Journal of Digital Forensics, Security and Law Volume 15 Number 1 Article 2 June 2020 An Evaluation Of Data Erasing Tools Andrew Jones University of Suffolk, [email protected] Isaac Afrifa University of Hertfordshire, [email protected] Follow this and additional works at: https://commons.erau.edu/jdfsl Part of the Computer Law Commons, and the Information Security Commons Recommended Citation Jones, Andrew and Afrifa, Isaac (2020) "An Evaluation Of Data Erasing Tools," Journal of Digital Forensics, Security and Law: Vol. 15 : No. 1 , Article 2. DOI: https://doi.org/10.15394/jdfsl.2020.1615 Available at: https://commons.erau.edu/jdfsl/vol15/iss1/2 This Article is brought to you for free and open access by the Journals at Scholarly Commons. It has been accepted for inclusion in Journal of Digital Forensics, Security and Law by an authorized administrator of (c)ADFSL Scholarly Commons. For more information, please contact [email protected]. Data Erasing Tools JDFSL V15N1 AN EVALUATION OF DATA ERASING TOOLS Isaac Afrifa1, Andrew Jones2 1 2Cyber Security Center, University of Hertfordshire 2Cyber Security CRC, Edith Cowan University [email protected] [email protected] ABSTRACT The permanent removal of data from media is a major area of concern mainly because of the misconception that once a file is deleted or storage media is formatted, it cannot be recovered. There has been the development of both commercial and freeware data erasing tools, which all claim complete file or disk erasure. This report analyzes the efficiency of a number of these tools in performing erasures on an electromechanical drive. It focuses on a selection of popular and modern erasing tools, taking into consideration their usability, claimed erasing standards, and whether they perform complete data erasure with the use of the Write Zero method. Keywords: Data wiping, Write Zero, Data Erasing Tools 1. INTRODUCTION In another fairly recent incident, the Mir- ror (2017) also reported a massive data loss threat that involved a USB stick, which was Data in the 21st century has become an found in the streets of London, containing epitome of controversy due to the count- highly confidential information belonging to less occurrences of crimes associated with Heathrow Airport. The drive consisted of 76 data breaches and data loss. Most physi- unencrypted folders, which included precise cal drives that are used to store either cor- routes Her Majesty the Queen uses in the air- porate or personal data usually end up be- port, maps showing the tunnel networks and ing sold when they are no longer required, escape shafts linked to the Heathrow Express, stolen, or lost. Examples include a report by and many more. These pieces of information, Historycoalition.org (2009), that the US in the wrong hands, can be used in malicious National Archives and Records Administra- attacks. tion (NARA) reported the loss of an external hard drive from the NARA College Park fa- A significant question that is related to cility in Maryland. This hard drive contained data removal is, “Can data be completely copies of sensitive personal information such erased if no longer required?” The perception as names and social security numbers of indi- that non-technical individuals tend to have is viduals who may have worked or visited the that once a file is deleted from the recycle bin White House during Clinton’s Presidency. or a drive is formatted, and the data cannot c 2020 JDFSL Page 1 JDFSL V15N1 Data Erasing Tools be recovered. However, when the Recycle items are lost every second (Drolet, 2019). bin or Trash folder is emptied, the operating Corporate organizations are spending mil- system only removes pointers to the deleted lions of pounds to avoid data breaches and data. The information remains on the hard losses. The general public also had their fair disk until another file overwrites it. With the share of data loss due to the general lack of formatting of drives, if the ‘quick’ format is knowledge in relation to media sanitization. used, data is not removed as formatting only It is therefore essential to address the prob- reinitializes the file system of the drive, as lem of data erasure and help identify the best explained by Rothke (2009). Even with new and most easily accessible tools for media overwrites, some of the data might still be sanitization associated with storage devices recovered. This misconception has led to nu- notably hard drives, as they are considered as merous data breaches and loss of confidential one of the most commonly used primary stor- information to identity thieves and hackers. age devices to store confidential and sensitive The aim of this research was to examine information (Valli and Jones, 2005). some of the most popular and easily acces- sible data erasing tools and evaluate their 1.2 Project Phases efficiency based on their performance and The project started in February 2019 and ability to completely erase drives with the was carried out in 5 phases: Write Zero wiping method. The reasons for carrying out this study were that it had been • Literature review. This phase includes some time since a comparative study was car- an investigation of past and recent pa- ried out, and in the intervening period, new pers that relate to erasing of data on tools have become available and existing tools storage media devices, the known data have been updated. In view of this, standard erasing standards, and other notable top- experiments were conducted on an electrome- ics associated with data erasing; chanical hard disk using 8 data erasing tools, namely, Hard Wipe, Eraser, Macrorit Data • Research of Erasing Tools. This phase Wiper, Active KillDisk, Disk Wipe, Puran involves the study and investigation into Wipe Disk, Remo Drive Wipe, and Super free versions of data erasing tools that File Shredder. Solid state drives were not have the Write Zero method as one of the included in this research because, with the supported erasing standards. As a result, wear leveling algorithms that are in use and 8 tools were acquired and installed; the current state of the art, there is no scien- tifically proven method that can be used to • Creation of dataset for evaluation. This ascertain that all sectors of the storage me- phase consisted of the acquisition of dia have been accessed and overwritten. This different file types that were used as issue will be examined in future research. datasets for the research; 1.1 Motivation • Experimentation and Analysis. This With the surge in data related crimes, orga- phase involved the testing of all the nizations and individuals are investing heav- selected erasing tools and also exam- ily in keeping data safe and secure from un- ines their wiped disk images to enable wanted parties. Studies show that almost 5 the analysis of the results and included, million data items are reported missing or where relevant, an attempt to recover stolen worldwide every day, which implies 58 deleted data; Page 2 c 2020 JDFSL Data Erasing Tools JDFSL V15N1 • Conclusion and Recommendations. In paper printouts, and Electronic or Soft Copy, this phase, the results of the analysis and which include hard drives, Random Access evaluation of the selected erasing tools Memory (RAM), Compact and Floppy Disks are documented. Recommendations of etc. The document further explained the dif- the top performing tools are also made ferent types of sanitization. It grouped sani- during this phase of the project. tization into four types, namely, Discarding, Clearing, Purging, and Destroying. Discard- ing involves getting rid of media without any 2. RELATED WORK sanitization method. The digital forensics area has witnessed a Discarding has consequences as reported plethora of contributions confirming and dis- in a news article by BBC (2019), where the proving major data concepts, and data era- medical records of patients, which had sen- sure is not an exception. Data storage has sitive information such as bank and contact immensely improved from the days of mag- details were found in an abandoned nursing netic tapes and floppy disks to the more cur- home in Hampshire. The second type of rent forms of storage devices such as flash sanitization, Clearing, entails high levels of drives, electromechanical hard drives, Solid- data destruction, which include overwriting State Drives (SSDs), and cloud storage. Most using hardware or software tools. Purging forms of storage, at the end of their lifecycles, is similar to Clearing and includes methods are sold, donated, or destroyed. such as Secure Erase and Degaussing. Lastly, Sahri et al. (2018) argued how fragile soft- destroying as the name implies involves physi- ware and hardware involved in data storage cally destroying media by shredding, melting, could be and estimated the lifespan to be disintegration etc. about five years. Other reports on the life Countless data wiping techniques, in the expectancy of data storage devices were pro- form of software or hardware, have been vided by (Brook, 2017), which highlighted adopted to aid in data erasure from storage that the lifespan of such devices depends on media devices. Companies and individuals a number of factors, including usage rates, tend to purchase or freely download eras- environmental factors, and manufacturing. ing tools to remove data on storage devices. In addition, (Brook, 2017) provided an esti- Sansurooah et al. (2013) revealed that the mated life expectancy for hard disks to be licensing of such data erasing tools, whether 3 to 5 years and flash storage devices to be freely available or commercial based, does not 5 to 10 years, depending on the number of reflect on their data wiping efficiency and fur- write cycles, meaning the more you delete ther recommended some free and commercial and write new data on the devices, the faster tools for secure data removal.