Data Destruction

If you are responsible for dealing with end-of-life media, you will know that the ever-increasing range of media formats and associated destruction standards can be challenging to deal with effectively. Every device needs to be destroyed to the appropriate specification and this process must supported by detailed and searchable destruction reports that are accurate, fit for purpose and audit ready.

Using the widest available range of processes, CriticalData can design and execute a comprehensive media destruction plan that will meet your precise needs, backed by almost two decades of trusted data expertise.

Enquire about our Destruction ServicesCall Us

FULLY OBSERVABLE ‘BELT & BRACES’ APPROACH

Critical Data uses a twin-tracked approach to guarantee complete inaccessibility of data. Firstly, we destroy all magnetic data using a degaussing process following which we destroy the physical media by shredding or disintegrating.

We approach your end-of-life data management project as data and media experts, and we can deal with your project onsite or offsite to meet your policy requirements. Having spent almost 20 years at the forefront of data recovery, we understand exactly what it takes to put data beyond recovery.

Most of our competitors are traditional paper shredding businesses or e-waste brokers, usually more interested in your hardware assets than in your data security. Our focus on data security is always front and centre. The hardware assets are an entirely different consideration, and not of direct interest to us. Of course, we will be very pleased to help with those requirements too if you need a single-source solution for both destruction and e-waste management.

Dealing with the widest range of legacy and contemporary media formats, our onsite process solutions enable us to deliver unmatched particle sizes, down to as small as 2mm particle size for data-bearing media.

Our unique onsite deployment is operated by data experts, and offers unique ‘go anywhere’ agility, even into low-clearance basement service bays where our competitors’ vehicles cannot fit!

Critical Data is different in many ways, notably due to our heritage in understanding all media formats, from legacy to future.

In the past, hard drives dispositioned for destruction were either laptop or desktop-sized electromagnetic drives. A fixed shredder fitted inside a truck could effectively handle these types of hard drives, albeit at the kerbside. The fixed geometry of the shredder produced an acceptable standardised particle size, perhaps in the range of 15-40mm.

However, modern data storage devices present multiple complications. The biggest contributing factor is device miniaturisation, which means that small, yet high-capacity media can pass through the jaws of a traditional shredder without being properly destroyed, therefore presenting a major data risk. The reality is that there is no longer a single destruction process that can cater effectively for all device types. Our range of mobile processes have been designed carefully around the recognised DIN66399 Standard to provide the level of assurance that traditional shredding services just cannot.

Consumer-grade Laptop HDD (2.5″ IDE/SATA)

These devices usually contain glass platters which will shatter when the device is shredded. As a result, our process will deliver a DIN66399 H-5 destruction compliance result.

For maximum peace of mind, we will first have degaussed each hard drive before we physically destroy it. Where possible, this will be completed within your premises under client supervision so that devices do not contain data as they move to the physical destruction phase.

Consumer-grade Desktop HDD (3.5″ IDE/SATA)

These devices usually contain aluminium platters which will tear when the device is shredded. As a result, our process will deliver a DIN66399 H-4 destruction compliance result.

A DIN66399 H-7 result can be achieved by platter disintegration, which is an available option, though significantly more costly as it involves disassembly of each hard drive.

For maximum peace of mind, we will first have degaussed each hard drive before we physically destroy it. Where possible, this will be completed within your premises under client supervision so that devices do not contain data as they move to the physical destruction phase.

2.5” Enterprise-grade HDD (SAS, NL-SAS,SATA)

Similar to their consumer-grade counterpart, these devices usually contain glass platters which will shatter when the device is shredded. As a result, our process will deliver a DIN66399 H-5 destruction compliance result.

For maximum peace of mind, we will first have degaussed each hard drive before we physically destroy it. Where possible, this will be completed within your premises under client supervision so that devices do not contain data as they move to the physical destruction phase.

3.5” Enterprise-grade HDD (SCSI, SAS, SATA)

Just like their consumer-grade counterpart, but with sturdier construction and additional heat sinking, these devices usually contain aluminium platters which will tear when the device is shredded. As a result, our process will deliver a DIN66399 H-4 destruction compliance result.
A DIN66399 H-7 result can be achieved by platter disintegration, which is an available option, though significantly more costly as it involves disassembly of each hard drive.
For maximum peace of mind, we will first have degaussed each hard drive before we physically destroy it. Where possible, this will be completed within your premises under client supervision so that devices do not contain data as they move to the physical destruction phase.

USB Memory Keys

Capable of high-capacity data storage, these devices must be granulated (disintegrated) using a process capable of particle size of 4mm2 to guarantee data security. Every data bearing memory chip must be disintegrated to attain a higher DIN66399 Class 2 destruction compliance result. In a standard industrial shredder, there is a high risk of the microchips passing through the shredder intact due to their small size.

Solid Sate Drives

These drives use cascaded memory microchips to provide a high-capacity and high-performance alternative to traditional electromagnetic hard drives. Just like USB memory keys, every memory chip must be granulated using a process capable of particle size of 4mm2 to guarantee a higher DIN66399 Class 2 destruction compliance result.

!WARNING! Hybrid hard drives (SSHD)

These drives work using a combination of electromagnetic storage (platters) in conjunction with a flash memory bank residing on the hard drive’s control PCB. When certifying a destruction, the platter needs to be shredded AND the control PCB granulated. It can be difficult to distinguish a hybrid drive from a traditional magnetic drive. This complication can make the ‘single shred size fits all’ offering obsolete, even for hard drives.

M.2 & NVMe devices

A further refinement of SSD technology has seen reduced-footprint flash memory implementations in modern laptops. These devices can often be mistaken for RAM modules and must be granulated using a process capable of particle size of 4mm2 to guarantee a higher DIN66399 Class 2 destruction compliance result.

Soldered-in Memory.

Soldered-in memory is gaining popularity, already having been used in netbooks as well as Macbooks for several years. As the name suggests, the memory cannot be removed easily. In terms of asset value, a decision needs to be made at end-of-life regarding the hardware asset value. In the case of a high-value laptop computer, we believe that certified overwriting using the trusted Blancco process represents the best end-of-life data security option. Critical Data is Blancco’s only certified ‘Erasure as a Service(EaaS)’ provider in Ireland. The physical alternative is to disassemble the computer and granulate the entire motherboard, or the memory chip(s), if identifiable.

Magnetic Tape

Tape cassettes are conventionally subjected to a degaussing process to destroy data content. This process involves subjecting the cassette to a strong focussed local magnetic field for a short period of time. This erases all data from the tape, including the factory servo track data.

Since degaussing alone can lack visual reassurance, we additionally offer a standard physical destruction which results in variable-length degaussed tape strands (typically 70-100mm in length, 12 mm wide) which no longer contain encoded data.

SD & MicroSD media

These high-capacity storage devices must also be granulated to put data beyond recoverability. A process capable of producing a 2mm particle size is essential. In a standard industrial/paper shredder, there is a little chance of these devices being destroyed effectively.

Smartphones & Tablets

Smartphones have become the repository of much personal information, and present challenges not found with other media. For fire safety and environmental reasons, LCD screens and batteries MUST be removed before any physical destruction can be initiated.

Data is stored on small flash memory chips on the phone’s main circuit board, and this main circuit needs to be granulated to approximately 2mm particle size to assure that data is beyond recovery. The residual components must be segregated.

Code generators / Digipasses

Capable of generating proprietary verification codes, these user-specific devices are high-risk and need to be disintegrated due to their size. Batteries need to be removed in advance of disintegration.

Reporting of Media Destroyed

After the destruction work has been completed, the enduring value lies in our Media Destruction Report. A plain .csv or Excel spreadsheet containing serial numbers lacks context, and can be error prone, as the serial number may be difficult or impossible to locate on a device. Some devices do not contain machine-readable serial numbers, and some devices contain no specific identifiers. Manual recording is also subject to error. So how is the vital information best encapsulated?

Aside from summarising the project by quantity of various device types, we include a detailed description of destruction method and a photograph of each device prior to destruction to capture all the original information available about that device. This includes asset labels, user information etc. We make this information searchable within the PDF report, so in case of audit, you will quickly be able to find the destruction record that you seek. You can download a sample report here.

frequently asked questions

To what standard should I destroy?
It depends on your organisation’s policy, the data type, the media format and on your budget.
DIN66339 has become the acknowledged reference for destruction to particular shred sizes. However, this standard deals exclusively with destruction of physical media, i.e., elimination of access to data, but not necessarily with elimination of data itself. We recommend that the guidance provided by this standard is supplemented with a level of practical diligence that also sees the data fully eliminated where possible before physical device destruction, and preferably before media are moved to the shredding location, even if within a secure perimeter. This data elimination can be achieved using erasure or degaussing.

Is degaussing necessary?
Degaussing is ineffective on SSD and optical devices. However, we do recommend degaussing for all magnetic storage formats and recommend specifically that devices are degaussed before leaving your building if physical shredding is being conducted in a vehicle parked externally to the building.

Data destruction is not the same as destroying the media on which data is stored (physical destruction). When a device is physically destroyed, it is rendered completely unusable, most frequently by disintegrating, shredding, or crushing the media. For rotational hard disk drives (HDDs), it is highly recommended to degauss the drive prior to physical destruction. Degaussing scrambles the magnetic polarisations present in HDDs, rendering the drive completely unusable. Newer and smaller devices tend to use solid state drives (SSDs) that pose different threats regarding their physical destruction. Degaussing, for example, is not effective with SSDs since SSDs use interconnected flash memory chips (integrated circuits) to store data, and only magnetic media is able to be degaussed.

Might my destroyed devices be recoverable by an expert?
As trusted experts in data recovery, we can guarantee that data will not be recoverable from the devices that we certify as destroyed.
What might it cost?
Physical destruction starts from €7.50 per hard drive/SSD/tape, and depends on device type, destruction level sought, device quantity and location of service.
How long might it take?
The physical destruction process is relatively fast, averaging in excess of 100 units per hour across most media types. However, the effective sorting, recording and degaussing of media necessary to generate a high-quality accurate destruction report will result in an expected daily process rate of 300-400 units.

Ignore services claiming shred rates of 500+ hard drives per hour. It simply is not possible to record 8-10 hard drives per second every second. Also, bear in mind that the faster the shredder and the finer the particle size, the noisier and more intrusive it will be environmentally. Our process is the quietest available, which guarantees the minimum of noise when working at your site.

Can you destroy onsite?
Yes, and this is always our top recommendation. Uniquely, we can temporarily embed our process within your building in the security of a service/loading bay or basement to meet the requirements of a policy that mandates in-site destruction.
How is the destruction certified?
Every job is certified with a report that looks like this.

Each report supports OCR and is searchable by any data string that appears anywhere in the photographed area. The serial number is sometimes less than obvious on some hard drives, and 3D barcodes can also complicate text logging. Our report allows you to virtually place the original device back in your hands for review.

What happens the media after destruction?
The media fragments will be removed from site sent for recycling and/or landfill using registered and reputable recycling partners.
How can we trust Critical Data Services with our information?
We operate GDPR-compliant processes and will enter into specific a Non-Disclosure Agreement, if required. Since destruction of data represents a form of data processing under GDPR Art. 4, we fully recognise the requirement to enter into a Controller-Processor Agreement to assist with your compliance.

We also recommend that a member of your team supervise the physical destruction process.

Can you remove hard drives from our computers?
Removal of devices from native hardware is not included in our service. We do recommend customers to carry out this task internally, since it allows an inventory to be generated independently which can be reconciled with our destruction report.

GET IN TOUCH

Contact CriticalData today to discuss any Data Erasure or Secure Decommissioning needs you have