How to securely sanitize data tapes, and audit the results?

Question

I work at an electronics recycling facility and we were just presented with an offer from a client that would like to buy our used data tapes. Our problem is that we have never sanitized data tapes as we have only shredded them in the past. I need to know if data tapes have the same properties as traditional rotating magnetic media where a DOD 3-Pass wipe is sufficient to sanitize the device or if there is any hidden dangers that we must be aware of.

The only way we can move forward with the deal our client has proposed is if we can 100%, without a doubt, know that the data is unrecoverable. On top of that we must have a method to verify that the data has been successfully sanitized, and there is no remnant previous user data.

Typically we would use a hex checking program for checking our hard drives after they have been sanitized, but I'm not sure if that will reliably work for data tapes. If anyone has any experience with sanitizing data tapes (other than degassing, or shredding) please let me know how the task was completed.

Answer 1

Regarding the reuse of recycled tape; the business may appear sound but the technical parts are not. Even apart from the issue of securely wiping data, it is hard to determine if tapes were properly stored before they were sent to you for recycling. Magnetic tape is susceptible to mold damage if stored in high humidity conditions.

Unless it is used for forensic(skim data using non-traditional method) or other research purpose, the next viable step of recycling magnetic tape material is to create counterfeit/ after market product or even "refurbished as new".

Use of research or forensic techniques to recover data means that data not recoverable by normal methods doesn't mean the data can't be recovered at all. Any method that claims safe wiping of data by today's forensic standard may also be insufficient for future forensic methodologies.

If your facility signs any sort of strict data destruction agreement with a client, reuse of the client's tapes should be avoided at all costs. Your business would risk major legal liability if someone could prove your data destruction destruction facility didn't destroy the tapes.

Answer 2

For modern hard drives, 3-pass is overkill as explained here:

for ATA disk drives manufactured after 2001 (over 15 GB) clearing by overwriting the media once is adequate to protect the media from both keyboard and laboratory attack.

But for older magnetic storage media it might be nescessary.

So as this guide here explains:

To “sanitize” or “eradicate” LTO media and keep the servo tracks intact, the only method available has been to re-write over the existing data.

Conclusion: The DOD 3-pass ( zero out, random data, inverted random data) will do just fine. This will even be fairly robust against electron-microscope recovery. If you need an absolute, state-actor-with-unlimited-budget-proof 100% guarantee, physical destruction is the only option.

Answer 3

This is primarily a legal problem, not a technical problem. You have no idea what kind of sensitive data may be on those tapes. It might be medical records, tax forms, employment records, credit card numbers, or other highly sensitive bits.

Unless your existing contract with the clients who are sending you the tapes to be recycled specifically states "used storage media sent for recycling may be resold to third parties" and "Electronics Recycling Corp is not responsible for the security of any residual data on media sent to us for recycling", you shouldn't move forward with this. Written or not, your existing clients may have an implicit or verbal expectation that their old data is secure.

Think about the risks. What if you're wrong about your technical solution, and data is recoverable anyway? Or worse, what if you are right, but the kid who unloads tapes from trucks on the receiving dock drops one in the hallway in front of the shipping dock, and it ends up going out the door unwiped?

One mistake and your company could be the subject of a destroy-the-business lawsuit. Even if it doesn't go to trial, your clients would be mad, and your reputation as a place to send stuff for recycling would be ruined.

The potential profits will likely never outweigh the potential risks.

Answer 4

As everyone else has said, the legality of reselling storage media is a valid concern. But I think it is worth considering that a company serious about data security will either not be selling you tapes, or will have erased them before they left the premises since there is no reason they should trust you.

Since people are recommending using dd to overwrite, which assumes you have a drive/computer setup, the internal erase command of the drive should be worth considering. If you're on linux (your device may vary, I have a SAS drive):

mt -f /dev/nst0 erase

Since there is no data transfer involved, it's fast and you don't have to worry about ideal block sizes in order to get that speed. It will also leave the tape truly empty, if you dd then there will technically be a file on the tape, including the beginning and ending marks. If you try to read an empty tape nothing will happen, but if you try to read a dded tape, it will read the whole tape.

There is also the problem of compression, LTO drives automatically compress incoming data unless explicitly told otherwise. You may need to send a lot of zeros to actually fill it.

Edit:

I tried streaming some zeros to an LTO 3 tape I had available. The drive is a Dell (IBM) LTO 4 SAS drive. LTO 3 does ~80MB/s raw. pv < /dev/zero | dd of=/dev/nst0 bs=256k streamed at ~100MB/s with the drive spinning up to its lowest speed for less than 2 seconds at a time, with long waits between. I stopped after 3GB.

Answer 5

I suggest the DOD 3 pass and a full read as a final check the 3 passes overwrote it fully. On a Unix system it is easily performed with the dd command with a bs=200k (tested as efficient on tapes, a much larger one might be tested on DLT):

dd bs=200k if=/dev/zero of=/dev/rmt0
</dev/zero tr "\000" "\377" | dd bs=200k of=/dev/rmt0
dd bs=200k if=/dev/random of=/dev/rmt0

On a Unix system a simple

dd bs=200k if=/dev/rmt0 of=/dev/null

will fit to check that the 3 passes fully wrote the tape.

If this last dd displays the correct number of writes seen in the 3 first passes, then this means that the EOT was written at the end of tape. If this last dd fails, then the tape has to be degaussed and is unusable = can't be sold.