####  Media Sanitization Procedures

1\. **Procedure Subject Area**: This document describes procedures for
sanitizing various types of data storage media. The NIST Recommended
Computer Security Procedures document, paragraph 11.03, the Financial
Information Systems Controls Audit Manual (FISCAM) section AC 3.4, NIST
Special Publications 800-18 (4.4.5) and 800-26 (3.2.12, 8.2.8, 8.2.9),
and the NIST System Development Life Cycle Management policy require
that media containing sensitive NIST data be erased using a repeated
overwrite operation, purged, degaussed, or destroyed prior to recycling,
reusing, donating, or disposal of the storage media.

2\. **Procedures:** Storage media may be sanitized using several methods
as follows:

2.2.1. Data Overwriting Applications

2.2.2. Magnetic Degaussing

2.2.3. CD Data Destroyer

2.1. **Scope:** Please see the scope and background within each specific
method.

2.2. **Specific Procedures:**

> 2.2.1 **Data Overwriting Applications (Active KillDisk for
> Wintel/SuperScrubber for**
>
> **Apple MacIntosh)**
>
> 2.2.1.1 **Scope and Background:** The Active KillDisk software is
> executed from a bootable floppy disk that boots to DOS. The software
> is operating system, file system, and hard disk drive (HDD)
> independent; however, it is architecture/processor dependent and can
> be used only with PC/Intel compatible processors. The SuperScrubber
> software is executed from a bootable CD ROM and can be used only with
> Apple Mac machines that are capable of running Mac OS X Version 10.2
> (Jaguar). A firmware upgrade may be required prior to running the
> SuperScrubber application (visit <http://www.apple.com/support> for
> more information). If the drive to be sanitized cannot be installed in
> a PC/Intel compatible or Apple Mac machine, the drive will have to be
> degaussed for sanitization (see 2.2.2 and heed associated important
> note). The Active KillDisk application will also erase Zip disks and
> floppy diskettes (if the PC has two floppy drives).
>
> Utilities such as FORMAT only create new FAT and ROOT tables, leaving
> all previous data on the disk intact and recoverable. Moreover, an
> image of the replaced FAT and ROOT tables is stored, so that the
> UNFORMAT command can be used to restore them. Other utilities such as
> FDISK merely clean the Partition Table (located in the drive\'s first
> sector) and do not clean or erase anything else. This situation
> necessitates the use of a data destruction utility that erases data by
> overwriting all addressable locations on the disk with random data.
> The Active KillDisk Professional and SuperScrubber applications
> overwrite all addressable storage and indexing locations on the drive
> three times with zeros and/or random data for each single pass. For
> this reason, the overwriting software should be used with caution as
> data is erased completely without possibility of recovery. For more
> information on the Active KillDisk software, visit the website at
> <http://www.killdisk.com/eraser.htm>. For more information on the
> SuperScrubber software, visit the website at
> [http://www.superscrubber.com](http://www.superscrubber.com/).
>
> 2.2.1.2 **iTAC** **Procedure for Wintel and Apple Mac (Boulder and
> Gaithersburg):**
>
> To sanitize both Wintel and Apple Mac HDDs, submit a request through
> iTAC to generate a work request for PC Hardware Support to perform the
> data erasure. Please provide the following information:

-   How many machines or drives require sanitization

-   The NIST property number from each machine

-   Where each machine is located

Based on the iTAC service request, PC Hardware Support will contact you
to schedule a time to pick up the machine(s) to be erased. After the
hard drive or drives have been sanitized, PC Hardware Support will then
return the machine to you. Typically there is a four day turn around for
erasing hard drives. In the event of an emergency, PC Hardware Support
may provide same day service.

> 2.2.1.3 **OU Procedure for Wintel Only (Boulder and Gaithersburg)**
>
> For Wintel machines only, the media may be sanitized at the OU,
> Division, Group, or System level utilizing the Active KillDisk
> application provided to each OU ITSO by the NIST ITSO by following the
> instructions below:
>
> a\) Obtain a bootable floppy disk containing the Active KillDisk
> application from your OU ITSO or the NIST ITSO. The application is
> licensed -- **do not make additional copies**. If you require
> additional copies, request them from the NIST ITSO.
>
> The floppy disk provided by the NIST ITSO also contains the Active
> KillDisk application manual supplied by the vendor.
>
> b\) With the PC power off, insert the Active KillDisk floppy disk into
> the floppy disk drive.
>
> c\) Start the PC by turning on the power. The software will execute
> automatically, detect all system drives, and display drive information
> on the monitor.
>
> d\) Using the keyboard arrow keys, select the drive you wish to erase
> and press the \[Enter\] key. The "Data Erase Warning" splash box
> appears:
>
> ![](media/image1.png){width="5.916666666666667in" height="3.625in"}
>
> e\) Confirm your choice to erase data on the selected drive by
> pressing the letter \[Y\] on the keyboard. The "Level of Security"
> splash box appears:

![](media/image2.png){width="6.375in" height="3.7215277777777778in"}

> f\) Key in the level of security by typing in a number between 1 and
> 99 and press the \[Enter\] key. Three disk write head passes will
> occur for each number between 1 and 99 (i.e. if number 5 is selected,
> 15 disk write head passes will occur). A higher number of passes will
> ensure a higher level of security. Each time the write head passes
> over the disk surface, more of the residual data charge will be
> removed from the disk surface. Please note that the erasing procedure
> is time consuming and additional time is utilized for each added level
> of security. The "Active Kill Disk" splash box appears:

![](media/image3.png){width="6.5in" height="3.4770833333333333in"}

> g\) This is the user's last chance to stop the process before removing
> data from the selected drive forever. If you do not want to remove all
> the data, you may exit the application by pressing the \[Esc\] key.
> You will then be returned to the command prompt.
>
> If you want to continue with permanent data removal, type KILLDISK and
> press the \[ENTER\] key. You will be able to view the progress of the
> erasing procedure in the "Disk Erasing" splash box:

![](media/image4.png){width="6.375in" height="3.3375in"}

> h\) If, for any reason, you wish to stop the process after it has
> begun, press the \[Esc\] key; however, data erased up to that point
> will not be recoverable.

i\) The application will continue to operate on its own without human
intervention. If there are any errors, (for example due to bad
clusters), they will be reported on the screen. If such a message
appears, it will be possible to cancel the operation (by pressing
\[Esc\]), or continue erasing data.

> j\) In order to use any erased HDDs again, you will need to:
>
> a\. Repartition the HDD using a standard utility like FDISK
>
> b\. Reformat partitions using a standard utility like FORMAT
>
> c\. Reinstall the operating system using a bootable CD-ROM or floppy
>
> 2.2.2 **Magnetic Degaussing**

2.2.2.1 **Scope and Background:** Magnetic media containing sensitive
data that cannot be erased using an approved repeated overwrite
operation, should be degaussed to completely erase data prior to
recycling, reusing, donating, or disposal of the storage media. The
degausser will erase data from all magnetic media formats including all
oxide & metal particle video cassettes, all reel formats up to 16\"
diameter including 2\" pancakes up to 16\" diameter, all computer backup
tape cartridges, floppy diskettes, and hard disk drives.

> The degausser NIST has purchased (Verity Systems SV91M) provides a
> degaussing force of 4000 gauss and an erasure depth of between --75
> and --90 dB. While this equipment meets U.S. Federal specifications
> for erasure of top secret data, the manufacturer has not submitted the
> equipment for official approval due to prohibitively expensive costs
> for such approval.
>
> **[IMPORTANT NOTE:]{.underline}** Hard disk drives are rendered
> **permanently unusable**
>
> by the degausser. Hard disk drives should only be submitted for
> degaussing
>
> if they are no longer needed, are technically obsolete, or have
> already been damaged. Other magnetic media can be reused but may
> require reformatting.
>
> 2.2.2.2 **Procedure (Boulder and Gaithersburg):**
>
> 1\) Submit a request through iTAC (phone, e-mail, etc.). Please
> provide the following information:

-   Type of media requiring degaussing

-   How many units require degaussing

-   Whether or not you want the media returned

-   Any time constraints for return of the media

> 2\) Based on the iTAC work order, PC Hardware Support will contact you
> to schedule an appointment. Do not take media to the PC Hardware
> Support office until you have been contacted by a PC Hardware Support
> representative.
>
> 3\) At the appointed time, media must be physically taken to the PC
> Hardware Support office in Gaithersburg, building 101, room A37 (in
> the basement). For Boulder, the media must be taken to the ITAC office
> in building 1, room 4050.
>
> 4\) In most cases, for degaussing jobs of 10 units or less, PC
> Hardware Support will be able to complete the degaussing while you
> wait.
>
> 5\) PC Hardware Support will contact the customer upon completion of
> the degaussing if it cannot be completed immediately. The customer may
> then retrieve the media from the PC Hardware Support office or have PC
> Hardware Support dispose of the media.
>
> 2.2.3 **CD Data Destroyer**

2.2.3.1 **Scope:** The CD data destroyer may be used to physically
scrape the data-containing surface from any CD or DVD. Because this
process renders the CD or DVD unusable, the CD data destroyer should
only be used to dispose of media that is no longer needed.

2.2.3.2 **Procedure (Gaithersburg):**

1\) Complete the attached "Request for Media Destruction" form.

> 2\) Take the completed form along with the CDs or DVDs that you wish
> to have destroyed to the Central Computing Facility (CCF) located in
> the basement of building 225, room A02.

3\) Ring the bell at the CCF visitor's window and give the media to the
operator on duty.

4\) Enter the destruction request in the log supplied by the CCF
Operations Staff.

5\) CCF Operations personnel will destroy the media and dispose of it.

2.2.3.3 **Procedure (Boulder):**

1\) Take the CDs or DVDs that you wish to have destroyed to the Boulder
iTAC office, building 1, room 4050.

> 2\) A Remedy ticket for the destruction will be created.
>
> 3\) Boulder PC Support personnel will destroy the media and dispose of
> it.

**[Request for Media Destruction]{.underline}**

Requestors
Name:\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

( PLEASE PRINT )

NIST Division: \_\_\_\_\_\_\_

# Office Extension: \_\_\_\_\_\_\_\_\_\_

# Type of Media: \_\_\_\_\_\_\_\_\_\_\_\_

# Quantity: \_\_\_\_\_\_\_\_\_\_\_

Volume Serial Numbers (if any): \_\_\_\_\_\_\_\_\_\_\_

\_\_\_\_\_\_\_\_\_\_,\_\_\_\_\_\_\_\_\_\_\_,\_\_\_\_\_\_\_\_\_\_,\_\_\_\_\_\_\_\_\_\_\_

\_\_\_\_\_\_\_\_\_\_,\_\_\_\_\_\_\_\_\_\_\_,\_\_\_\_\_\_\_\_\_\_,\_\_\_\_\_\_\_\_\_\_\_

\_\_\_\_\_\_\_\_\_\_,\_\_\_\_\_\_\_\_\_\_\_,\_\_\_\_\_\_\_\_\_\_,\_\_\_\_\_\_\_\_\_\_\_

\_\_\_\_\_\_\_\_\_\_,\_\_\_\_\_\_\_\_\_\_\_,\_\_\_\_\_\_\_\_\_\_,\_\_\_\_\_\_\_\_\_\_\_

# Signature:\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

# Comments: \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

[For CCF Use only:]{.underline}

# Operator Initial: \_\_\_\_\_

FN=data/nist/forms/media.destruction.form.doc