JustInTime, I'm with you -- this is a fascinating and increasingly important topic. Unfortunately, the proliferation of storage media and evolution of drive architectures have led to some confusion and misapplication of older research results. The multiple-pass wipe (DOD 3-pass, Gutmann 35-pass, etc.) is a case in point. These protocols were based on the results of research using previous generations of magnetic storage media, including a very influential 1996 paper by Gutmann. (You can get his paper at https://www.cs.auckland.ac.nz/~pgut0...ecure_del.html. For a brief non-technical critique of it, check out Can Intelligence Agencies Read Overwritten Data?.) Today, however, the general consensus is that multiple passes really aren't necessary for most modern drives, due to their encoding methods and higher data density (narrower tracks). Of course, if someone is in the business of sanitizing hard drives, and a client requests a protocol that might be more stringent than necessary, it's probably easiest just to go with their preference -- and price the job accordingly.
Secure Erase is actually code that's embedded in the firmware of all ATA drives > 15GB produced since the early 2000s, as mandated by the NSA and incorporated in the ANSI spec for the ATA interfaces. SCSI drives now usually include it as well, although I think it might still be optional. The most basic implementation of Secure Erase, as developed by CMRR under the sponsorship of the NSA, essentially just overwrites all user data areas with binary zeroes in a single pass. Manufacturers have developed their own proprietary implementations, some of which include multiple overwrites, etc. Using Secure Erase (or its variants) is not identical to performing a software-based single-pass overwrite, however. Secure Erase can access the entire drive, including bad sectors (the g-list), the Host Protected Area (HPA), and the Device Configuration Overlay (DCO). Some other benefits, especially in a high-volume environment, are that it's purportedly 8-18 times faster than other methods, and it doesn't consume system resources since the code is embedded in the drive's firmware and executes on the drive only. That means you should be able to Secure Erase multiple drives concurrently on a single system.
Bookmarks