College Closing - I have to wipe and image all the unencrypted drives...

Posted by Gedanken-mental@reddit | sysadmin | View on Reddit | 388 comments

The small college (60 employees) I work for is shutting it's doors for the last time on Sept 30. My Sysadmin was let go back in October, so it's only me (Director of IT), with an MSP watching the server room. I just found out yesterday (Aug 15), that a company is coming in at the beginning of October and will be auctioning off everything in the building, including all the computer equipment. They want the computers functional. This means all (about 80 of them) have to be wiped and reimaged in about 30 days (I can't start until Aug 30) They from 15yrs to 6m old (several vendors), and all of them had our licensed version on Enterprise Windows (10 and 11) installed on them. Most were purchased with Windows 10 Pro, so I'm planning on reimaging with that. Pretty much every machine has an SSD in it, except the newest laptops and desktops (20 or so) that are NVMe. Since we have a clinic (HIPAA-issues) at our College, as well as plenty of student data (FERPA-issues), I'm required to wipe or destroy every unencrypted disk that could have held patient or student data. Much of it is stored on our encrypted (at rest) Nimble/HPE, but it's possible people stored data they shouldn't have locally on their work computer. Without getting into past mistakes, that's the situation in which I currently find myself. What I'm looking for is a method of quickly wiping and reinstalling with generic Windows 10 or Pro (I have access to ISOs). Specifically, is there software that can quickly wipe SSDs/NVMe's? I've looked at PartedMagic, but the few times I've tried it, it took several hours per SSD (haven't been able to test on NVMe yet). I'll have access to an empty classroom after Aug 30 where I'll be able to set up a long table with 10+ computers to parallelize the process. Any suggestions would be greatly appreciated. I've got about 2 weeks before I can start the process in earnest, so I have some time to gather resources, though I pretty much have little to no budget for this.

Reply to Post

Reply

388 Comments

[-]

StarSlayerX@reddit

You need to have those drives taken to a recycler that provides a certificate of destruction on those drives. You don’t want that liability on your hands.

Reply

[-]

stephendt@reddit

Certificate of data destruction doesn't always mean physical destruction, FYI. At least where I am, recyclers re-use drives all the time for a variety of reasons.

Reply

[-]

gharvey5@reddit

ShredX do, you watch them be detroyed...

Reply

[-]

stephendt@reddit

Highly unncessary and wasteful unless we're talking about old / defective HDDs. Imagine if you had a fleet of 2023 Surface Pros or Macbooks... you'd have to destroy hundreds of thousands of dollars worth of computers when a simple ATA secure erase will have the same effect on data.

Reply

[-]

DonCBurr@reddit

Very much depends on the liability, contract, and legal issues. HIPAA & PCI DSS have heavy fines and significant liability attached. Unless the Auction company is willing to indemnify DESTRUCTION is the safest route...

Reply

[-]

stephendt@reddit

What liability issues are they going to have? The data is gone, there are no damages.

Reply

[-]

DonCBurr@reddit

I am talking about if the "wipe" is done correctly ... and given the time line to wipe that many drives I would be concerned ...

Reply

[-]

StarSlayerX@reddit

I work for a business that contracts with Feds, States, Banks, Hospitals, and other highly secured data. Our contract with these clients REQUIRE certified destruction of all decommissioned hardware attested by a third party vendor... No exceptions unfortunately... Absolute waste of $1000-1500 laptops that are 3 years old.

Reply

[-]

Visible_Witness_884@reddit

Doesn't really matter if you have a certificate of destruction. Then one self is in the clear.

Reply

[-]

Ok_Kaleidoscope1388@reddit

Is there even proof that anyone has ever recovered an encrypted drive? You would need the password. If you know you are using a strong key (following correct procedure) i don't really see any reason to be worried at all.

Reply

[-]

pjockey@reddit

Either encryption works or it doesn't.

Reply

[-]

Ok_Kaleidoscope1388@reddit

What? What does that even mean?

Reply

[-]

pjockey@reddit

If it can't be relied on now that you're disposing, how was it ever good for live data?

Reply

[-]

Ok_Kaleidoscope1388@reddit

Ah i understand what you mean now. I was not sure what you where saying before.

Reply

[-]

TheGreatNico@reddit

Yup. We(I) have to do it every few months as old hardware cycles through form a tech upgrade.

Reply

[-]

Sintarsintar@reddit

There are bootable programs that will do this with a certificate of destruction.

Reply

[-]

Ballzovsteel@reddit

This again.

Reply

[-]

ArtificialDuo@reddit

This is the correct answer. I'm due to do it soon myself with a lot of old hardware we replaced over the last year.

Reply

[-]

DonCBurr@reddit

1.) Document your concerns in writing, make sure to include the HIPAA and FERPA issues 2.) Do NOT take responsibility unless you get a lawyer approve letter of indemnity 3.) Find the best way outside of you killing yourself and present it with the cost along with your request for indemnity DO NOT FUCK AROUND WITH THIS. I have first-hand knowledge of when this goes wrong and have seen colleagues as named defendants in legal proceedings. This is WHY the companies that provide certificates of destruction exist in the first place...

Reply

[-]

tildesplayground@reddit

Our university standard is to remove the drive from every device, wipe the drive, then send to shredding before the system is out to surplus

Reply

[-]

pjockey@reddit

It makes sense to wipe a drive before physically destroying it? Share school name so we can stop sending people there?

Reply

[-]

tildesplayground@reddit

I don't make the rules, just stuck following them. That being said. We've caught a few previous vendors in the past that were contracted to shred laptops and drives. Some of those laptops would show back up when booted in another state after being "shredded". So security decided to ensure that if a new vendor does this in the future, at least the data was thoroughly wiped.

Reply

[-]

Kthef1@reddit

Boot a computer with a live linux USB, then get some sata adapters that fit your hard drives and use the DD command to wipe each drive. You can easily do several a day depending on how many adapters you get. You can create one image if you like and then DD that image to every drive if you want to reuse them in similar machines. Trust me a DD wipe is secure. The DOD uses it.

Reply

[-]

fargenable@reddit

Should be pretty easy to make a python tool that does the following. 1. Enumerates drives using the `lsblk` command. 2. Detects if drives are SSD (SATA), NVMe, or HDD (SATA) based on their identifiers and transport type. 3. Uses `hdparm` for SATA SSDs and `nvme-cli` for NVMe drives to perform the secure erase and dd and /dev/urandom for the HDDs. Then just wrap this up in a systemd service and a bootable linux USB, also possible to pxe depending on system OS.

Reply

[-]

pjockey@reddit

Easy for a director who doesn't do day to day hands on technical work?

Reply

[-]

fargenable@reddit

Yeah, aren’t you the smartest guy in the room, can do anything, figure it out.

Reply

[-]

Still-Learning73@reddit

How long does data from a business that is closing need to be retained for HIPAA, FERPA requirements? (Also, your services as a consultant might be needed. Don't volunteer to work for free.)

Reply

[-]

Resident-Geek-42@reddit

Pxe with drive wiping software on the network. Boot everything via network boot (ipxe or equivalent) and let them run.

Reply

[-]

chandleya@reddit

Drive wiping software does diddly squat on an SSD from the past 12 years.

Reply

[-]

Resident-Geek-42@reddit

Got any data to back that statement up? Depends on the wiping software but generally zero’ed drives properly is enough.

Reply

[-]

look_mom_no_username@reddit

There have been some studies that show data can be recovered from hard drives if just zeroed, the attacks require specialized tools and knowledge though That's why there are other wipe methods that use randomized data and multiple passes just to be safe But if the drive was encrypted already and then the TPM was cleared and the drive was secure-wiped, that has to be secure enough I'd think anyway

Reply

[-]

vertexsys@reddit

Source? There has been no successful attempt to recover data from a drive that was zeroed and verified.

Reply

[-]

look_mom_no_username@reddit

Here's a good discussion on the you with sources and references https://security.stackexchange.com/questions/10464/why-is-writing-zeros-or-random-data-over-a-hard-drive-multiple-times-better-th It was proven *possible* in a specific setting and hardware, not practical, apparently last time someone was able to recover something from a zeroed drive *and* published was a while ago Zeroed is likely enough, but in data security "likely enough" tends to be not good enough

Reply

[-]

vertexsys@reddit

Thank you, that was a good read. The conclusion of the referenced article (link is behind a paywall but it's free to read [here](http://tracedigital.be/pdf/overwriting_hard_drive_data.pdf) if you're interested in some light reading) is that while it is possible to retrieve individual bits, sometimes, there is no way to generate useful information from that in a meaningful way. "The recovery rate of a 32-bit word is 0.06937619 (just under 7%). As such, the chances of finding a single 4 letter word correctly from a Microsoft Word document file is 2.3166E-05 (0.00002317%)" And this is their conclusion: "This study has demonstrated that correctly wiped data cannot reasonably be retrieved even if it is of a small size or found only over small parts of the hard drive. Not even with the use of a MFM or other known methods. The belief that a tool can be developed to retrieve gigabytes or terabytes of information from a wiped drive is in error." I agree that "likely enough" is not enough. Thankfully, a successful 1-pass zeroing on spinning drives, with a verification pass, is "more than enough". Because of the continued belief in the fallacy that the only way to safely purge data is to physically destroy a drive, millions of hard drives are shredded rather than go on to live on for years in the secondary market. This is a large contributing factor to e-waste and is simply not necessary. NIST 800-88 and R2v3 recognize that clear/purge methods, including single pass zero+verify as well as secure erase purge methods on SSDs, are sufficient to fully sanitize hard drive and SSDs. Thankfully many companies recognize this and utilize ITAD companies who erase rather than shred, and provide the business the certificates required to cover their ass. My company is one such company and we regularly erase drives, often 500-1000 at a time. Those drives get put back into use in smaller organizations and in homelabs where they live long and happy lives.

Reply

[-]

pjockey@reddit

Yeah, and out of context you have no idea even if it happens to be a known word, that it isn't an encrypted version of something else.

Reply

[-]

vertexsys@reddit

Maybe if the word is 'redrum' Otherwise some nation state spends $3M to deduce the word "Mike"

Reply

[-]

pjockey@reddit

Sir, should we confirm it's not a typo or incomplete Like Nike Mile Mikela? No, we're sending nukes to the sun ASAP as possible.

Reply

[-]

look_mom_no_username@reddit

I agree that destroying the drive is not aligned with the science of data recovery, it is more in line with: "What if someone does not follow the process or a drive is missed, bad inventories, shadow IT, lack of internal processes etc. then destruction is quicker" I suppose that DoD and similar wiping methods work under: "Even if they recover a few words that might be too much" So yeah, even then the shortest DoD wipe method guarantees not even a single word can be recovered if drive was not encrypted and for encrypted data, key deletion and zeros pass will do, for flash perhaps just secure erase and verification (Although no idea if there are any known attacks or studies directly on modern flash)

Reply

[-]

vertexsys@reddit

""What if someone does not follow the process or a drive is missed, bad inventories, shadow IT, lack of internal processes" That's an issue whether you shred or wipe. You can't conceive of an employee stealing a $1000 SSD before it goes through the shredder? That's why you engage an ITAD firm. The method of data sanitization doesn't matter, what matters is working with a firm utilizing rigorous ISO / R2 controls. Otherwise, glad we see eye to eye on the unnecessary nature of shredding useful hardware.

Reply

[-]

chandleya@reddit

https://nvlpubs.nist.gov/nistpubs/specialpublications/nist.sp.800-88r1.pdf That should do.

Reply

[-]

look_mom_no_username@reddit

There's ShredOS, a minimal Linux OS that uses DBAN's successor, NWipe Supports NVMe, secure erase, generates deletion certificates, has different wipe methods and can run in bulk, from USB, PXE, open source etc. https://github.com/PartialVolume/shredos.x86_64?tab=readme-ov-file Also has anyone here actually tried to recover information from a hard drive after a secure erase? Saying it's hard is an understatement, it is impossible for most practical applications You'd need a team of nation state funded level experts to get anything out of the drive and even then you're looking at maybe a few words or patterns, no way you'll get a database or similar, hell databases sometimes even get corrupted beyond repair because they didn't like the weather And why would they bother buying a bunch of 2nd hand computers to maybe extract something? They'll try to go after the actual source of data and steal millions of records at a time

Reply

[-]

chandleya@reddit

Why? Compliance. Everything I read about nwipe suggests it’s not doing that yet.. “Nwipe will erase drives using a user selectable choice of seven methods. hdparm - amongst many of its options - can be used for wiping a drive by issueing ATA erase commands to the drive’s internal firmware. This is a planned feature addition to nwipe.”

Reply

[-]

210Matt@reddit

Can you even resell Enterprise Windows? Put them back to Pro

Reply

[-]

pjockey@reddit

Maybe I skimmed but thought that's what he said

Reply

[-]

michaelpaoli@reddit

>every machine has an SSD in it, except the newest laptops and desktops (20 or so) that are NVMe. >What I'm looking for is a method of quickly wiping Use the SSD's/NVMe's secure erase functionality - it's the only way you can securely erase without destroying the drives (no way to otherwise, e.g. wipe mapped out sectors/cells, etc.). Set yourself up with boot media (and some copies thereof), e.g. USB stick, that you can boot, run from RAM, and then fire off the secure wipe(s) via the device's secure erase, then come back later to check that it successfully completed. For low value drives that aren't worth even that time investment, have them physically destroyed (certifiably/verifiably so) - there are companies/providers that will do that - some even offer on-site service for the destruction. That's basically it. All that other stuff about installing an OS - why bother - if they hardware has license, have that with it, let someone else deal with that - probably not worth the time/labor to do (re)installations ... besides, many (e.g. corporate/commercial/institutional) buyers won't trust the install and will want to (re)install what they want, configured as they want, and that they know is clean from their sources/images. >iPads Thoughts on those? Figure out how to do secure wipe on those, and do so ... or have the drives (or iPads) destroyed. I'm sure there must be some reasonable means to do it, but how easy is a different questions.

Reply

[-]

beren12@reddit

I pad storage is encrypted 100% if you erase all data there is 0% change anything survives.

Reply

[-]

pjockey@reddit

I wouldn't say zero. Why is the iPad an exception to destruction proposed by 80% of the commenters? Personally I'm a hoarder and reuse advocate.

Reply

[-]

Mythbrand@reddit

Worked in a hippa environment and we would always use a drill press on the drives

Reply

[-]

mapold@reddit

Why would `dd if=/dev/urandom of=/dev/sda` on a bitlocker enabled drive not suffice? It get both HDD and SSD could have relocated sectors but recovering bitlocker key is impossible plus getting the data from a random bad sector which was relocated is going to be useless. When drilling do you make sure to drill through ALL the memory chips in case someone desolders the untouched chip?

Reply

[-]

pjockey@reddit

Not understanding technology, or just not wanting to deal with it.

Reply

[-]

Tzctredd@reddit

Paranoia. You won't convince a paranoid person with logic.

Reply

[-]

mapold@reddit

Sure, but here we have dozen people who would like to appear to be sysadmins parroting the same stuff over and over.

Reply

[-]

1Digitreal@reddit

You had me at auctioned off. I would secure wipe each PC and leave them unformatted. If you have old Win Pro keys, tape each individual key to the side of the case and be done with it. Let the buyer be responsible for reinstalling Windows. I get wanting to provide a complete product for the auction, but there is liability attached to that too. You auction a 'working' Win 10 computer, and some drivers are missing, can the buyer come back and complain? Another thought, what are the chances the workstations will be auctioned off as bulk/pallets of PCs, just to go to another business who then re-mages them anyway. Don't make your last month of working there a hell just to get a bunch of old computer working for them to resell. My two cents...

Reply

[-]

pjockey@reddit

Yeah I interpret it as all components and parts present, doesn't have to have an OS loaded with office software. the cars the school sells off won't come with a driver.

Reply

[-]

Gedanken-mental@reddit (OP)

Thanks for that recommendation. I believe there will be pallet being sold.

Reply

[-]

1Digitreal@reddit

Sure thing. Another note. I've done a few decommission projects where the companies resold the hardware afterwards. With any company or sensitive data, I always inventoried the workstation SN, and asset tag, then removed and destroyed the hard drives. Computers were then sold without hard drives. This is pretty common practice.

Reply

[-]

beren12@reddit

It’s common to buy them with secure erased drives as well.

Reply

[-]

MonkeyManWhee@reddit

Destroy the drives, sell the hardware as is. You do not want the headache if someone gets partial data off the drives.

Reply

[-]

Gedanken-mental@reddit (OP)

That's what I was hoping to do. I'll run it by my superiors. It will certainly make my life easier!

Reply

[-]

tfmm@reddit

If there's a potential for HIPAA data, this is the only option. Hire a shedding company that has the ability to come to you so you can witness the drives being destroyed.

Reply

[-]

mkosmo@reddit

Or provide a certificate of destruction. That'll satisfy anybody worth worrying about.

Reply

[-]

Boringtechie@reddit

I think OP should operate under the assumption that all of those drives have HIPAA data on them. Used to work in medical IT. We would give away old laptops when we switch brands. Just pulled the drives and RAM. set them to the side to be shredded and receive the certificate. That satisfies all HIPAA requirements.

Reply

[-]

thatfrostyguy@reddit

I work in the banking sector, and we only need to pull and destroy drives. So I'm curious, why pull the RAM as well? That data gets obliterated when there is no power to the RAM chip. Is it a HIPPA related thing?

Reply

[-]

nullpotato@reddit

There are some weird ram types where data can persist without power. My company doesn't have HIPAA data but our policy is the same because way easier to not worry about missing something.

Reply

[-]

gummo89@reddit

It's much easier from management perspective if someone calls them "storage" but a quick search reveals it's not relevant. Then management should be made aware of the wasted time and lost value in resale.. I'm sure the policy will go away.

Reply

[-]

pjockey@reddit

Those pesky laptop bags must be crushed as storage devices

Reply

[-]

OldschoolSysadmin@reddit

Intel Optane.

Reply

[-]

Practical_Ad5671@reddit

What types are these? Genuinely curious. Old tech or new tech?

Reply

[-]

OldschoolSysadmin@reddit

New-ish tech - Intel tried it with Optane Persistent Memory a few years back.

Reply

[-]

nullpotato@reddit

Apparently I was gaslighting myself because after digging cannot find anything like I remember hearing about.

Reply

[-]

Sure_Acadia_8808@reddit

You might be thinking of a "cold boot attack," but it's so esoteric that it's basically just proof-of-concept. https://en.wikipedia.org/wiki/Cold_boot_attack The circumstances required for a successful exploit are really specific and time-sensitive (a matter of seconds to minutes).

Reply

[-]

nullpotato@reddit

I am pretty sure I was remembering ram disks but in reverse

Reply

[-]

Sure_Acadia_8808@reddit

Yeah, that makes sense, too. There's all kinds of gray areas around whether RAM is persistent or not, and under what conditions. NVRAM, EEPROM, RAMdisk, NVDIMMs, etc.

Reply

[-]

surveysaysno@reddit

There were some SSD DIMMs there for a bit.

Reply

[-]

pjockey@reddit

Because people dont understand the hardware they work with.

Reply

[-]

stephendt@reddit

As far as I am aware it's a stupidity thing, it's absolutely not necessary.

Reply

[-]

Boringtechie@reddit

you're right it's not necessary, just did it as the extra check box.

Reply

[-]

Practical_Ad5671@reddit

We would smash the OLED monitors also, just to be safe there wasn’t burned in data…

Reply

[-]

injury@reddit

Don't forget the rollers and users in all the printers, and sxanner glass too

Reply

[-]

alainchiasson@reddit

Printers and copiers have their own issues!!

Reply

[-]

Particular_Yak5090@reddit

Or the cpu. Never know what is still in cache.

Reply

[-]

fuckredditlol69@reddit

and the laptop keyboard - you could glean some PII off the most greasy keys

Reply

[-]

Capable-Reaction8155@reddit

Ram is also weird to me

Reply

[-]

vertexsys@reddit

Shred the ram? Sorry, that is such a waste. Any data on ram is completely purged as soon as power is removed from them. It's not a 'could be recovered by a nation state hacker's situation. It's just not possible.

Reply

[-]

mkosmo@reddit

It's a question for his leadership. If his direction is to ensure they're operable and functional, his hands may be tied.

Reply

[-]

Dear-Ad1329@reddit

When I had to destroy drives to make the data unrecoverable back in the day, my go to move was to disassemble the drives, collect the magnets, remove the plates, drill holes in them, and if possible, cut them into throwing stars. It’s a known scientific fact that no data can be recovered from a throwing star.

Reply

[-]

sploittastic@reddit

I was a desktop admin in the public sector and when we decommissioned computers we would pull the drives and run them through a certified degausser and then take all of the drives to the facilities shop and snap them with a sheet metal brake. It was kind of fun, for the first couple hundred at least.

Reply

[-]

airforcematt@reddit

You just gave me flashbacks to having to use the only, and very slow degausser on base to wipe a bunch of old VHS tapes that had classified recordings on them. Took a few days of mindlessly waiting for the thing to slowwwwwly charge up.

Reply

[-]

drosmi@reddit

Watching drives get shredded is kinda cool. It’s jlike a giant wood chipper except for metal.

Reply

[-]

EastcoastNobody@reddit

GET A CERTIFICATE OF DESTRUCTION!

Reply

[-]

PoeTheGhost@reddit

Seconded, most companies have carts and/or a truck with destructive equipment mounted on it. Usually a big electromagnet (shielded) to wipe, and a hydrolic vise to bend/destroy the internals, then a shredder for the pieces.

Reply

[-]

MadManMorbo@reddit

There are a number of firms out there who will show up with an industrial shredder and grind them to tiny pieces right in front of you.

Reply

[-]

AnnoyedVelociraptor@reddit

Mmmm NVME dust. Don't breathe this.

Reply

[-]

onafoggynight@reddit

I love the smell of napalm in the morning.

Reply

[-]

SHDrivesOnTrack@reddit

Thanks Tom Dickson

Reply

[-]

nullpotato@reddit

Smells like data. And copper

Reply

[-]

incendiary_bandit@reddit

Sounds like a fun day

Reply

[-]

MadManMorbo@reddit

It would definitely make for a good r/oddlysatisfying post..

Reply

[-]

primarycolorman@reddit

HIPAA breach notice and identity protection is running $30 a soul. HHS fines of late have been around $400 a head.

Reply

[-]

shouldvesleptin@reddit

You're the Director, yes? Their choices are this (drive destruction) or, they pay through the nose to hire a ton more labor to get it done correctly in such an unreasonably short time. Likely, that labor isn't even available.

Reply

[-]

Tozz2@reddit

It's still time consuming though

Reply

[-]

g00nie_nz@reddit

If your superiors say no id resign as you are being made redundant I assume anyway. Why have the last fee weeks there running around stressed.

Reply

[-]

Pretzeloid@reddit

Honestly, there are recycling orgs that will take the equipment, provide certificates of destruction of data and then give you a reasonable price for the lot. I wouldn’t mess with a sale. Also, are all these drives removable? Or are some of the SSDs soldered to the board (MacBooks for example)?

Reply

[-]

deepasleep@reddit

With SSD’s formatting the drive and installing a new os will effectively destroy the data. The drives are constantly balancing the data being written across the all the available space. It’s not like a magnetic drives that writes data to contiguous sectors on a spinning platter and only overwriting old data when it needs to use the reallocated space. And SSD’s / NVME’s can’t be taken apart and put through a physical process the can look for faint traces of magnetic data that hasn’t been completely destroyed by multiple write passes.

Reply

[-]

Coffee_Ops@reddit

With SSDs formatting rewrites a partition header (a few bytes) and does not remove data. OS reinstall will nuke a few dozen GB tops. Its not a good way of sanitizing and will get you in trouble.

Reply

[-]

ITguydoingITthings@reddit

No. Effectively destroying isn't the same as destroying...even if you could back that claim up with verifiable proof.

Reply

[-]

bmzink@reddit

You have leverage here. Tell them what you're going to do and do it.

Reply

[-]

USSBigBooty@reddit

Don't forget the hard drives out of the copiers btw.

Reply

[-]

arwinda@reddit

Whatever your superiors say, get it in writing, and print it out for when your account is no longer working.

Reply

[-]

BallZach77@reddit

Fuck your superiors. What are they going to do, fire you? There's no need to play politics in an organization that is disappearing. Refuse it. Tell them you will not be party to a potential HIPPA or FERPA leak in the name of selling fully functional computers. The drives need to be destroyed.

Reply

[-]

sauriasancti@reddit

I would even suggest considering using a contractor that can give you a certificate of destruction for cya/audit trail

Reply

[-]

houserPanics@reddit

Run it by legal. Done.

Reply

[-]

kafeend@reddit

Agree with this. Just inform the buyer to install windows 10/11 pro on new drives, it should auto activate, if not provide them with a key upon request.

Reply

[-]

stephendt@reddit

No-one is getting data off any of these drives as long as you zero any modern HDDs (anything larger than 160GB should be safe, but this admittedly can take overnight to process), or use an ATA secure erase on an SSD takes like 30 seconds. I swear it's easier to do a quick wipe than it is to destroy hardware but this ancient wasteful advice still gets passed around...

Reply

[-]

_TheManInBlack@reddit

Have you ever worked in financial or medical IT?

Reply

[-]

stephendt@reddit

Not really interested in ad-hominem attacks thanks. We're talking about 1's and 0's here. I have not seen evidence that it is possible to recover data from zero'd HDDs larger than 160GB, provided that the drive is not defective. Same applies to ATA Secure Erase on SSDs. If you find evidence of the contrary I would be very interested in seeing it. Whilst I did not specify this, if a drive is defective for whatever reason, it should be destroyed, but that part is pretty obvious.

Reply

[-]

_TheManInBlack@reddit

LOL what? That wasn't an ad-hominem, it was a question. But I can tell from that reply that there's no point in even having a discussion with you.

Reply

[-]

moistnote@reddit

Insurance wants certificates of destruction. Every time. Go ahead and tell them why they are wrong, they will say shut up little IT boy and shred the drives.

Reply

[-]

stephendt@reddit

They want cerficiates of data destruction. Plenty of recyclers will do this for you FYI.

Reply

[-]

moistnote@reddit

I’ve done this for early education, power, bio science, and industrial. They all want shredded drives, per their insurance. OP is asking for advice, not to re-educate the insurance system.

Reply

[-]

stephendt@reddit

I can't say I've had this experience, but I am not american.

Reply

[-]

Tzctredd@reddit

Yep, that's the difference, the litigious nature of doing business in the US. In other countries a more common sense approach is perfectly fine.

Reply

[-]

Zestyclose_Tree8660@reddit

The time’s really the issue. I can sanitize a drive in seconds in a degausser or shredder, or hours to overwrite it. Drives are cheap.

Reply

[-]

stephendt@reddit

Not sure if I agree. It takes about the same amount of time for me to initiate a boot-time ATA secure erase as it does to physically disassemble a system and remove a drive. Especially on some of the newer systems that make this process a bit fiddly, or on laptops.

Reply

[-]

uzlonewolf@reddit

> I swear it's easier to do a quick wipe than it is to destroy hardware Depends on the machine. I wanted to wipe the SSDs in a Supermicro server before repurposing and the only way to do it was either a) pull the drives and do it in another machine or b) set a drive password, reboot, skip the BIOS/UEFI unlock prompt, unlock them in the OS, and then issue the SECURE ERASE command. Neither of those options are particularly quick.

Reply

[-]

stephendt@reddit

You can easily PXE Boot to iVentoy and run all of that from a linux linux OS in about 3 minutes

Reply

[-]

uzlonewolf@reddit

You can set up the computer, plug in power, network, keyboard, and a monitor, go into the BIOS/UEFI to enable PXE Boot, boot, reboot, manually skip the BIOS/UEFI "unlock drive" prompt, boot again, wait for the erase to complete, and take it all apart again in 3 minutes? Get out of here.

Reply

[-]

IkouyDaBolt@reddit

You still need to do Secure Erase on a HDD as reallocated sectors are not overwritten with a high level zero fill.

Reply

[-]

stephendt@reddit

Correct, thank you for clarifying.

Reply

[-]

bradsfoot90@reddit

This is what we did at the college I worked at. All PCs were decommissioned and auctioned off without drives.

Reply

[-]

wow___just_wow@reddit

What about destroying the drives and selling the computers with a Linux boot usb to demonstrate the machine is functional and the monitor/kb/mouse works properly?

Reply

[-]

TuxAndrew@reddit

Pretty much this, I find it hard to justify paying for the hours for something that's going to be auctioned off by the pallet not to mention you're reducing your liability.

Reply

[-]

vertexsys@reddit

Don't destroy the drives and waste a perfectly reusable HPE Nimble in the process. Wipe them with certificate of erasure and move on. Data can be completely purged by erasure with zero chance of retrieval. We do it every day, generally hundreds of drives concurrently. There is already enough waste in this industry.

Reply

[-]

lakorai@reddit

Which means on a Mac your fucked. Whole laptop has to be destroyed. Who in their right mind decided a soldered SSD was a good idea? Shareholders probably

Reply

[-]

AnnoyedVelociraptor@reddit

No. This is why you enable FileVault at the initial setup. That way you can reset the FileVault passwords and the data is truly gone. But you cannot do that after the fact. You can enable FileVault but you have no guarantees that while encrypting a file the original isn't somewhere on some part of the SSD that never gets deleted.

Reply

[-]

Slyons89@reddit

Does FileVault provide a data destruction certificate for proof? I work in the medical industry and they still make us run killdisk on Macs so we can get a certificate to show to auditors in case it ever comes up.

Reply

[-]

malikto44@reddit

Any Mac with a T2 security chip or Apple Silicon can be [restored](https://support.apple.com/en-us/108900). This will completely obliterate all existing encryption keys, update the SepOS firmware, update other firmware, and install a clean copy of macOS. Some compliance reqs require complete destruction, which means the entire Mac gets shredded, but if that isn't the case, a restore via this method will pretty much ensure the previous data is wiped.

Reply

[-]

ajrc0re@reddit

Just because a design choice doesn’t adhere to the industry standard doesn’t mean it was a bad one. There are plenty of reasons to utilize on board storage instead of detachable.

Reply

[-]

uzlonewolf@reddit

On a consumable item prone to failure? No, it's a bad choice designed to fuck over consumers.

Reply

[-]

ajrc0re@reddit

consumable hard drive 😂

Reply

[-]

uzlonewolf@reddit

Are you saying hard drives do not fail? Or that SSDs do not wear out? Because both are true if you would care to educate yourself. There are a bunch of videos showing the (rather involved) process of repairing Macs with blown flash chips - it's quite a common failure. The fact you think it is laughable tells me everything I need to know about your opinion.

Reply

[-]

ajrc0re@reddit

theres a dozen parts that will wear out from regular use before the ssd LOL let me go tell my 10 year old macbook that it is consumable and should have died by now

Reply

[-]

lakorai@reddit

Profit margin being the main reason.

Reply

[-]

beanmachine-23@reddit

Yes. Board of directors with shareholders in mind.

Reply

[-]

Quietech@reddit

The board members all have shares.

Reply

[-]

Turinggirl@reddit

And by destroy the drives. Buy a drill and drill through them and then you find a company that will do on sight destruction. you take those drives, label them so you can keep a record of them. When they come to destroy the drives you will not leave sight of those drives until every one of them is shredded and marked off your list. This is how I've decommed everything from a doctors office to a project for the DoD.

Reply

[-]

thortgot@reddit

That's extraordinarily overkill and wasteful. A simple 3 pass wipe (0s, 1s, 0s) on thr most vulnerable drives (magnetic) has been proven to be 100% unrecoverable. There was 1 million dollar bounty for years when drives were much easier to do this style of recovery against. For SSDs? Secure Erase is literally designed to exceed all security stands.

Reply

[-]

Turinggirl@reddit

Nope. HIPAA violation. Is it wasteful sure. But that's the cost of business. You destroy the data drives. That's how it is and how it always should be when it comes to medical records and classified data. To think otherwise is naive at best and foolish at worst.

Reply

[-]

thortgot@reddit

On drives that have or plausibly have HIPAA data sure. On all of them?

Reply

[-]

Turinggirl@reddit

Kill them all let God sort it out.

Reply

[-]

BornAgainSysadmin@reddit

My colleague has had luck with using a bar code scanner to scan the drives' SNs into a spreadsheet. We used to have to do it by hand. Literally, the old manager for the group required us to use a physical form. So glad when he retired and we were able to leave the 1990s behind.

Reply

[-]

fmillion@reddit

While I want to argue and say "use DBAN" or "why didn't you use full disk encryption" I have to reluctantly admit that not including the drives may be the safest option. I would still posit that a fully properly zeroed drive is so close to zero risk though, but the time needed to do it isn't free.

Reply

[-]

IkouyDaBolt@reddit

Doing a zero fill not only burns the SSD but unless you are able to multiple passes properly the factory over provisioning might be untouched. SATA drives have Secure Erase; NVMe drives may do a PSID reset.

Reply

[-]

fmillion@reddit

Yeah, I know the sector sparing thing can be an issue. What I do think is bullshit is destroying drives and even whole computers even when proper FDE was in use, over some paranoia based on a sci-fi hacker flick or irresponsible journalism. Had it out with a manager once who sincerely believed hackers could decrypt the drive character by character like in WarGames...

Reply

[-]

especially_me@reddit

Most NVMe drives also have the Format command. Example (Linux): nvme format /dev/nvme0n1 -s1

Reply

[-]

IkouyDaBolt@reddit

Yup. I only didn't mention it because I don't know how drives implement it. With Secure Erase it's also manufacturer specific (I've heard of things like voltage spiking the chips or deleting the keys used to read the SSD. Some manufacturers such as ADATA suggest this damages the SSD and to use it sparingly) but I'm familiar enough with HDDs to figure it knowingly uses the drive's firmware to erase the device.

Reply

[-]

jatorres@reddit

If the college is being shut down, who would someone complain to?

Reply

[-]

Competitive-Bag9469@reddit

This is the way

Reply

[-]

Tremfyeh@reddit

Yea most every data critical industries just remove drives and sell equipment without. Then destroy drives physically beyond any recognition.

Reply

[-]

pdp10@reddit

Don't destroy hardware. The computers definitely won't be functional if the storage is destroyed. That's not even counting machines where storage is soldered down, like an XPS ultrabook, recent Mac, or mobile device. If the wiping is performed, nobody's getting partial anything off the drives. The only actual risk is a logistics risk, that some machine gets skipped accidentally. But you have that same risk if you're yanking and crushing drives.

Reply

[-]

RagingITguy@reddit

Sure, practically nobody is getting anything off the drive. BUT if anything happens, sorry the drives were destroyed and there is 0% chance someone is getting that data. Student data can be protected in some ways almost as HIPAA, and I wouldn't take the chance unless someone wants to sign off on it and then that's their problem.

Reply

[-]

pdp10@reddit

It's not practically anything. The [post I linked](https://www.reddit.com/r/sysadmin/comments/1bq5z5i/securely_wipe_nvme/kx0j95j/) has a way of verifying the wipe, which is to read the device and see if there's anything but zeros. One simple way: `hexdump /dev/nvme0p1`.

Reply

[-]

arwinda@reddit

This is only changing logical blocks on the drive, not overwriting all the data. When the OS overwrites a file, the drive firmware will use different blocks and make it look like the file is gone and the blocks are overwritten. Using firmware tools it is still possible to extract the content of blocks not yet cleaned by the drive firmware. You don't want to be responsible if the drives end up in the wrong hands and someone extracts the data directly from the drive.

Reply

[-]

pdp10@reddit

I linked to the NVMe and SATA Sanitize routines, which doesn't abstract blocks.

Reply

[-]

Hollow3ddd@reddit

Yup. Lazily showing hdd sn and a hammer action for the record via video.

Reply

[-]

ITguydoingITthings@reddit

Or reimage with new drives. But OP needs to destroy the drives.

Reply

[-]

twitchd8@reddit

This is the ONLY way!

Reply

[-]

libertyprivate@reddit

Very much this. This is the only appropriate answer. Those drives should never have been unencrypted, but its too late for that conversation. Now you destroy those drives

Reply

[-]

TheLightingGuy@reddit

Can confirm. This is the only way. I recently started to work for a company that has government contracts. Specifically the government contracts that require some kind of secret clearance. When we decommission laptops, this is exactly what we do.

Reply

[-]

Turinggirl@reddit

For us our SOP was complete destruction of the PC but that was for SCI. So we had one of those dual screw shredders and would throw the drives, ram, cpu and motherboard in and would auction the cases for scrap and recycling I believe.

Reply

[-]

cntry2001@reddit

Yeah this is nuts pull drive and sell PCs without

Reply

[-]

BecomeApro@reddit

This is the way

Reply

[-]

DE_WDC_4850@reddit

I would personally recommend using Parted Magic, create a handful of bootable flash drives and run their smart erase utility. You mention it was slow when you ran it, with smart erase it should wipe an SSD in under a minute and 1TB spinning disks take up to 50 minutes. It may be built into modern Dell and Lenovo BIOS’s as well. Smart erase is incredibly powerful and is a bit quicker than a DoD wipe. If you wipe the machines yourself I would then pull drives and have them destroyed by a NAID certified facility. You should be able receive a certificate of destruction and be able to sign an affidavit that the media was sanitized prior to processing. HIPAA requires ‘reasonable safeguards to limit incidental, and avoid prohibited, uses and disclosures of PHI“, secure erase and a NAID destruction should be plenty for you.

Reply

[-]

fnordhole@reddit

"I just found out yesterday (Aug 15), that a company is coming in at the beginning of October and will be auctioning off everything in the building, including all the computer equipment. They want the computers functional." That's very nice for them that they want things. I want things, too. You know what? "Functional" is a very broad term. Booting to a message that says there's no OS drive is functional, in my book. Let the auction company deal with it. They're not the boss of you.

Reply

[-]

Tasty_Rub_2912@reddit

Email recycle@beyondsurplus.com we can re ord serial numbers and generate a certificate of destruction after physical shredding

Reply

[-]

TechSupportIgit@reddit

If your higher ups are adamant that these be sold working with storage, you'll need to run software that will issue secure erase commands to the SSDs and NVMe drives. I haven't done that before, so do some research on that. As for HDDs, DBAN them all with RCMP/DOD standards. Three wipes, zeroes, ones, random I believe. Anything more and you'll be there for weeks. I may be wrong with that exact standard, but DBAN is programmed with those standards built in. If you want to, you can run DBAN on the SSDs. The secure erase should be good enough, but honestly a single pass of random data should be fine. Then, I'd set up a server to act as a network boot with an ISO of Win10 for all the servers to install from. I'm sure there is a way to customize the ISO to automatically install and all that. Good luck, OP. You'll need it.

Reply

[-]

vertexsys@reddit

From a basic, DIY standpoint, ShredOS will do a lot of that. For HDD, a single pass zero + verify will do it, no one has ever recovered meaningful data from even a single pass, in a lab environment. I posted a link to a study elsewhere in this thread. For SSD, secure erase is available within PartedMagic. Dban is seriously old school now (it has been purchased by Blanco and development ceased - nwipe / shredOS is the spiritual successor) Outside of the DIY zone though, hire an ITAD company (like mine) to do that work, and they assume the risks and issue the certificates that cover you off for legal and regulatory requirements. A good ITAD will provide those services for free and pay residual value back on the hardware.

Reply

[-]

TechSupportIgit@reddit

Huh. The more you know! Thanks man

Reply

[-]

vertexsys@reddit

Happy to help! Just so you know, PartedMagic is available for purchase commercially for about $20 CAD for a one time purchase or $270 for lifetime updates. It's worth the cost given the functionality, but if you're on a budget you can do secure erase with hdparm / sdparm in Linux. Either way you would need direct access to drives, which is normal for desktop devices but for servers you would need an HBA, or set your RAID card to passthrough mode. If you are going through an ITAD make sure you're not getting ripped off lol. The common belief is that the fear is worthless and they're doing you a favor to haul it away. Then they turn around and sell it.

Reply

[-]

the_rob_c@reddit

Your Edit is the correct approach to the workstation hard drive issue. Just remove all the drives and catalog the serial numbers. Then hire a third party to destroy, not wipe, and provide a report with the outcome by serial number. As far as iPads or mobile devices, that would be a judgement call on risk. If there is any chance, just destroy, the little bit of profit would cover any potential lawsuit.

Reply

[-]

ProfessionalEven296@reddit

Trash the disks. It’s unlikely that you can legally transfer a windows license with these machines.

Reply

[-]

Fatality@reddit

The bundled license stays with the machine, even without the disks the motherboard will relicense as soon as Windows is installed.

Reply

[-]

ProfessionalEven296@reddit

Interesting. It’s been a while since I played with windows.

Reply

[-]

Ssakaa@reddit

> but it's possible people stored data they shouldn't have locally on their work computer and > We also have iPads that were used in our clinic, but they used online EHR software on them, so no data should have been stored locally Don't gamble that medical or ferpa data didn't land in a local unencrypted cache. If it was rendered in a webpage, it was probably written to disk. Nuke and pave, pulverize, or otherwise solve it right. On the upside, if those are all *recent* ipads, I believe those tend to encrypt at rest by default, and a proper full reset *should* suffice, but you'd have to double check that for your specific model/os version/config/etc. > a company is coming in That's a good deal for them. > They want the computers functional. That's nice. Hope they have spare drives.

Reply

[-]

Fatality@reddit

Who is going to get punished for data loss if the company doesn't exist?

Reply

[-]

beren12@reddit

iPads are encrypted. Apple has whitepapers and all about it.

Reply

[-]

Silent_Dildo@reddit

I destroy hard drives before anything leaves to be safe. I’ve heard that encrypting the drive (the entire drive, not just used space ESPECIALLY for SSDs which have wear leveling in firmware) and then formatting the drive and then clearing the TPM works very well, but I haven’t tested that personally. And it’s more work than destroying the drive with a hammer.

Reply

[-]

Fatality@reddit

For SSDs you can just wipe the partitions then run TRIM

Reply

[-]

Tzctredd@reddit

At what point are we going to take responsibility for the planet? Reuse those disks. Several people on this thread have given perfectly adequate methods to wipe out the data, unless you are legally mandated to destroy them and you can't wriggle yourself out of it please ensure they are reusable. Can anybody here point to a single case of data leaked from a disk that was cleaned up following best practices? The paranoia is quite something about this topic.

Reply

[-]

Fatality@reddit

What I think too, if there's no legal requirement to shred why do it? Encryption/TRIM/DBAN aren't new solutions.

Reply

[-]

vertexsys@reddit

Agreed. Wiping is more than sufficient. Somewhere in this thread is a mention of shredding ram. Absolutely insanely wasteful.

Reply

[-]

Dependent-Moose2849@reddit

I just did this for over 60 computers. I made several usb drives with the windows media creation tool. Booted to the usb drive chose install deleted the partitions and clicked next it makes new ones and reinstalls windows. Once it installs and reboots and gets to the setup screen you are done. It takes about 10 minutes per machine. It goes much faster than you think honestly.

Reply

[-]

jwinela@reddit

That does not wipe / sterilize the data. Some of the existing data would be wiped out by the install, but simple data recovery software (photorec etc.) could scan the unallocated space and recover whatever had been there before repartitioning.

Reply

[-]

Fatality@reddit

It's enough to wipe data from SSDs though (once they TRIM)

Reply

[-]

Dependent-Moose2849@reddit

Yes sure I agree it does not however I don't want to do a 25 time dod wipe routine on each machine to wipe out the data. I have done it before it takes days. If you have to have that level of scrutiny by all means for me in my situation it was not required.

Reply

[-]

Dependent-Moose2849@reddit

complete 0 Fill process will indeed do this a number of times. Takes a long time ..

Reply

[-]

Quick_Care_3306@reddit

We use ERA. They give destruction certificates and pick up the equipment: https://www.era.ca/

Reply

[-]

vertexsys@reddit

Honest question, because I don't see the ERA in the wild that often, do they pay for the hardware you donate or do they charge you for the services? Because they make a lot of money on the resale of hardware.

Reply

[-]

Quick_Care_3306@reddit

We didn't care about that. They work with law enforcement organizations, pick up, and provide destruction certificates. They take a problem off our hands and provide a trusted certificate of destruction.

Reply

[-]

vertexsys@reddit

Ok, thanks for that. I'm genuinely curious as I own a business in this space as well and operate in competition with the ERA in western Canada. It's interesting that you note they work with law enforcement, which is true - obviously that is a vote of confidence for sure. But they are not R2v3 certified. Any other ITAD worth their salt, including mine, provides pickup, audit and CODs - and we pay on top of that, or provide all services for free. I'm trying to win business from incumbents like the ERA, which is why I'm trying to understand the pain points and what features make one ITAD stand out against the rest.

Reply

[-]

Assumeweknow@reddit

Ssds literally just need windows 10 install on them. Once it runs for about an hour everything is wiped via trim. Personally, id get a few ssd drive copy tools start with 1 ssd and then copy that 60 times this works to fully format as long as everything has the same size drive. The servers its drill press time. Honestly they likely wont get much for the machines anyways. Bulk resale is roughly 30 to 40 percent of actual value.

Reply

[-]

jeremyrem@reddit

What about iPXE. Spin up a fog server or netboot.xzy

Reply

[-]

Itguy1252@reddit

Bitrazor. Boot up on flash drive and run. If you configure the WiFi in the image it will connect and upload the certificates of wipe. They have all the standards.

Reply

[-]

IconicPolitic@reddit

Do you or the MSP have an RMM? Ninja RMM has this automation built out. You might be able to find the exact script online. I was reading it just earlier this week but it might be account locked

Reply

[-]

Watcherxp@reddit

Holy shit, you have HIPAA info and aren't encrypted? Yikes!

Reply

[-]

Gedanken-mental@reddit (OP)

All the hipaa info is in a hipaa compliant EHR, but I don’t want to take any chances.

Reply

[-]

Watcherxp@reddit

Yah, as others have said, certified destruction is really the only responsible call here

Reply

[-]

PunDave@reddit

One type of datadestruction is to bitlocker the drive and delete the key before cleaning it and reinstalling it? From what i found hipaa requires encryption to begin with as well.

Reply

[-]

LokeCanada@reddit

You can not guarantee data is wiped from an SSD. It is the nature of the beast that there are sections that are not normally available. You need to destroy the drives to meet compliance. And you need it done professionally. That destruction certificate and inventory is your insurance for the future. Anything less and there is always a chance, albeit very small, that someone is going to have compromised data and point the finger at you, whether it is your fault or not.

Reply

[-]

MrCertainly@reddit

This right here -- needs to be the top comment. Same with spinning drives too. "Enthusiastic bad actors with bottomless budgets" can pull data off officially erased drives. It's just more expensive and takes longer, that's all. You can erase them to your heart's content, but then give the drives to a professional company that physically destroys the drives, grinds them, incinerates them, and stores the ashes at a secure facility. This is the only answer that insurance will accept.

Reply

[-]

beren12@reddit

Who? Has anyone ever proven you can recover data from an overwritten drive? Not in theory, but done it.

Reply

[-]

mrGood238@reddit

There are hundreds, if not thousands of companies all over the world which will attempt and in most normal cases (format, overwrite, damage to HDD/flash/optical/tape…) restore data for substantial fee. Most of them have no data/no fee policy so if they fail, you will not pay anything. Expensive and really good ones have electron microscopes and they will recover data from drives which were destroyed in fire, doused in water and then left for few weeks until someone realized that only record of something important was on that drive. I personally know for one case when drives were botched by malfunctioning RAID card and then damaged by unsuccessful repair/rebuild attempts by banks IT. Bill was massive (north of 100k €) but they restored basically everything.

Reply

[-]

beren12@reddit

Right, not erased. All of the “nation state” recoveries have been theoretical so far. Relevant: https://m.xkcd.com/538/

Reply

[-]

marklein@reddit

That's not exactly true. If they are BitLockered (and they should be) then reset the TPM and you're done. Otherwise hdparm is the go-to tool for nuking SSDs from orbit.

Reply

[-]

Sure_Acadia_8808@reddit

My expectation is that we're going to find out BitLocker was nerfed the whole time (either because MS wanted a backdoor or by accidentally -- because they laid off all the experienced devs who knew not to leave themselves backdoors), and that the backdoor keys were lifted when Russia, Iran, and North Korea went digging through their sock drawer repeatedly (or, you know, just never left) between September 2023 and March 2024.

Reply

[-]

stephendt@reddit

I highly doubt anyone is cracking bitlocker anytime soon.

Reply

[-]

Sure_Acadia_8808@reddit

the problem isn't "soon," really. It's "HIPAA data was on these drives that have been in a closet after the previous company that had this warehouse purchased a bulk pallet of discarded computers 10-15 years ago and then forgot about them." But knowing Microsoft's security practices, it could also be "soon." The problem is the lack of verifiability, and the fact that we can't see the future. Destruction is the only way to be sure.

Reply

[-]

SammyGreen@reddit

You’re right, cracking BitLocker’s actual encryption is really tough and hasn’t been done yet. But it’s been bypassed in other ways, like through weaknesses in hardware security or by exploiting things like cold boot attacks and insecure BIOS settings. It’s more about slipping through the cracks than breaking the lock itself.

Reply

[-]

stephendt@reddit

Humor me, how is any of that possible if you reset the TPM? The keys no longer exist... if someone finds a way to easily AES-256 we will have much bigger problems.

Reply

[-]

SammyGreen@reddit

Nope, not if you reset the TPM. Not that I know of. I’m not too worried about bad actors grabbing encrypted data at the moment. What I’m more paranoid about is down the line when (if) quantum computing becomes more cost-effective. AES is considered resistant to quantum attacks but not invulnerable. There’s a reason nation-states’ SIGINT is grabbing everything they can… they’re anticipating that future quantum advancements could potentially decrypt current encryptions.

Reply

[-]

stephendt@reddit

Also, I am yet to see evidence of any modern SSDs from 2017 onwards that were shipped in OEM systems and do not perform an ATA secure erase properly. Early on there were some consumer SSDs that had some issues but those issues have been long resolved as far as I am aware. If there are any unencrypted drives in the field, now would be a good time to get them encrypted if you want to be extra safe.

Reply

[-]

Frothyleet@reddit

This is correct if you try to use traditional methods. However, most SSDs, even non-enterprise, have firmware-level secure erase options which will actually hit all writable sectors, including ones that wouldn't have been presented to the OS. But, that said, it's always better to have drive encryption going and to just nuke the keys when appropriate.

Reply

[-]

Sure_Acadia_8808@reddit

Those secure-erase routines are proprietary and unverifiable. There's no way to tell whether they were actually implemented, or whether there are flaws in the implementation. The last thing we want to find out is that the secure-erase wasn't doing anything. Microsoft lied about their security for 15+ years, so I'd say it's pretty normal in the industry to fake your "security" these days.

Reply

[-]

nullpotato@reddit

I have far more trust in a shredder than drive manufacturers implementing erase features with no flaws.

Reply

[-]

stephendt@reddit

Unless the SSD is defective, an ATA Secure Erase is fine. If your drives are encrypted then you're fine as well.

Reply

[-]

BasicEmployee@reddit

This is the correct procedure for HIPAA and FERPA. Its the only way to 100% make sure data is not leaked, and the certificate of destruction from a third party is needed to CYA and the organization.

Reply

[-]

MyIntuitiveMind@reddit

As others have said remove and destroy the drives as it’s the only real way to ensure that there is no way that any data can be recovered.

Reply

[-]

jwinela@reddit

This is nonsense. There are a variety of ways to "shred" the data or otherwise render any existing data on the drives unusable. This thread covers many including encryption, dban, ata secure erase and etc.

Reply

[-]

wagneja4@reddit

Only way how to truly erase the data is to overwrite them with zeros

Reply

[-]

jwinela@reddit

This is directionally true, but not completely accurate. First, it is better to overwrite with random data than zeros, second ATA secure erase or encryption would accomplish the same task.

Reply

[-]

StudioDroid@reddit

I have been through several of these auctions of the place I worked. (not HIPAA though) The auctioneers did not any of the hard drives that had been used to be in the systems. The unused spares were okay for auction. They just did not want to deal with any of the potential issues.

Reply

[-]

chandleya@reddit

So much bad advice in here, makes me want to quiz my team. DBAN, DOD erase, and other overwrite software is completely ineffective at securely erasing flash. Flash has MANY tricks to get the performance you experience - some even treat an all zeroes action as literally nothing at all. You can do this for fun but for security it’s not much better than a quick format. All NVMe and most SATA SSDs have Secure Erase functionality - it’s an industry standard. Flash drives have encryption between the chips and the controller. This is always certificate driven. Secure erase will rotate the certificate, nullifying everything on it with AES-256. So while the file system may not have been encrypted, the raw 1s and 0s always were. If you must retain hardware, this is the way. But as others have said, fuck that. The drives should be destroyed. 256/512 SsdS are virtually worthless new or used. It isn’t worth the time, money, or effort. Given your limited time with the org, I’d be focused on making good, repeatable decisions into the future.

Reply

[-]

beren12@reddit

No way just send them all to me. They will be 100% overwritten by porn!

Reply

[-]

asdlkf@reddit

I would just build a bit RAID 69 array.

Reply

[-]

chandleya@reddit

Hahah you dawg

Reply

[-]

Sintarsintar@reddit

For SSDs/ NVMe's Nwipe is a bootable iso with the ability to save destruction certificates for each drive. A secure erase on a SSD is a few seconds long process and leaves nothing accessible ever since it charge pumps the nand packages, that sets every cell to 1s then 0s even non accessible to the OS cells that are behind the controller. For spinning rust those should be removed and shredded there's still a possibility to change the head offset and recover data in between the tracks.

Reply

[-]

docgreen574@reddit

Get yourself a copy of Parted Magic on a flash drive. Boot each computer into it, and then run Secure Erase. https://partedmagic.com/secure-erase/

Reply

[-]

ohfucknotthisagain@reddit

Sometimes, people don't get what they want. >They want the computers functional. Physical destruction is the safest method. If you want to be sure, that's the best way. That said, it isn't hard to do it via software. Enable Bitlocker on all the systems. You can do this today. If these machines are members of a domain, you can configure it via GPO (and publish the recovery keys to AD, just in case). Encryption runs as a background task so the machine remains usable. Good for users, but... This means it will take a while on older systems. Once you repartition or reformat an encrypted drive, the data is gone forever. Even the fancy $1000+ data recovery services can't bring it back. That's the whole point of encryption---no key, no data.

Reply

[-]

gregory92024@reddit

If I can't destroy the drives, this is what I do. Encrypt the drive, create a new user delete the old user, use the built-in wipe data feature. Almost completely unattended, so you can run many in parallel.

Reply

[-]

vertexsys@reddit

Sell the whole lot, wholesale, to a business that will audit, sanitize configs, peel labels and erase the drives with certificates. Like my business.

Reply

[-]

Crazy_Human1@reddit

There is a reason why my university requires all drives to be removed from all systems and physically destroyed in their 'hydraulic' press. Which is because it is the cheapest and fastest way to guarantee no data can be recovered.

Reply

[-]

DoctorMacDoctor@reddit

Send them to Iron Mountain or one of its many competitors, get a receipt of destruction, and coast from there. Your job isn't going to exist in a couple of months so there's no point in serializing a process that will only occur once. Your time is better spent looking for new work.

Reply

[-]

craigontour@reddit

Shred the drives as stated and don’t waste your own time and effort

Reply

[-]

ropsu25@reddit

IBAS. You buy the licens, boot from a usb drive, wipe it (and get a cert from every drive). And then install the image through PXE or use a usb drive again. Best part of IBAS is that you can use any PC that has sata ports and wipe them all at the same time when booting up from their OS.

Reply

[-]

asdlkf@reddit

DBAN. google it. It's a bootable USB drive image. Plug it into any computer, boot off if it, wait a couple hours. It will destroy any data on the machine. You can pull the usb drive out after the process starts, so you can do many machines in parallel.

Reply

[-]

HudsonValleyNY@reddit

What is the upside to this? Destroy them, preferably via a reputable company.

Reply

[-]

ChaosRandomness@reddit

I was in similar boat. If you goj g wipe all the way, use red key and it will erase everything no issues. Make 1 perfect image and then use acronis. It will literally copy paste the computer. I'm also assuming most computers being the same and on at least ssd. Basic image clone took about 5 min max per comp.

Reply

[-]

retro_owo@reddit

Why do the systems need to be reimaged with windows? Whenever we got rid of systems, they were wiped completely with no OS. It’s the surplus purchaser’s responsibility to install an OS, they’d probably just wipe whatever we install anyway. As for disk wiping, you can look into nwipe or shredOS. Though honestly that could take a long time because drive wiping as a slow process. We had a bench system that could wipe 4 drives at a time and, depending on how old they were this could take like 20 hours to complete.

Reply

[-]

beren12@reddit

What in 2001? Modern drives use encryption at the physical layer, secure erase throws away the keys. Takes about 30s, and you can read the raw sectors to make sure they are blank.

Reply

[-]

Outrageous_Device557@reddit

I would look for a new job or let them pay the msp to do it

Reply

[-]

Spidaaman@reddit

I’m picturing the scene in Silicon Valley when Gilfoyle pretends to be with geek squad to drill a hole in Dinesh’s old hard drive lol

Reply

[-]

zephalephadingong@reddit

Do you have to destroy or wipe the drives? The college is closing which means no more job. I would be spending the majority of my time job seeking and not worrying about if the work got done or not

Reply

[-]

CaptainofFTST@reddit

I just removed about 138 NVMEs from laptops and sold the laptops ‘as is’. All drives were completely shredded on the coolest machine I’ve ever seen. I received a certificate saying all drives were shredded and fully destroyed along with a video of destruction! We used a third party to do this to cover our asses.

Reply

[-]

Silly_Swan_Swallower@reddit

Pull the drives out, bring them to the desert, and use them as target practice with your .308 That's what I do.

Reply

[-]

chill_pickles@reddit

Functional doesnt mean that it has a boot drive installed, just that it would work with a boot drive and an OS

Reply

[-]

Secret_Account07@reddit

DBAN is a pretty effective way to ensure data is overwritten. If you are trying to make money off used drives that’s the way. Easy to use and effective. If there is confidential data on drivers, physical destruction is the way.

Reply

[-]

ScreamingVoid14@reddit

This is the way to meet the stated criteria, even if the stated criteria is problematic. DBAN + new OS ought to be fine outside the HIPAA and FERPA drives; those I would still destroy.

Reply

[-]

sadsealions@reddit

Second for DBAN. Then USB install of Windows 10. You need to touch each machine for about 5 minutes.

Reply

[-]

dfinf2@reddit

Dban does not work on ssds

Reply

[-]

look_mom_no_username@reddit

There's ShredOS, a minimal Linux OS that uses DBAN's successor, NWipe Supports NVMe, secure erase, generates wipe certificates, has different wipe methods and can run in bulk, from USB, PXE etc. https://github.com/PartialVolume/shredos.x86_64?tab=readme-ov-file

Reply

[-]

Secret_Account07@reddit

Oh wow, I just had to look this up and yeah, looks like it doesn’t for SSDs. Bummer. It’s been a few years since my desktop days, but now that I’m thinking all drives were platter at that point. Many optiplex hard drives I ran DBAN on lol. That kinda sucks. DBAN was a great, free tool.

Reply

[-]

stephendt@reddit

I mean it still most likely works, it's just not able to touch the spare area with conventional methods.

Reply

[-]

sadsealions@reddit

Learn something new every day

Reply

[-]

dfinf2@reddit

Hell yeah dude, best part about IT imo !

Reply

[-]

thephotonx@reddit

Quickly and Hippaa compliant don't go hand in hand. If you have access, a system center task sequence will do this happily, otherwise I'd probably be looking at a winpe/Linux boot CD and a script. You may also want to consider just reinstalling and turning on bitlocker, while getting it to encrypt the entire drive. Not sure if this is compliant though.

Reply

[-]

ScreamingVoid14@reddit

> You may also want to consider just reinstalling and turning on bitlocker, while getting it to encrypt the entire drive. Not sure if this is compliant though. Technically you don't even need bitlocker to encrypt empty space. The issue is that virtually all SSDs have more storage than are presented to the OS. Those are used for wear levelling and such. Any OS level solution won't hit those addresses. In theory you can use vendor software to instruct the drive to wipe those, but that becomes hit and miss.

Reply

[-]

Marteicos@reddit

Is it possible to just enable bitlocker on existing installs then get rid of the keys?

Reply

[-]

WilyDeject@reddit

I was thinking the same thing, but booting, logging in, turning on bitlocker (assuming you don't run into issues), then wiping will take more time than it is worth. Honestly, I'm surprised they aren't already bitlocker encrypted. Would negate pretty much this entire issue I'd think.

Reply

[-]

DoctorOctagonapus@reddit

> Quickly and Hippaa compliant don't go hand in hand. Yeah they do, it's called a pillar drill and a sledgehammer.

Reply

[-]

Borgmaster@reddit

You can use the windows deployment software to generate a basic setup complete with user account and bitlocker enabled on default. Super easy to do as the first time setup stuff catches the script from the usb root.

Reply

[-]

flip-n-irish@reddit

Fk them about reimaging in short time but make sure they are clean. The only guarantee is to take a drill bit to each as you pull them. They think it's easy to rebuild because your former team probably did good work. What are they gonna do, fire you. You are the expert, tell them the only way to be sure is destruction. If they demand, walk early.

Reply

[-]

IBuyBrokenThings2Fix@reddit

You can also run a cmd line script to pull up the OEM windows license that was part of the purchase to reactivate your vanilla windows machines.

Reply

[-]

MetaVulture@reddit

Hammer time. ![gif](giphy|Xdcj75alQutVe) Smash all hard disks

Reply

[-]

Kaxax98@reddit

https://i.redd.it/cf8tw3tux5jd1.gif

Reply

[-]

BasicEmployee@reddit

My preferred method!

Reply

[-]

mkosmo@reddit

Rifles are more fun.

Reply

[-]

linkslice@reddit

I have in my possession 2 sunblade 150s I bought 2 years ago. Sun stopped selling them around 2006. The disks still had all the data from the bank they were used in. I formatted one for a project. The other I’m just having fun perusing. Moral: pull the drives and have iron mountain dispose of them.

Reply

[-]

midnightdiabetic@reddit

Lots of bad advice here. Destroy the drives using a method that will satisfy compliance.

Reply

[-]

Ok-Condition6866@reddit

There bankrupt shutting down. They have no money to pay to shred them. Why they want to sell them. F em I would not waste time wiping takes hours and days. Pull drives and destroy them.

Reply

[-]

redditinyourdreams@reddit

Put all the drives in a barrel and burn them

Reply

[-]

chelseacalcio1905@reddit

Hammer works. It’s also fun.

Reply

[-]

IbEBaNgInG@reddit

I'm a rebel, kinda hilarious that you care. Some hacker probably already has all that data. The position that someone is going to dumpster dive, and go through the trouble to read the data from your hard drives is beyond hilarious to me. But "safety" and all. Good luck dude.

Reply

[-]

mcdithers@reddit

Get a giant vat of molten metal and dump the SSDs in there terminator style. Or, thermite is always an option. Real answer, in case your superiors are lame, hire a company to destroy them and get a certificate of destruction. That’s what we had to do after Caesars bought our casino.

Reply

[-]

GeophMan@reddit

We use HP in our shop. Each year we have to wipe 100 or so computers. In the BIOS HP has a secure erase option. I have no clue if that satisfies HIPAA or not. Anytime we have drives that might contain sensitive data, we request certificates. We also have a bunch of spare 256gb ssds we pull from the machines before upgrading then to 500gb and imaging. IF I had to do what you are about to do, with our HP machines, I would swap the drives, secure erase in BIOS, connect to a network and reboot. The computer recognizes it doesn't have an operating system, then a couple of clicks and it's reinstalling Windows automatically. If that wasn't an option, I'm telling the important higher ups that without sending the drives away for certificates, it's not possible to guarantee data has been wiped. Also if they want imaged computers they would need to pay for new hard drives, or they could sell them as is without drives and move on. Sorry you have to deal with that, best of luck to you in the future!!!

Reply

[-]

callmetom@reddit

Another vote to destroy the drives for all the reasons already started. If auction company wants them to boot to.prove they work, install Linux on a the cheapest USB key you can find.

Reply

[-]

Majestic-Speech-6066@reddit

You cannot sell a laptop with a drive that had hippa on it.

Reply

[-]

After-Vacation-2146@reddit

PXE Boot DBAN. You’d be done by lunch time.

Reply

[-]

PhReAk0909@reddit

Are they managed by an MDM like Intune or SCCM? that would be just a simple push of a wipe command to each of them at the same time (or 10 at a time as you only have 10 active ports)

Reply

[-]

corky63@reddit

Vendors push for drive removal and destruction because it makes them more money. They claim this is the only way to ensure data destruction without offering evidence. If the drives used encryption like Windows BitLocker then with a new Windows install that should be good enough. Those who claim it is not have no evidence to support their claim. Our computers have Windows Enterprise with BitLocker and when they reach end of life we install Windows Pro so that our recycle vendor can resell these computers. This is for a state government with about 500 computers per year.

Reply

[-]

stephendt@reddit

This is correct and I see it pushed all the time that hulk smashing drives or entire PCs is the only way. It's not, modern disk wiping systems on non-defective drives works without issue. If a drive is defective - smash away, but otherwise save yourself time, money and reduce waste by just securing data properly.

Reply

[-]

Japjer@reddit

All the drives need to be destroyed at a licensed facility, and you need a certificate of proof upon delivery of them. Don't reimage and sell.

Reply

[-]

cosmos7@reddit

> They want the computers functional. That's their problem. Proper drive wipes plus reinstall/reimage costs time and money, and isn't the generally accepted practice for disposition anyway. Drives can have unknown personal / HIPPA / sensitive info on them... they go in the shredder.

Reply

[-]

reubendevries@reddit

This is how I would do it. 1. Create Windows Image 2. Copy Windows image to a safe location, where it won't be touched, deleted, removed or modified. 3. Get or more USB A Thumb Drive and install [ShreadOS](https://github.com/PartialVolume/shredos.x86_64/blob/master/README.md) on it. 4. Insert thumb drive into computer, and boot into the OS, you can use that to securely delete the existing HDD or SSD on the computers. I would do the DOD short method (writes passes 1,2, and 7) if it's good enough for the DOD it should be good enough for your college. This could take some time so you may want to consider doing more then one computer at a time (which means using more then one USB A Thumb Drive). 5. Installed the new WIndows image on used computers. I wouldn't give anyone a 15 year old computer never mind sell it, but that's up to you and your employers.

Reply

[-]

chandleya@reddit

DOD erase is good for rust and meaningless for flash.

Reply

[-]

reubendevries@reddit

There is an option in ShreadOS for SSD.

Reply

[-]

Phreakiture@reddit

College of Saint Rose?

Reply

[-]

redundant_ransomware@reddit

Just start the encryption process

Reply

[-]

Gedanken-mental@reddit (OP)

So encrypt everything, then do a standard reformat and reinstall?

Reply

[-]

Frothyleet@reddit

This would take ages, requires all of these computers to have a TPM to do properly, and also, since they weren't encrypted from the jump, there are edge cases where recoverable data won't get encrypted (the same reason that application-level drive wiping is insufficient for SSDs - for wear-leveling purposes, the drive firmware does not actually expose all writeable blocks).

Reply

[-]

sambodia85@reddit

They have plenty of time, if you force enable bitlocker via group policy now, they will all be done well and truly by end of September. (Provided they are powered on.) Then they can reset the TPM and reimage from USB/PXE and call it a day.

Reply

[-]

Practical-Alarm1763@reddit

DBAN all the drives then throw them into an incinerator. Sell hardware as is without drives.

Reply

[-]

Frothyleet@reddit

I was about to say "DBAN doesn't work for SSDs" but your second step is sufficient without messing with DBAN anyway.

Reply

[-]

Practical-Alarm1763@reddit

Wait... really? Holy shit I never knew that lol It's been a long time since I've used it lol.

Reply

[-]

Frothyleet@reddit

It doesn't work because of wear leveling built into SSD firmware. Anything accessing an SSD at the application layer can't actually "see" all of the write sectors of that SSD. E.g., a 128GB SSD probably has 140GB of writeable memory, but the firmware, via TRIM, rotates where data writes actually end up to avoid wearing out specific cells and killing the SSD prematurely. As a result, if an application like DBAN says "Write 0s across the whole drive!", the SSD will say "OK!" but actually only write across 128GB of that drive, as it skips sectors that are being "benched" for wear leveling purposes. Most manufacturers have firmware utilities that will actually overwrite all of a SSD (or will blow away built in encryption keys).

Reply

[-]

redundant_ransomware@reddit

You mention that you have to wipe all unencrypted drives. Just encrypt them all then you don't have to do anything. It should be relatively simple compared to wiping every single drive

Reply

[-]

majornerd@reddit

This 100%

Reply

[-]

TechFiend72@reddit

non-helpful answer but if HIPAA is involved, why are any of your drives unencrypted?

Reply

[-]

Gedanken-mental@reddit (OP)

Like I said, past mistakes, made before I took over, will not be addressed here.

Reply

[-]

TechFiend72@reddit

I would suggest you throw them on a PXE network and blow images to them. Some smart young guys and gals on here can give you more specifics if you want to go down that road.

Reply

[-]

Frothyleet@reddit

This will not reliably wipe data to a degree sufficient for compliance.

Reply

[-]

TechFiend72@reddit

they are already breaking the law. The only way to clean this up if they are using SSDs is to destroy the drives. Everything else is just messing around.

Reply

[-]

chandleya@reddit

Patently untrue. ATA/NVMe secure erase - where present - revokes the chip level encryption certificate on the drive. It takes a couple of seconds and it’s concrete outside of some wild vulnerability in the certificate keying process. G

Reply

[-]

whocaresjustneedone@reddit

Were you just hired this week? I bet there's been time to remediate that "mistake"

Reply

[-]

Mobile-Guitar6565@reddit

Use Acronis then initialize disk wipes it blank.

Reply

[-]

upperVoteme@reddit

don't are they going to fire you?

Reply

[-]

EastcoastNobody@reddit

most modern laptops and desktops have thier own Wiper built into the bios.

Reply

[-]

apathetic_admin@reddit

It'd take a little time, but you could build a FOG host and a Windows 10 image, and get them all registered, pxe boot them all to be wiped (that's a bootable option) and then reimage with FOG.

Reply

[-]

th_teacher@reddit

> They want the computers functional. That's a hard NO from you. Will not be possible.

Reply

[-]

waddlesticks@reddit

Just to add on, if they push you to keep the drives. Encrypt the drives first (if not already) then do a few wipe passes if you'd like. The general factory wipe would do the trick and the data. One wipe pass would be good enough. If they don't just enable it to do the full drive, then wipe it. That will work best though if it's a TPM machine, the others would be better to just destroy unless you really want to do a lot of passes to make sure the key is totally removed.

Reply

[-]

MrPotagyl@reddit

Usually no need for specialist software. It depends on the model, for SSDs and NVMe drives, there's usually an option to secure wipe in the BIOS. For old fashioned HDDs, you just need to zero them with Diskpart. If you doubt that's sufficient, go read what NSA, NIST, GCHQ etc recommend, they don't feel there's any need to go beyond that for most sensitive government kit.

Reply

[-]

IkouyDaBolt@reddit

If the hard drive has bad sectors, a diskpart clean all will not address them. Using the Secure Erase ATA command should cover them.

Reply

[-]

Minimoua@reddit

If you still need to reimage the pc after disk destruction, easy to create an autounattend to fully automate windows install. Simpliest is probably : https://schneegans.de/windows/unattend-generator/ Use bypass everything, create a local afmin account without password, and make it log on 1st boot. Put the autounattend.xml on the root of each usb drive containing your win10 iso. The only thing you have to do for each pc is plug the usb drive, boot from usb and remove the usb drive after 1st reboot (or whenever you want).

Reply

[-]

Useful_Transition883@reddit

It’s just 60. Get a degausser and an intern

Reply

[-]

CuriouslyContrasted@reddit

Most nvme and ssd drives are actually encrypted by default at the hardware layer. All you need to do is get the mfg twice utilise that overwrites the stored decryption key with a new one. Unrecoverable.

Reply

[-]

WilyDeject@reddit

Somewhat of a joke answer/anecdote: update the SSD firmware and yank the power part way through. That did a number on a drive for one of my former users. Spent hundreds of dollars to send it off to a reputable recovery lab and they couldn't get anything off of it.

Reply

[-]

AdministrativeAd1517@reddit

I used to use Active Kill Disk in a health care setting to do secure wipes. We had a PXE server and everything. I bet it still works to this day. But then we had a separate pxe server for windows. Maybe a good way to deploy over the network? Idk it’s been a minute since that was the standard lol.

Reply

[-]

Aeeaan@reddit

I second KillDisk. It will generate a nice certificate for you at the end saying the drive is wiped. But better to destroy as others have said.

Reply

[-]

CarlSpaackler@reddit

Time to get authorization to buy a drill press and some decent bits. Drill baby Drill. Kill the drives that way and sell without as others have mentioned.

Reply

[-]

Jwatts1113@reddit

Hydraulic press will save you the cost of bits and works well

Reply

[-]

NightMgr@reddit

For some personal drives I took the to a friends warehouse and a forklift crushed them pretty well.

Reply

[-]

Zjacer@reddit

Hi, as many wrote there: destroy the disks\*. It's often being done even if you potentially don't store any health data. Just for company's safety. IF and only IF supervisors don't agree, send them e-mail explaining what might be the consequences (we can help you here) and get their reply. But you are IT director, so I'm pretty sure you know that verbal agreements mean nothing if someone must take responsibility. They won't. If you are going to wipe these disks, most likely you want to proceed with some standard (and 3rd party application). Nice article here; [https://www.blancco.com/resources/blog-comprehensive-list-data-wiping-erasure-standards/](https://www.blancco.com/resources/blog-comprehensive-list-data-wiping-erasure-standards/) Also, kinda weird, I never worked with external compan buying hardware from us, which required laptops to be provisioned as re-imaged (what in case you deliver these with some 'extra' stuff, like keyloggers, etc?). However, I worked with companies which offered to buy these devices and wipe disks. You sign contract, they wipe disks, they provide you certificate. We paid 6 EUR / device 2 years ago in Germany as far as I remember. If there is data leak, responsibility is on them.

Reply

[-]

cbelt3@reddit

As others noted…. NO. Surplus computers have little value. They should be destroyed. The licenses are not transferable. The data is super confidential. Never ever ever should see the light of day. AND… there may be a legal requirement to maintain records. Bankruptcy lawyers need to weigh in. This is big no from me, dog. Side story: I once bought a couple of surplus macintoshes from a local second hand store. They contained a ton of very confidential data about a Dortune 50 CEO and presidential candidate. Because the person “reformatting it” just dragged documents to the trash. And didn’t empty it. I wiped the heck out of that data.

Reply

[-]

M-G@reddit

Back in the 90s I went to a surplus auction for a medium-sized city. Most of the systems they were getting rid of were PS/2s. Oddly, none of them had any RAM, but still had hard drives. At first, that seemed strange, as it wasn't like the memory would be useful in other machines. Someone said the city policy was to remove memory before disposal. The geek hive-mind quickly came to the realization that there was likely a policy written by someone who called the drive "memory" and someone else followed the policy to the letter...

Reply

[-]

Steebo_Jack@reddit

I'm actually doing this right now and I have partition magic with dban and it takes about two hours per 256gb drive...just create a bunch of USB drives...I have a second set of usbs to install w11 pro. Our data isn't all that critical but I still wipe...

Reply

[-]

Steebo_Jack@reddit

Parted magic

Reply

[-]

downundarob@reddit

Is there not something in Microsoft Windows Licensing that says you cant pass the license on, you may need to check that. As for sanitation, the last time I did this was with Darik's Boot N Nuke (DBAN)

Reply

[-]

981flacht6@reddit

You can setup a PXE environment with mDART tools and wipe them all in pretty easily.

Reply

[-]

981flacht6@reddit

Stand your ground and say destroy it or find someone else.

Reply

[-]

SpeedImaginary9820@reddit

Shred the drives and sell as is. Saves you time and potential HIPAA breach.

Reply

[-]

guydogg@reddit

Same thoughts from me. Shred the drives, get the sign off document, and you're done.

Reply

[-]

b4k4ni@reddit

For the delete part - any modern laptop or machine should have SSD secure erase. This takes not long (bios, enable delete, reboot, start delete, done) - a few minutes at best. But it's secure erase, so there won't be any data left.

Reply

[-]

Aacidus@reddit

They really want them re-imaged? When I buy PCs from auction sites, it's always with no OS. Would save some time.

Reply

[-]

Darkace911@reddit

The folks at Shredit can destroy the drives.

Reply

[-]

Bolyki@reddit

Hi Just wipe them. Don't worry about the data. Teachers told not to put personal data on computers. "teaching" data is not really anything what would be used against you and if shit hits the fan, you won't be around there anyway. Do the bare minimum on your last months.

Reply

[-]

identicalBadger@reddit

At my work, any drive with protected data is shredded by a 3rd party, we get receipt and video. Mind you the drives are all encrypted to start out with, but it’s cheaper to do it this way than run the risk of accidental disclosure.

Reply

[-]

TheMartok@reddit

Yep destroy them … damn it feels good to be a gangster

Reply

[-]

Nick85er@reddit

Intune Wipe (Managed restore)/Re-Image every iOS device. Period. Ensure the "Hello" screen accepts new login. Good to go. I would also fully remove the drives, and sell the lappy hardware as-is. Ensure they're fully removed/disabled in AD and/or intune/autopilot. Or whatever management utilities you work with to manage endpoints.

Reply

[-]

hops_on_hops@reddit

Ask the msp how they plan to handle it. Get compliance statements in writing. Done. You already made the call to outsource the IT work, so outsource it, and enjoy your golden parachute.

Reply

[-]

bornnraised_nyc@reddit

Just open every device, pull the drive, document the SN, and physically destroy it. Don't waste your time formatting and reinstalling windows!

Reply

[-]

randomuser135443@reddit

If the college is shutting down are you getting laid off? If so then why worry? It will literally not be your problem.

Reply

[-]

Gedanken-mental@reddit (OP)

I’m not laid off until the IT work is done. If I don’t do the work, I get laid off sooner and don’t get my severance package.

Reply

[-]

tryfor34@reddit

Are you in Northeast PA?

Reply

[-]

Gedanken-mental@reddit (OP)

Nope

Reply

[-]

KittensInc@reddit

Do you also have a plan for the data that **shouldn't** be destroyed? People lose their own copy of their college transcripts due to things like house fires, and students almost certainly haven't transferred their medical data - but it might later be needed. Is there a plan in place to transfer data like that to a successor so that it isn't permanently lost when you take out the sledgehammer?

Reply

[-]

das0tter@reddit

I would run this past legal. Depending on the nature of the wind down, the company has potentially competing fiduciary obligations. If this is a bankruptcy and there are unpaid creditors, the school has a duty to maximize recovery. That recovery obligation may be at odds with best practices for HIPAA. Bottom line, the risk/reward decision here should not be yours as IT Director, but instead, someone who is a director of the entity and therefore covered by directors and officers insurance.

Reply

[-]

NoRomBasic@reddit

I won't add to the already good advice you have received here, but for what it is worth, I was CIO of Saint Joseph's College when it suspsended all operations in 2017 and remained for about 2 years after to see the wind-down through. My heart goes out to you.

Reply

[-]

AnnoyedVelociraptor@reddit

PSID revert. All SSDs need to randomly write data to the chips to ensure all cells wear equally. How can you ensure randomization? You encrypt. The whole idea of encrypted data is that it is indistinguishable from random data. So SSDs with PSID revert do this. And the PSID revert resets the internal encryption key.

Reply

[-]

AistoB@reddit

Definitely destroy the droves, besides 80 used desktops? What are they gonna get at auction $2k at most?

Reply

[-]

JustHereForYourData@reddit

You’re the Director of IT?

Reply

[-]

NoyzMaker@reddit

They likely never specify what OS so just load a Linux distro on it

Reply

[-]

thomasmitschke@reddit

I you know what you are doing, the ssds and nvmes must be wiped with their own vendor specific procedure. If not, destroy them - best would be a specialized disposal company that shredders them. If the drives were encrypted, just initialize the TPM and re-format them.

Reply

[-]

TinderSubThrowAway@reddit

buy the cheapest new drives you can and replace them all. take the old ones and have them physically destroyed. No computer older than 3(maybe 4) years should be bothered to be redone and sold, so that will cut down on drives needed. Skip the NVME on the replacements, just get all spinning HDD, the new owner can upgrade if they need/want to.

Reply

[-]

Wuss912@reddit

DBAN :)

Reply

[-]

jonchihuahua@reddit

Well, HIPAA , can’t reuse the drives.

Reply

[-]

pdp10@reddit

> They want the computers functional. You should strongly consider making an executive decision that a fully-wiped computer is functional. It can be booted with removable media if anyone wants to check it. Retail OS licensing won't follow the hardware anyway, and OEM Windows licensing will follow the hardware even when it's wiped. That's the *easy* part. Deciding what, if any, data needs to be retained on archive media, is the hard part. There's got to be tax and compliance records that need to be kept, for example.

Reply

[-]

illarionds@reddit

This just can't be worth your time. Destroy the drives (because liability), don't bother doing installs, just not worth it.

Reply

[-]

OhioConfidential@reddit

Any chance this college is in Cincinnati?

Reply

[-]

usa_reddit@reddit

I agree keep and destroy the drive and sell without drives. Will be faster to pull drives than mess around doing military grade wiping.

Reply

[-]

AnthonyG70@reddit

Was Bitlocker enabled and they were domain joined with decryption key saved on DC? If so pulling drive is about all you need to do. However, we typically go into BIOS and run secure wipe (Dell and Lenovo here), and be done with it. Once donated the drives are blank and even if someone restored data it was Bitlocker encrypted. Also check if you have a Blind Center in your area. They are 501c3 and can do wipes for you at a fee. Win for school as a tax writeoff and helps communities with refurb and resale of hardware.

Reply

[-]

AnthonyG70@reddit

Was Bitlocker enabled and they were domain joined with deceyption key saved on DC? If so pulling drive is about all you need to do. However, we typically go into BIOS and run secure wipe (Dell and Lenovo here), and be done with it. Once donated the drives are blank and even if someone restored data it was Bitlocker encrypted. Also check if you have a Blind Center in your area. They are 501c3 and can do wipes for you at a fee. Win for school as a tax writeoff and helps communities with refurb and resale of hardware.

Reply

[-]

changework@reddit

So, I’d look at this presuming every system is currently connected and operational. Push out a bitlocker encryption script to the lot of them with a big random password or pin. This will wipe all the data upon reimagining. Setup a pxe server (just download the docker for it) and boot everything to clonezilla client that’s waiting for an image. Prep one machine with Win10, image it, then distribute it to all your machines through clonezilla. Prior data on the drive was encrypted so there’s no problem there. Document your process for legal reasons. This presumes of course that states can not iPXE, or you have a lot of thumb drives you can boot CZ from.

Reply

[-]

S70nkyK0ng@reddit

Recycle the drives by a vendor who provides certified data destruction. Maintain the certificates for compliance and insurance.

Reply

[-]

MJZMan@reddit

Since you're dealing with HIPAA & FERPA data, you'll want to format iaw DoD 5220.22-M to truly cover your ass. There are utilities available that will meet this spec. I think the Govt offers a free one, but I'm not sure on that. That said, the 3 pass method will take a couple of hours depending on the drive size. If you opt for 7 passes, it can be almost 18-24 hours per drive.

Reply

[-]

FauxReal@reddit

Talk to the legal department and make a case for removing the drives and destroying them.

Reply

[-]

H2OZdrone@reddit

Destroy. I’m in the middle of destroying 3000+ drives both encrypted (PC) and unencrypted (server). For true certified destruction along with chain of custody, figure $9-10 a drive.

Reply

[-]

Dar_Robinson@reddit

Get some small USB drives. Install Ventoy on them . Copy "ShredOS" to them. Boot, wipe, save PDF to the USB for any audit

Reply

[-]

Beavis_Supreme@reddit

Blannco if they are willing to purchase anything. It will process a certificate of destruction which you need if anyone ever had to audit these action. You lauch it from thumb drive but have it connected to Ethernet to upload the cert in the console for auditing purposes. Bleachbit is free but not cert. You could also have shred it come pickup the drives and destroy them but its expensive. If you are not worried auditing uses a hammer or drill to destroy them.

Reply

[-]

sugar_bear65@reddit

Put a bullet or two in each drive. Data still can be recovered after wiping the drives

Reply

[-]

Dar_Robinson@reddit

Pull the drives and physically destroy them.

Reply

[-]

namocaw@reddit

I hope they are paying you a fat bonus up front for staying on to the end.

Reply

[-]

jpm0719@reddit

format c: not a thing anymore :)

Reply

[-]

woodsbw@reddit

Like others have said, just enable Bitlocker and don’t save the key. Also, down break your back for a company that, explicitly, isn’t going to be paying you soon. I have seen to many people get into the position of being the sysadmin that shuts off the lights and kill themselves trying to pick up the slack. Work your 40 and go home unless they are massively upping your pay to compensate.

Reply

[-]

Ohmystory@reddit

Capture serial numbers of the device ( take pictures ) remove the drive and capture the serial number on the drive ( take pictures ) and drill three holes in the drive ( take pictures ) Then send drive for recycling… Then you will have evidence for drive destruction … put this info on a usb stick and a secure cloud storage for HIPPA audits…

Reply

[-]

Ohmystory@reddit

That is what we have done in our data Centres but we engage an a contractor to do hdd destruction on side and provide us with certificates of destruction ( to cover liabilities)

Reply

[-]

bhambrewer@reddit

Pull the hard drives /SSDs and bulk shred them. Job done.

Reply

[-]

Bubby_Mang@reddit

There aren't any TCP's requiring that you zero-fill the drives is there? Ouchtown population, you, if so.

Reply

[-]

PacketMover@reddit

Why re-image and not just wipe? If those weren't OEM licenses that came with the laptop I don't think the Windows license transfers (but then MS licensing is not my area of expertise)

Reply

[-]

sryan2k1@reddit

Enable bitlocker, ensuring it is "all space" and not just used space. [https://support.microsoft.com/en-us/windows/create-installation-media-for-windows-99a58364-8c02-206f-aa6f-40c3b507420d](https://support.microsoft.com/en-us/windows/create-installation-media-for-windows-99a58364-8c02-206f-aa6f-40c3b507420d) Create a bunch of USB sticks with the tool. Reimage them after bitlocker is done. Drivers are someone elses problem.

Reply