The Issue of Data Persistence

Devices connected to your corporate network may contain data believed to have been deleted. If the data that unknowingly remains is sensitive, its unauthorized exposure can put you at risk. This exposure can jeopardize the reputation of your business and risk incurring financial and other consequences from violating industry and federal data protection regulations.

The risk of unknowingly leaving sensitive data without adequate protection is ample reason to use certified hard drive erasure software. Without software that verifies and certifies the erasure, there’s a good chance you could experience data persistence—also known as data remanence—a situation where data persists, or remains on the drive.

Vivian Cullipher Vivian is a career writer and editor, having covered technology-related topics for government and B2B organizations since before LinkedIn and the iPhone. As Blancco’s head of content, she oversees the development of thought-leadership-based copy for web, social media, and other Blancco communication channels.

The difference between deleting and erasing

Deleting data in Windows/Linux/Apple operating systems leaves data behind. When referring to the default deletion functions of most operating systems, “deleting” only means removing the pointers to the data, not necessarily the data itself.

Even with more rigorous approaches to destroying data, remnants of information may still exist on hard drives in the form of zeros and ones—leaving sensitive information vulnerable to recovery.

Software-based sanitization tools are needed to truly overwrite data across all areas of the drive to ensure information is gone. This is especially important when

• disk drives have developed unusable tracks, which are inaccessible via traditional means of deleting data
• data is stored in the cloud, such as within Software as a Service (SaaS), Platform as a Service (PaaS), or Infrastructure as a Service (IaaS) systems, which unauthorized parties may be able to access

What is data persistence (or data remanence)?

Data remanence is when, even after you’ve deleted files or reformatted data storage devices, there are still residual bits of information left over. Fragments of information can be pieced together by advanced hacking methods, allowing cyber criminals to potentially retrieve sensitive data. File deletion, reformatting, and storage media that allow for previously written information to be recovered do not fully protect your data.

Even if you lose your device or throw it in the trash, data remanence can expose sensitive company information.

Why can’t data be permanently erased?

The process of erasing data can be complicated by many factors. Data persistence on a computer can be exacerbated by:

• Inaccessible storage: Bad sectors on magnetic disks, reallocated tracks on hard disks, tapes with inter-record gaps, and relocated bad block tables on solid-state drives cannot be overwritten in the same way as readily accessible data. Simple methods of overwriting data are often unsuccessful in these cases.
• Advanced storage: As technology has gotten more sophisticated, the presence of data remnants has become more prevalent. A journaling file system writes data in multiple locations to protect data integrity. Data remnants may reside in locations outside typical file storage areas. Some storage media are designed to never overwrite data, particularly those with revision control. Antifragmentation features may also write file data to multiple locations, making full deletion next to impossible.
• Media type: Methods such as degaussing only work on magnetic media, not optical media devices. You also can’t purge a CD-R or DVD-R; information can be written only once but not erased (CD-RW and DVD-RW media may be overwritten). Flash-based solid-state drives store data and use algorithms that can be exploited, so without highly rigorous approaches, data can be recovered even after being wiped with lesser methods. This makes data remanence a problem.

Data persistence has even been observed with static random-access memory (SRAM) at room temperature, even though information storage is temporary and contingent on there being a power source. Dynamic random-access-memory (DRAM) chips must also have a power supply to retain data. Plus, they require contents to be refreshed to prevent data from fading away. However, this process can take several minutes at room temperature and up to a week if the medium is cooled with liquid nitrogen.

How data persistence can harm your business

Many forms of media are used in a modern business environment. Computers and servers may use different storage media, but you must also consider the mobile devices connected to your network and information and applications stored in the cloud. Data persistence on mobile and on company-owned devices can lead to harmful situations such as:

• Security breaches: Data theft, whether by external hackers, internal staff, former employees, or due to the loss or theft of portable devices. Malicious programs can result in the loss or alteration of data, identity theft, and injection of spyware, viruses, trojans, and other damaging elements into your network.
• Breach of standards: Standards such as NIST Special Publication 800-88; Army AR380-19, Information Systems Security; and Air Force AFSSI 8580, Remanence Security provide data security standards related to data persistence. If regulatory compliance requirements enforce the eradication of data, you must understand the required methods of validating the process to regulators or auditors.
• Uncertainty of data: There is no way to know whether a SaaS service you no longer use has written over your data or if data stored in the cloud can be destroyed in a logical sense. Finding all that data, alone, can be a challenge.

Data persistence can, therefore, lead to downtime, violation of regulations, operational problems, disruption of service to customers and clients, and damage to your company’s reputation.

Eliminating remanent data

For on-premise resources, data destruction takes time and can be costly, depending on the method used. As you’ve seen here, it is important to eliminate remanent data. Here are some ways this can be achieved:

• Clearing: Removing sensitive data so they can’t be retrieved using data recovery software or standard system procedures.
• Purging: Sanitizing of data before discarding old hard drives and other media, so data can’t be reconstructed using known forensic or laboratory methods.
• Destruction: Physical destruction of the storage medium using techniques such as grinding, shredding, or incineration. Optical media may be delaminated or destroyed with electrical arcing or submersion in a polycarbonate solvent. Solid disks may be destroyed through vaporization or liquefaction.
• Degaussing: By using a degausser, the magnetic field of a storage medium can be removed or reduced, purging all data and rendering a hard disk inoperable. The disk may be used again if the magnetic pulse is weak, but stronger fields can destroy a hard drive’s motor. Such degaussers approved by the U.S. government and military can do this. Unfortunately, degaussing is not effective on SSDs, CDs, and flash drives.
• Encryption: Data may be unrecoverable if it is encrypted, especially if the decryption key is overwritten. This is known as crypto-shredding. Whole disk and file-by-file encryption are possible methods. However, advanced methods may be used to acquire data, encryption processes may have been executed on only a selection of data or execut4ed improperly, or someone may obtain a copy of the decryption key.
• Overwriting: Overwriting is an extremely common and highly effective method of dealing with data persistence on computer and mobile storage. A hard disk is often still writable after being cleared and not damaged by the overwriting process. As a low-cost option, overwriting can target all or part of the storage medium. Overwriting software may be configured to target specific data or files, or even a storage device’s partitions. The techniques vary from writing a pattern of all zeros, which prevents any previous data from being retrieved, to overwrite patterns that may be used over multiple passes. This addresses the risk of more advanced data recovery techniques.

Permanent data destruction with hard drive erasure (or wiping) software

Blancco’s solutions erase devices used by corporations and government entities to make sure that all sensitive data is completely and permanently eradicated. Companies can properly erase hard disk drives and solid-state drives before reuse or permanent disposal.

Our solutions not only eliminate data remanence on these devices, they also generate certified, exportable audit reports to prove data has been wiped.

We offer a free data erasure trial for enterprises and ITADs to show how our software works and what is included in our report. Ask for yours today.

You may be interested in:

Why You Shouldn’t Rely on a Free File Shredder

Managing the Data Lifecycle of Your Organization’s Assets

Are Dark & Unstructured Data Putting Your Business at Risk?

Blancco File Eraser