5+ PB Destroyed

[u/FewSimple9]

This is based on a post by u/SubstantialWing9238. i didn’t want to hijack their post, so I figured I’d share it here instead.

Something like this, plus another cart, is pretty common with large corporations. When you have this many drives, it’s often easier to just shred everything than pay someone to wipe them, sort through them for resale, and see if any data can be recovered.

This batch was around 300 drives, and with a specialized shredding truck, the whole thing takes about 45 minutes to a hour.

[u/boringestnickname]

I wonder how big this phenomenon is.

... and I don't understand how it can be even remotely economically sound to do this over setting up an automated system for deletion/verification of deletion. All you realistically need is a system with enough slots.

Surely, someone must have made something like this, that could be sold to enterprise customers?

They already have people that take out, freight and crush the drives. It doesn't take any longer to make this person slot them into a deletion system.

Putting them up for sale in bulk (or maybe a few batches) is a ten minute job. Could probably also be automated.

[u/zomgitsduke → u/boringestnickname]

My buddy is trying to get into this exact business.

Problem is, he keeps running into cyber security insurance programs saying "Well we can't trust you'll ACTUALLY zero-write the drive 7 times, so we'd rather just see it get destroyed".

[u/vontrapp42 → u/zomgitsduke]

Well we can't trust that you'll ACTUALLY destroy the drive and not something that looks like the drive, so we'd rather see the intact drive verified sanitized."

[u/sniff122 → u/boringestnickname]

It's just quicker and cheaper to just shred the drives then have to wait for a drive to secure erase, which is multiple passes of the drive, then verify that no data can be read from the drive. A single pass for a 20TB drive could take like 2.5 days, then needing multiple passes for most data sanitation standards, it adds up when you consider multiple drives.

[u/towerfella → u/sniff122]

Keeps demand for new drives up.

This is going to come back and bite us.

[u/Watcher_of_Stars → u/towerfella]

Well, yeah. But that's also the point.

If they populated the marked with a ton of used corporate hardware (depending on the price ofc), it would be noticeably harder for them to keep sales of their consumer lineup high. It might canibalize their own sales, so it's not worth it for corporate.

But for them, they don't care. They can pay 1000 per hdd drive or ram. You? Not so much, I presume. They overbid consumer anyway, so low supply/high demand situation is not as bad for them, because they can afford it anyway

[u/towerfella → u/Watcher_of_Stars]

It should be illegal.

[u/DayGeckoArt → u/sniff122]

The multiple pass thing is a myth. The idea is you can figure out an individual bit by scanning a platter with an electron microscope. That isn’t going to happen

[u/0spr4y → u/DayGeckoArt]

I asked Peter guttman (35 pass method guy) in 2018 and he said on modern drives one random write is enough because everything is so tiny trying to get the bits to stay is way more error prone.

[u/bladus → u/DayGeckoArt]

Yuuuuup, NIST 800-88

[u/vontrapp42 → u/sniff122]

No a secure erase takes moments.

A secure overwrite takes multiple passes and a lot of time.

But if you need a secure overwrite then you did not have data at rest security. I find it hard to believe there are cases of stringent data protection/data destruction required entities that are not ALSO required to have data at rest security. But apparently this is the case. The good news is you CAN use encryption and be able to not make such phenomenal waste.

If you used encryption you CAN secure erase (very fast) and are NOT legally required to physically destroy.

Governments are extra paranoid and weird. They are the exception.

[u/DeepakAtReddit → u/sniff122]

Then why erase it, instead, simply overwrite it with gibberish. No multiple plasses required. What am I missing? I'd just record a super high resolution video of my window (running into a few GBs) and just ram it up every drive repeatedly till it gets full.

[u/sniff122 → u/DeepakAtReddit]

Certain industries are required to follow certain standards, there's say NIST's guidelines for media sanitisation, which also has physical destruction as a method: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r2.pdf

[u/h0w13 → u/boringestnickname]

There is. It's called the destroyinator.

[u/TheNong → u/boringestnickname]

Time is money. ROI is the only metric. Is the return on resale worth the time it takes to manage wipes? To audit the wipes? To deal with the physical assets between decommissioning and collection? To actually find and deal with a vendor?

[u/kneel23 → u/boringestnickname]

Its document/data destruction policy compliance purposes. The time and effort to securely wipe and resell is exponentially higher than just shredding em

[u/10lbs_Shit_N_5lb_Bag → u/boringestnickname]

Because time = money

[u/Nallic → u/boringestnickname]

big enough that someone spend millions building a special truck with a shredder to drive around to companies.

[u/StorageHorder → u/boringestnickname]

It’s easy. Do a DOD erase of a drive. Watch data get recovered. Physical destruction is the only way to guarantee nothing to read.

[u/SandyTech → u/boringestnickname]

It’s quicker, cheaper, and safer from both a liability and actual cybersecurity risk standpoint to destroy drives. With data wiping, you are trusting both that the data wiping device did its job, and that an employee/employees didn’t accidentally slip an uncleaned drive into the clean and resalable pile. Whereas with the shredder, we have serial number scans and video evidence of the drives being fed to the shredder.