What is Data Destruction?

Data Destruction is defined in a variety of ways by technical publications and industry leaders. However, the term 'Data Destruction' is often used instead of Data Sanitization and it may be difficult to determine which definition is correct.

Along with phrases such as physical destruction, Data Erasure (a software-based override method, which completely destroys all data on the hard drive) and simple actions to ensure data is not recoverable. In the meantime, clarifying these terms is extremely necessary.

Defining Data Destruction

TechTarget defines Data Destruction as a process of destroying data stored on tapes, hard disks and other types of electronic media, so that it cannot be read, accessed or used for unauthorized purposes.

However, if you continue reading, there are a few things to keep in mind. Although the operating system and data creation applications no longer have easy access to read them, the data can still be accessed by other means. There are data recovery and reconstruction services that do just that.

To completely eliminate data, you need to do more things. This is where Data Erasure and Data Sanitization came into being.

What is not Data destruction?

Data Destruction is not the same as Data Sanitization

Unlike Data Sanitization, Data Destruction does not include verification. This means that the Data Destruction method used has not been proven to remove the targeted information, whether it is a file or an entire drive.

Here are two examples that show why this is important:

When trying to remove individual files, many Data Destruction methods simply delete the pointers to a certain file, instead of the file itself. The data remains on the device, although it is not easy for the operating system or applications that have created the file to access it. In other cases, the File Shredding technique may overwrite the file, but it is not clear whether the overwriting process will succeed.

1. Distinguish Delete and Erase, wipe and shred

When trying to erase all the data on a device (in case you might want to reuse, sell or give away the device), even a full reformatting process can leave the data. This information can often be recovered via keyboard methods or the help of forensic tools.

How much data is left over and how easy it is to access it, depending on the media and the Data Destruction method used. In both cases, the Data Destruction process has not been verified making the data vulnerable to attack. The level of risk you take depends on the value or confidentiality of your data, as well as the level of data protection required by industry regulations.

Data Destruction is not the same as physical destruction

Note that understanding Data Destruction is not the same as destroying media where the data stored on it (physical destruction) is also important.

Physical destruction is the process of making a device completely unusable. Physical destruction can involve crushing hard drives, smartphones, printers, laptops, and other storage media into small pieces with a large mechanical shredder. This may also involve the process of rearranging magnetic fields on the HDD, using the demagnetizer. Besides there are also other methods.

The process of physical destruction can actually destroy a lot of data. However, a device has been physically destroyed, no guarantee that all data on it has been discarded.

This is especially true when it comes to newer, flash-based technologies like SSDs, where data is stored so dense that it can remain intact in debris.

That also applies to HDDs. For example, with hard drive demagnetization, proper procedures must always be followed and the demagnetization force must be strong enough to handle the hard drive that you want to destroy. Otherwise, the data may be completely unaffected. Moreover, if demagnetization is applied to non-magnetic drives (SSDs), the data is completely unaffected.

These vulnerabilities mean that physical destruction alone will not be enough to ensure that data cannot be recovered. The verification part of any Data Destruction process cannot be ignored.

Don't be limited by Data Destruction, make sure the data is gone completely!

So how do you make sure the data is completely erased from the device? Your organization should not be limited to Data Destruction. Focus on Data Sanitization instead.

Data Sanitization does more than Data Destruction. Validation of the Data Destruction process takes place using recognized verification methods and generates a certified, counterfeit report. A 'clean' device or file has been shown to render the target data unrecoverable. For very sensitive data, Sanitization is a very important step to minimize the risk of data being illegally accessed. For highly regulated industries, Data Sanitization is often required to protect and comply with data privacy.

There are 3 methods to achieve Data sanitization: Physical destruction (with verification), Cryptographic Erasure (erase the encryption key of the self-encrypting drive and the encryption algorithm must be at least 128 bits for the process to succeed ) and Data Erasure (a software-based rewrite method that completely destroys all data on the hard drive). Every method works. The method (s) you select must be based on equipment to eliminate data, industry directives, compliance with data protection regulations and risk tolerance. Many organizations choose to use all three methods, separately or in combination.

Learn more about Data Sanitization methods and determine which method is best suited for your business.

If you're considering which Data Sanitization standards to follow, the best reference is 'Data Sanitization in the Modern Age: DoD or NIST?' provides a quick overview of the two most famous standards from the Department of Defense (DoD), as well as the National Institute of Standards and Technology (United States), available at:

 https://www.blancco.com/resources/bp-data-sanitization-in-the-modern-age-dod-or-nist/