The accusation is a pretty serious one: IT departments are still disposing of hard disks without ensuring the drive has been properly wiped of sensitive data. Only this month came news that from a random sample of hard drives bought second-hand in the UK, US, Australia and Germany, not only could data be retrieved from them, but some contained enough information to identify former corporate owners.
The problem is that many companies still don’t have procedures in place to wipe drives to industry-secure standards. Too often, it seems, the task of looking after old drives is handed to inexperienced or hassled staff who naively assume that the DOS “format” command will do the job.
As its name hints, Blancco’s File Shredder is an application that can handle day-to-day data deletion tasks at a workstation level. File Shredder is not a low-level data destruction tool for use in drive wiping as such, though the company does produce software for this purpose in the form of Data Cleaner+ (we’ll review this in the coming weeks). That works from a CD used to boot the drive before its contents are securely wiped.
As simple as file shredding sounds, it is best thought of as the first layer in securing data from unauthorised recovery, with full drive wiping a stage up the stack. It is about good practise. The best way to secure the data that sits hidden on a drive (including external drives such as USB sticks) is to wipe it both as it accumulates as well as at the point a drive is disposed of or sold on.
There are a wide range of tools that claim to be able carry out this task, but what separates File Shredder from bewildering number of equivalent products is its thoroughness.
With File Shredder, data can be deleted from a drive’s surface using any one of 13 different algorithms, which basically overwrite the disk a set number of times. The greater the number of overwrites, and the complexity of the process used, the longer the wiping takes, so it is all about setting a security priority on what might be retrievable.
The algorithms suggested for straightforward file and directory wiping are HMG-baseline (a UK government standard), and separate algorithms from security notables Bruce Schneier and Peter Gutmann. The latter is said to overwrite data up to 35 times for the maximum paranoia approach.
Objects to be overwritten are existing and deleted files (including, optionally, the free cluster “slack” reserved by a file but not used by it), system temp files, and the free space that the FAT tells Windows is available for storage. All can contain traces of confidential, old data, not visible to the operating system, and therefore the user.
Shredding can be automated on a daily, weekly or monthly schedule, or each time the PC is started, but a superb feature is the ability to specify a wide range of command line scripts to be used when the program starts in this mode. For instance, using a dialog box you can set up which sequence of drives to shred, which algorithm to use, and what to shred (temp files, recycle bin, specific directories, or the whole drive).
This automation allows a data wiping profile to be set up and left alone with the same set of commands to be applied were the GUI being used manually. The scripting parameters are well documented so this should be very easy to apply. At the end of this, a log file can be studied for any errors, and for confirmation of what was done.
We did not go to any lengths to retrieve data that had been wiped, but a commonly available tool showed that it was doing its job. Properly applied, the free space on the test disk had been emptied of retrievable data.
It’s ornery to level a criticism at a good product such as File Shredder, but we’ll level one nonetheless. The program offers you 13 drive overwriting algorithms, but doesn’t offer much information on any of them. What makes Bruce Schneier’s algorithm so great then? It is hard to tell what without doing independent research.
When making the appropriate choice, it would be nice to be able to assess these formal and informal standards with better information, possibly in a help file. At the moment, the help button leads to a website page from where a support email can be despatched to the company.
That said, this is a simple-to-use but powerful program for the tending of a drive on an ongoing basis. We’d highly recommend it, more so given its highly reasonable price. By all means encrypt data as a first line of defence, and wipe every old disk till the read/write heard pack in, but don’t let that rule out a file deletion system to use in the meantime.
Blacco’s website can be visited here.
So many file deletion programs, so little time. Make sure they offer a good variety of wiping options, and preferably explain the consequences of each. A company that produces a range of data wiping products should be considered a contender.