Media Sanitization Procedure

I. Purpose & Scope

George Mason University Policy Number 1311, Information Technology Security Program, mandates compliance with the Information Technology Security Standard. This standard requires that information system media (both digital and non-digital) must be sanitized or destroyed prior to its disposal (e.g., surplus electronic devices deemed for destruction) or release for reuse (e.g. for interdepartmental transfers or return for replacement).

This procedure provides instructions for permanently removing data from Mason-owned electronic devices, verifying their sanitization, and documenting the process. This document only applies to all university departments and offices at all George Mason University locations that are planning to release for reuse Mason-owned computers.

II. Roles

The following roles and responsibilities have been identified for this procedure:

Departmental Staff #1 (or System Administrator)

  • Performs recommended data sanitization technique on Mason-owned electronic device
  • Completes the top half of the Certificates of Data Destruction Sticker

Departmental Staff #2

  • Performs verification that data have been successfully removed from Mason-owned electronic device
  • Completes the bottom half of the Certificates of Data Destruction Sticker
  • Applies the sticker on the electronic device, closest to the Asset TagIII. Workflows

III. Workflows

This workflow below provides a graphical representation of the data sanitization procedure. More detailed steps are provided in the following sections.
Figure 1: Data Sanitization Process

Figure 1: Data Sanitization Process

IV. Determine Which Data Sanitization Technique to Use

Use this chart below to determine which data sanitization technique to use on a Mason-owned electronic device.

IMPORTANT

Optical media such as CD, CD-RW, DVD, and DVD-RW can NOT be released for reuse. They must be physically destroyed through a shredder.

Figure 2: Data Sanitization Technique

V. Implement the Data Sanitization Technique

Data Sanitization Techniques:

  1. Using DBAN on Hard Disk Drives
  2. Using Erase on Solid State Drive Running on macOS
  3. Using Secure Erase on Solid State Drive Running on Windows
  4. Using hdparm on Solid State Drive Running on Unix
  5. Secure Erase on Flash-memory Device(s)
  6. Using a Factory Reset on Multi-function Printer(s)
  7. Using Factory Reset on Mobile Device(s)
  8. Deleting Configuration on Non-volatile Memory Devices (Routers, Switches, and Firewall Hardware)
  9. Physical Destruction of Defective/Non-functioning Media
a. Using DBAN on Hard Disk Drives

Step 1: Create a Bootable DBAN Disk

You may create a bootable DBAN disk on a CD or USB drive.

Create a Bootable DBAN on

ACTIVITY INPUTS: CD
ACTIVITY OUTPUTS: DBAN program, bootable DBAN CD

NOTE

DBAN has been recently purchased by a commercial entity, and as a result, the license has changed to personal use only. ITSO is searching for an adequate replacement.

An updated fork of DBAN is the nwipe project. It is functionally equivalent but without the restrictive license. There are few standalone nwipe bootable images; it is available on some Linux LIVE iso images.

    1. Download DBAN on the electronic device by clicking on the green download button.
    2. When prompted to download DBAN, save the iso file in a sub-folder called dban under Downloads.

NOTE

You will need to create the dban sub-folder.

DBAN download save screen

  1. Create a bootable DBAN disk using a CD by simply copying the iso file from the dban sub-folder under Downloads onto the CD, and then go to step 2.
Create a Bootable DBAN on USB (Optional)

ACTIVITY INPUTS: USB
ACTIVITY OUTPUTS: Rufus program, bootable DBAN USB

Rufus is a portable program (does not install) and works on Windows 10, 8,7, Vista, and XP

  1. Download Rufus, free tool that will correctly prepare the USB drive, automatically extract the content of the ISO file you have, and properly copy the files contained within it to your USB device, including any files in the ISO needed to make it bootable.
  2. Select Rufus 3.4 Portable from the download screen.
    Rufus Download Screen
  3. Double-click on the rufus-3.4p.exe file that you just downloaded. The Rufus program will start right away.
  4. Insert the flash drive or other USB device into your computer that you want to burn the ISO file to, assuming it’s not already plugged in.

    NOTE

    Burning an ISO image to a USB drive will erase everything on that drive!

  5. From the Device drop-down at the top of the Rufus program screen, choose the USB storage device you want to burn the ISO file to.
    DBAN Drive Properties
  6. From the Boot selection drop-down, make sure Disk or ISO image (Please select) is chosen. Click the SELECT button.
    DBAN Drive Properties Select Images
  7. When the Open window appears, locate and then select the ISO file you want to burn to the flash drive. Once selected, click the Open button.
    DBAN Drive Properties select ISO image
  8. Wait until Rufus inspects the ISO file you chose. This might take several seconds or may go by so quickly.

    NOTE

    If you get an Unsupported ISO message, the ISO you chose is not supported for burning to USB by Rufus. In this case, try one of the other programs such as UNetbootin, ISO to USB, and Universal USB Installer.

  9. Under the Image option area, pick Standard Windows installation (if you see this).
  10. Leave the Partition scheme, Target system, File system, and Cluster size options alone.
  11. Accept the default on the Volume label field.
  12. Click on the START button to start the burning of the ISO file to the USB device you chose.

    NOTE

    If you get an Image is too big message, you’ll need to use a larger USB device or choose a smaller ISO image.

    DBAN Drive Properties START button

  13. Click on the OK button to the WARNING: ALL DATA ON DEVICE ‘XYZ’WILL BE DESTROYED message that appears next.
    DBAN Drive Properties Data Loss Message
  14. Wait while Rufus properly formats the USB drive so it’s bootable, and then copies all of the files to the drive that are contained in the ISO file.
    DBAN Drive Properties Status Screen
  15. Once the status at the bottom of the Rufus program window says READY, you can close Rufus and remove the USB drive.

Step 2. Sanitize Hard Disk Drive using DBAN

ACTIVITY INPUTS: bootable DBAN CD/USB, hard disk drive (magnetic disk)
ACTIVITY OUTPUTS: “wiped” hard disk drive (magnetic disk)

  1. Insert the CD or USB into the computer.
  2. Restart your computer. You should see the DBAN Main Menu below.DBAN Quick Commands
  3. Using your keyboard, select the F3 key to list the Quick Commands. This opens the Quick Commands screen as shown below.
    DBAN Quick Commands
  4. DBAN can use one of several different methods to erase files as shown on the screen above. The pattern used to erase the files, as well as how many times to repeat that pattern, are differences you’ll find in each of these methods. Type autonuke at the cursor to start wiping ALL your hard disk drives. The autonuke command is the same as the dodshort. The dodshort command only does 3 passes versus 7 on the dod command.
  5. Once DBAN starts running, you should see this screen below. You can neither stop nor pause the process.
    DBAN Status Screen
  6. Once DBAN is done, you should see this screen below.
    DBAN Success Screen
  7. At this point, you can safely remove the CD or USB device that you’ve installed DBAN to and then shut down your computer.
b. Using Erase on Solid State Drive Running on macOS
  1. Reboot the computer.
  2. After hearing the boot sound, simultaneously press COMMAND + OPTION + R until the spinning globe appears and “Internet Recovery” is displayed.
  3. In the menu that is presented, select “Disk Utility” and press “Continue”.
  4. Highlight the internal disk entry and click the “Erase” button.
  5. The erase function will take several seconds.
c. Using Secure Erase on Solid State Drive Running on Windows

Some Dell workstations after 2015 with a compatible drive will have a Data Wipe option in the BIOS Setup.

  1. Boot to the system BIOS by press the F2 at the Dell Splash screen during system startup.
  2. Once in the BIOS, select the Maintenance option, then Data Wipe option in the left pane of the BIOS using the mouse or the arrow keys on the keyboard
  3. Ensure “Wipe on Next Boot” is checked, and confirm you would like to continue the operation by clicking OK.
  4. When asked if you want to cancel this operation, click NO.
  5. The machine will reboot and issue the secure erase command.

For Non-dell systems, refer to the computer manufacturer’s site OR use the hard disk manufacturer recommended utilities. Some manufacturers may not have a specific tool, but may mention any tool advertising ATA Secure Erase as a valid method.

d. Using hdparm on Solid State Drive Running on Unix
  1. Verify that the hard disk is not frozen
    # hdparm -I /dev/X
    Security:
           Master password revision code = 65534
                   supported
           not     enabled
           not     locked
           not     frozen
           not     expired: security count
                   supported: enhanced erase
           2min for SECURITY ERASE UNIT. 2min for ENHANCED SECURITY ERASE UNIT.
  2. Set a password on the drive
    # hdparm --user-master u --security-set-pass mypassword /dev/X
  3. Verify the password set
    # hdparm -I /dev/X
    Security:
           Master password revision code = 65534
                   supported
                   enabled
           not     locked
           not     frozen
  4. Issue the command to erase the drive
    # hdparm --user-master u --security-erase mypassword /dev/X
    security_password="mypassword"
    /dev/X:
    Issuing SECURITY_ERASE command, password=" mypassword ", user=user
e. Secure Erase on Flash-memory Device(s)

Any software capable of executing 3 pass, DoD-standard wiping is acceptable. One capable of erasing individual files or entire drives is Eraser (https://eraser.heidi.ie/).

f. Using a Factory Reset on Multi-function Printer(s)

Follow the device manufacturer’s recommendations. If internal storage involves a removable flash memory or hard disk, remove it from the device and follow the aforementioned procedures.

g. Using Factory Reset on Mobile Device(s)
  1. Apple iPhone
    1. Unpair your apple watch (if applicable)
    2. Turn off “Find my iPhone”
    3. Back up the device to iTunes (optional)
    4. Sign out of the Apple account associated with the device
    5. Open Settings, then tap “General.” Next, select “Reset,” then “Erase All Content and Settings.”
    6. Power off the phone and remove SIM card, if applicable
  2. Android
    1. Navigate to Settings à Security
    2. If necessary, expand Advanced
    3. Validate that “Encryption and Credentials” says “Encrypted.” If not, activate full disk encryption on the device
    4. Navigate to Settings, then System
    5. If necessary, expand Advanced
    6. Tap “reset options”
    7. Tap “Erase all Data (factory reset) and follow confirmation prompts
    8. Power down phone and remove the SIM card, if applicable
h. Deleting Configuration on Non-volatile Memory Devices (Routers, Switches, and Firewall Hardware)

Follow manufacturer recommendations for the specific hardware. If internal storage involves a removable flash memory or hard disk, remove it from the device and follow the aforementioned procedures.

i. Physical Destruction of Defective/Non-functioning Media

Some media may be non-functioning, rendering execution of a secure erase operation impossible. Typically, it is the controller on the device that has malfunctioned, leaving the data areas intact and recoverable with time and the right resources.

For standard hard disk drives, ITS has an NSA-certified degaussing tool to apply strong magnetic fields to effectively erase hard disk platters. ITSO still recommends executing a software-based wipe on any standard hard disk drive before degaussing, if possible.

George Mason University has a contract with a third-party electronic recycler that is able to execute certified destruction of this media. Contact the IT Security Office to coordinate the delivery of media to be destroyed. The vendor can provide a certificate of destruction if requested for record-keeping purposes.

VI. Fill Out the Certificates of Data Destruction Sticker

ACTIVITY INPUTS: Certificates of Data Destruction sticker
ACTIVITY OUTPUTS: Certificates of Data Destruction sticker

  1. Download and print the Certificates of Data Destruction stickers on a standard 2-inch high by 4-inch wide shipping labels.
  2. Check the appropriate sanitization technique checkbox on one of the stickers.
  3. Fill in the Executed By and Date fields with your name and the date. Sign the sticker.
  4. To complete the verification process in Section VII, find a departmental staff and give the staff the sticker.

VII. Verify a Successful Media Sanitization

a. On Electronic Device with Hard Disk Drive

ACTIVITY INPUTS: “wiped” hard disk drive, Certificates of Data Destruction sticker
ACTIVITY OUTPUTS: “wiped” hard disk drive, Certificates of Data Destruction sticker

  1. To verify if the hard disk drive was wiped out successfully, turn on the computer and you should see Operating System not found error on startup.
    verify successful media sanitization
  2. Print your name and enter the date on the Verifier’s Name (Print Name) & Date on the Certificates of Data Destruction sticker.
  3. Fill in Verified By and Date fields with your name and date. Sign the sticker.
  4. Take the sticker and stick it on the side of the computer, preferably near the Asset Tag.
b. On Electronic Device with Solid State Drive Running on iOS

ACTIVITY INPUTS: “wiped” SSD, Certificates of Data Destruction sticker
ACTIVITY OUTPUTS: “wiped” SSD, Certificates of Data Destruction sticker

  1. After completion of the erasure process, the target drive should not have any recognizable partitions viewable by the Disk Utility.
    2. To complete the Certificates of Data Destruction sticker, perform Steps #2-4 of Section VII. a, On Electronic Device with Hard Disk Drive.
c. On Electronic Device with Solid State Drive Running on Windows

ACTIVITY INPUTS: “wiped” SSD, Certificates of Data Destruction sticker
ACTIVITY OUTPUTS: “wiped” SSD, Certificates of Data Destruction sticker

  1. The output screen of the drive wipe utility will show completion.
  2. To complete the Certificates of Data Destruction sticker, perform Steps #2-4 of Section VII. a, On Electronic Device with Hard Disk Drive.
d. On Electronic Device with Solid State Drive Running on UNIX

ACTIVITY INPUTS: “wiped” SSD, Certificates of Data Destruction sticker
ACTIVITY OUTPUTS: “wiped” SSD, Certificates of Data Destruction sticker

  1. To verify, run hdparm and validate the password on the drive is not enabled
    # hdparm -I /dev/X
    Security:
    Master password revision code = 65534
             supported
    not      enabled
    not      locked
    not      frozen
    not      expired: security count
             supported: enhanced erase
       2min for SECURITY ERASE UNIT. 2min for ENHANCED SECURITY ERASE UNIT.
  2. To complete the Certificates of Data Destruction sticker, perform Steps #2-4 of Section VII. a, On Electronic Device with Hard Disk Drive.
e. On Flash-memory Device(s)

ACTIVITY INPUTS: “wiped” flash-memory device, Certificates of Data Destruction sticker
ACTIVITY OUTPUTS: “wiped” flash-memory device, Certificates of Data Destruction sticker

  1. To verify, view confirmation page from tool of choice.
  2. To complete the Certificates of Data Destruction sticker, perform Steps #2-4 of Section VII. a, On Electronic Device with Hard Disk Drive.
f. On Multi-function Printer(s)

ACTIVITY INPUTS: “wiped” Multi-function Printer, Certificates of Data Destruction sticker
ACTIVITY OUTPUTS: “wiped” Multi-function Printer, Certificates of Data Destruction sticker

  1. To verify, follow the manufacturer’s recommendations for verification.
  2. To complete the Certificates of Data Destruction sticker, perform Steps #2-4 of Section VII. a, On Electronic Device with Hard Disk Drive.
g. On Mobile Device(s)

ACTIVITY INPUTS: “wiped” mobile device, Certificates of Data Destruction sticker
ACTIVITY OUTPUTS: “wiped” mobile device, Certificates of Data Destruction sticker

  1. To verify, the phone will power up and begin the setup procedure as if it were a new device.
  2. To complete the Certificates of Data Destruction sticker, perform Steps #2-4 of Section VII. a, On Electronic Device with Hard Disk Drive.
h. On Non-volatile Memory Devices (Router, Switch or Firewall Hardware)

ACTIVITY INPUTS: firewall/network/switch, Certificates of Data Destruction sticker
ACTIVITY OUTPUTS: firewall/network/switch, Certificates of Data Destruction sticker

  1. To verify, follow the manufacturer’s recommendations for verification.
  2. To complete the Certificates of Data Destruction sticker, perform Steps #2-4 of Section VII. a, On Electronic Device with Hard Disk Drive.

VIII. Definitions

Acronym/TermDefinition
Data SanitizationThis is a process of deliberately, permanently and irreversibly removing or destroying the data stored on a memory device to make it unrecoverable.
Information System MediaThese are components in an electronic device that store data or use persistent memory. Information system media includes both digital and non-digital forms. Digital media include magnetic disks, flash-memory or Solid-State Devices (SSDs), and optical media. Non-digital media include paper and microfilm.
RUFUSThis is a free tool that will correctly prepare the USB drive, automatically extract the contents of the ISO file you have, and properly copy the files contained within it to your USB device. It is a is a portable program (does not install) and works on Windows 10, 8, 7, Vista, and XP.

To download this free tool, go to: rufus.ie
DBANThis program is also known as Darik's Boot and Nuke. It is designed to securely erase a hard disk until its data is permanently removed and no longer recoverable, which is achieved by overwriting the data with pseudorandom numbers generated by Mersenne Twister or ISAAC. DBAN erases all the files on the hard drive including installed applications, files, and the operating system.

To download a free version, go to: dban.org

Electronic DeviceAny electronic equipment that has a storage device or persistent memory, including but not limited to computers, servers, mobile devices, routers, switches, firewall hardware, and certain models of printers and copiers.

IX. Dates

  1. Effective Date:
    This procedure will become effective upon the date of approval.
  2. Date of Most Recent Review:
    January 19, 2022

X. Timetable for Review

This procedure shall be reviewed every year or more frequently as needed.

XI. Signatures

The following authorized party hereby approves the above process flow and documentation:

Curtis McNay
IT Security Director
Information Technology Services

Revision History
DateVersionPurpose of Revision
25 July 20191.0Initial Release
12 January 20222.0Global replacement of Data Sanitization Certification to Certificates of Data Destruction and updated steps in Section VII.A, On Electronic Device with Hard Disk Drive