Uncontrolled data growth has resulted in policies regarding data storage and retention. But when data backups are deleted in your business, are they really gone? In this FAQ, Executive Editor and Independent Backup Expert W. Curtis Preston discusses data destruction in backup environments. Curtis takes a closer look at the approaches to destruction, regulations and policies regarding destruction and options for outsourcing this policy.
Table of contents:
>> Can you explain the difference between data destruction and data deletion?
>> Can you outline some of the ways that data destruction is accomplished?
>> Do you need to set different destruction policies for local and remote data?
>> Are there specific regulations that regard data destruction?
>> Are there outsourcing options for data destruction?
Data deletion is simply making the data no longer visible to the application or end user. Depending on the technology in question, the data can be really easy to get back, sometimes even from the end user. Or, it can still be possible, but it requires an expert to get the data back. Data destruction is basically making the data completely unreadable, even if you were to hand that disk over to a professional that does it for a living.
There are a number of ways, but it depends on the degree to which that you're trying to destroy it. From a software basis, there are programs that will overwrite deleted data. They'll actually go and find the bits that have been deleted and then continuously overwrite that data with repeated ones and 0s.
Then there's the concept of degaussing, which only works if you have a tape or a disk drive that you want to make every bit of information unreadable. Degaussing just bombards this unit with a significantly strong magnetic field causing all of the bits on the disk or the tape to be aligned a certain way, causing the data to all be wiped out.
Different tapes, different tape types and different disk drives require a degaussing unit of different strengths to make it happen. So you can't take a degaussing unit that was designed to degauss a DAT drive and put it next to a large disk drive and expect it to do the job. You need to find out from that vendor what strengths of the degaussing system that it needs to degauss the system.
Finally, there's physical destruction, which is simply the electronic equivalent of a wood chipper. The federal government does all of the above. They delete the data, they overwrite the data, they then degauss the data, pass the data through a disk chipper and then they take the remaining bits, which are just a pile of rubble, and they smelt them.
Not necessarily, it's actually more about the different data types that need to be destroyed. Using the example of personal data, if you've got pictures that you want to destroy, and if the worst that could happen is that someone finds a goofy picture of you drunk at a party a few years ago, that's one thing. But if you've got your tax records from seven years ago and you want to make sure that no one gets that information -- it's more about the types of information than it is about where they reside that determines what the data destruction policy should be.
It's not so much that they require data destruction as they require you to do what you can to make sure that no one reads the data. One of the data destruction methods that I forgot to mention is that you can encrypt it in the first place when you initially store the data on the system. Then data destruction can simply take the form of deleting the keys to the data.
Now the data is encrypted and inaccessible, and is considered destroyed by a number of regulations. If you look at regulations like HIPAA that say if you store patient data electronically, you need to make sure that the wrong people don't see that data. That goes to the end of the line where if you happen to store patient data on a computer, then you're going to throw that computer away or destroy it. The data on that drive needs to be erased and needs to be erased more than by simply deleting the data, it needs to be destroyed. So it's not so much that the regulation requires destruction, it's that the only way to fully follow the interpretation of the regulation is to use destruction techniques.
Cost is the last thing that should be on your mind when you're considering data destruction, it's a really a risk factor. So the short is answer is yes, there are services, such as Iron Mountain and other companies like them. You can hand them tapes and tape drives and they will then degauss them, shred them and turn them into a big pile of rubble and then give you a certificate of destruction.
It is my favorite method of destruction because if you do it any other way, you're going to have to go and buy one of those tape shredding devices. Given the amount of shredding people are doing, outsourcing it is probably the best option. Then you have documented proof that certain data was destroyed for anyone who asks if you followed with HIPAA regulations or for electronic discovery.
W. Curtis Preston (a.k.a. "Mr. Backup"), Executive Editor and Independent Backup Expert, has been singularly focused on data backup and recovery for more than 15 years. From starting as a backup admin at a $35 billion dollar credit card company to being one of the most sought-after consultants, writers and speakers in this space, it's hard to find someone more focused on recovering lost data. He is the webmaster of BackupCentral.com, the author of hundreds of articles, and the books "Backup and Recovery" and "Using SANs and NAS."