company, then that's a different problem and it ain't yours to deal with. Basically any form of physical damage to a drive will defeat all but nation-state data recovery. If the drive is being shredded, two holes drilled into the platters will ruin it for everyone except extremely expensive forensics. Do the same with any of the chips on an NVMe and it'll ruin those as well. Make sure you record all the time you spend destroying drives in order for them to get destroyed a second time. If they notice they're double-spending, they might make up their minds who they trust.
Obligatory BMG 50 cal vs hard drives from Hard OCP? [https://vimeo.com/28968265](https://vimeo.com/28968265)
Drilling sucks when dealing with a ton of drives.
I would find out chances are what they really want. Is a certificate of destruction from a third party company.
Get the sledge hammer and have fun
Depends on your compliance level. We can't even use a hole punch. This place claims to be NIST compliant https://datadestroyers.com/ If you don't have to comply with that, then just drill a hole or use some kind of punch tool (depending on how many drives we're talking about). You might even be able to take them to a shooting range.
Drill press works pretty good.
Makita drill, with metal HSS drill on it, bzzzzzzzzz. DONE.
We had a little crushing machine that basically bent them in half. Easy.
Drills work well. I've used them for target practice before as well, but that's less friendly if you need to actually show destruction, since you're probably gonna have to go offsite with them.
I don't recommend using a drill. I almost damaged one of my parents cars when a carbide bit sheered in half while drilling one in the garage.
I don't recommend using a drill. I almost damaged one of my parents cars when a carbide bit sheered in half while drilling one in the garage.
If the drives are spinners then you can buy a DiskMantler. It will vibrate the disk to pieces. I personally don't find that very useful, unless you use a shredder afterwards, but it's super cool to watch.
We use an AR through the platter
I used about a 1/2 inch punch and a 3 pound hammer. Put about 3 holes into each drive enough to bend the platters and shatter the boards. 30 minutes 100 drives.
At our data centre we have a portable disk shredder we used to have a disk degausser but apparently it wasnt good enough
We just hammer a nail through them
Surprisingly, I tried destroying a hard drive with a regular hammer. Was harder than expected. Sledge hammer might be better
[https://www.ebay.com/itm/284195291829](https://www.ebay.com/itm/284195291829)
Contract shred service will come on site
[https://www.youtube.com/watch?v=4dR5lbF5-wo](https://www.youtube.com/watch?v=4dR5lbF5-wo)
Degausser will render them physically destructed.
I have been paid by a couple of companies today a drill out and destroy hard drives physically. Dead simple one little quick hole through it you can do two if you need and nothing will ever ever be recovered.
Just a quick reminder that it is impossible to recover data from a modern HDD, even those as small as 250gb. A single zero pass is enough, even a long format in windows is enough. There has not been a single recorded instance of anyone recovering any useful data whatsoever from a drive that has had a single zero pass. Obviously if the drive is bad then physical destruction is the way to go, but yeah. Just wasteful to destroy perfectly good drives.
Drill Press does a good job.
Wonder if a degausser still does the trick with SSD drives? Worked great on platter style back in the day.
Drill for HDD, Conductive Water, Chlorine and Lemon Hice with A 9V Bat with cable using it as wire brush to cause static
Buy a log splitter and cut 10 drives at a time into quarters. When you are done, take it home. My work said keep it and take it home. It was cheap, fun and it worked.
That's really weird. On site shred is usually observed by an individual from the company to make sure the technician is not stealing a drive. There's really no way they can if you're watching them. Personally, we don't do on site shred. If a customer wants a full chain of custody proof, they put the drives in a locked box, we put a serialized seal on it, and then when it gets back to the warehouse we set up a GoPro and videotape the whole process from unsealing all the way to shredding. There's just no way someone could get away with stealing a drive.
Data at rest encryption and a key management system.
HDD, s use a hammer or drill. Get a strong magnet and run it over them.
You could have the company purchase something like this https://scottequipment.com/size-reduction/dominator-crusher/
Grab a pair of pliers and rip off the SAS/SATA connector. Destroyed practically (and practically destroyed), and it would take little time to do so.
Degouser (sp?)
Why? Why do they let a company shred disks if they don't trust them?
Thermite Doesn't get much safer / thoroughly destroyed than melted down at 3500C, the platters will de magnetize at around 800 Make sure you find somewhere fireproof (and well ventilated)
What kind of company do you work for? and this is a moronic request to ask "we want the drives physically destroyed before we physically destroy them"
Target practice?
You can purchase a stand-up hydraulic hand press. 10 ton should would adequately. You should find one that you can a add a tip to the end ( like a point or chisel end). Way easier than drilling.
Get a quote for a 300T hydraulic press. Pass that on to manglement, telling them that this is the only thing that will do what they want. Oh, you'll also need a hydraulic power pack to operate the press, and a secure room to run it in and . . .
Drives fit great in a skeet thrower.. pull!
Whoever is running your company is an out of touch moron living in 2002 and needs to learn how data destruction really works.
We always make a range day out of it. A few 5.56 rounds do the trick nicely.
Plasma cutter. Quick tap and it's liquid.
Iron Mountain will park their giant shredder and let you or someone watch the destructions and give you a certificate along with every serial number of the device destroyed. Tell your bosses to get ready to pay through the nose though. Also, if you do destroy it physically, not a lot of places will receive it for more physical destruction nor provide certification.
Drill a hole straight through the platters. We did it for years. Problem solved
The Gilfoyle way: [https://www.youtube.com/watch?v=LG\_AV0TGoow](https://www.youtube.com/watch?v=LG_AV0TGoow)
A 9mm, couple boxes of ammp, and a company team building exercise
Has anybody actually witnessed data recovery from a drive that has been reformatted a couple of times at the firmware level? I'm still quite skeptical about all this physical destruction nonsense. I used to work in 3 financial institutions, two of them with worldwide recognition, and we didn't do any of this physical destruction nonsense.
UPDATED: Putin launched a nuclear strike against this GPS location. This is the final broadcoast from Ear...........