Hard Drive Euthanasia

I euthanized a Western Digital My Passport 1 TB external hard drive (Model WD10JMVW-11S5XS1). It belonged to a relative who passed away, and I was hoping to retrieve important information from it (namely bank account information, a will, and/or an estate plan). The drive failed to mount, but I was able to extract files from it using Disk Drill.

Following data recovery, I attempted to format the drive, but attempts to do so using Disk Utility and Terminal commands were unsuccessful. Therefore, I decided to destroy the hard drive to ensure that data could not be recovered.

Curious to see the inside of the hard drive, I disassembled it by popping off the plastic casing and removing the Torx screws. When I finally uncovered the platter, I bent the read/write head and arm so it could no longer function. I then grabbed the platter with pliers, and to my surprise, it shattered to pieces. I had assumed that the platters were magnetic media similar to floppy disks but apparently modern hard drives have platters that are made of glass or glass-ceramic base materials which are then coated with a thin layer of magnetic material where the data are stored.

I was not wearing protective eyewear, and fortunately I did not sustain any injuries other than a small superficial scratch on my finger. If you ever decide to disassemble a hard drive, be careful! Next time I euthanize a hard drive, rather than taking it apart I might smash it with a hammer instead.

Securely Erase Your Hard Drive

There are many reasons why you might need to securely erase your hard drive. If you are selling or recycling your computer or upgrading your hard drive, you don’t want your hard drive data getting into the wrong hands. Chances are that you have personal information on your hard drive that identity thieves and fraudsters would love to see. Here are some suggestions for how to securely erase the data from your hard drive.

SECURELY ERASING A MAC HARD DRIVE

First, boot your Mac from a volume other than the one you intend to erase. One common way to do this is to install a Mac operating system on an external hard drive or thumb drive. Read this article for easy step-by-step instructions on how to do that.

Next, run Apple’s Disk Utility application which comes with every Mac operating system. Select the hard drive you’d like to erase and press the “Erase” button.

From there, you can optionally click the “Security Options…” button to choose from one of several erasure methods:

• Option 1 (Fastest): This option does not securely erase the files on the disk. A disk recovery application may be able to recover the files.
• Option 2: This option writes a pass of random data and then a single pass of zeros over the entire disk. It erases the information used to access your files and writes over the data 2 times.
• Option 3: This option is a DOE-compliant 3-pass secure erase. It writes two passes of random data followed by a single pass of known data over the entire disk. It erases the information used to access your files and writes over the data 3 times.
• Option 4 (Most Secure): This option meets the US Department off Defense (DOD) 5220.22-M standard for securely erasing magnetic media. It erases the information used to access your files and writes over the data 7 times.

The best option for you depends on how critically important it is to wipe your data and how much time you are willing to spend erasing the data. Depending on the speed and capacity of your hard drive, it could take several days to erase your hard drive using the most secure method. There are also other commercial applications that you can purchase, and some of the offer a 35-pass overwrite option.

SECURELY ERASING A WINDOWS HARD DRIVE

Similar to a Mac, you need to boot into a Windows volume other than the one you want to erase. Read this article (https://www.pcmag.com/how-to/how-to-run-windows-10-from-a-usb-drive) for instructions on how to run Windows from a USB drive.

Next, decide which application you’ll use to securely erase your hard drive. I know of two free options: Disk Wipe (https://www.diskwipe.org) and Darik’s Boot and Nuke (DBAN; https://dban.org). DBAN offers several wipe methods:

• Quick Erase: fills the disk with zeros
• RCMP TSSIT OPS-II: 8-pass write of random 0s and 1s
• DoD Short: 1 pass with all 0s, 1 pass with all 1s, and 1 pass with random 0s and 1s (3 passes total)
• DoD 5220.22-M: 7-pass version of DoD Short
• Gutmann Wipe: 35-pass wipe described here
• PRNG Stream: overwrite with a stream from the Pseudo Random Number Generator, with as many passes as you specify

ADDITIONAL CONSIDERATIONS

Do not attempt to wipe a solid state drive (SSD). Not only would it add to the wear and tear of your SSD, it is also not possible to securely erase a SSD because of the way SSDs work. Namely, many SSDs use a technology called wear leveling to prevent any given part of the drive from being overwritten too many times.

One alternative to secure erasure would be to simply encrypt the hard drive. Maybe I’ll discuss this topic in a future post.

Another alternative to secure erasure is to physically destroy the hard drive, making sure to incapacitate the platters inside the drive. While a hammer would probably suffice, I’m sure you can find ways to get creative with other tools, weapons, firearms, artillery, explosives, etc. Just keep it legal, OK?

Catastrophic Hard Drive Failure

Last night my Late 2012 27-inch iMac experienced a catastrophic hard drive failure. In the minutes leading up the event, I was stitching together some photos which resulted in my iMac running out of memory. I assume that the virtual memory system kicked in, as my computer immediately became slow to respond, and I could hear busier-than-normal hard drive whirring noises. After force-quitting the photo stitching application, my iMac regained normal responsiveness. Abandoning the thought of using my photo stitching application, I proceeded to check my Facebook stream on Safari. A few minutes later, I heard loud “scratching” noises coming from my hard drive, so I quit Safari and attempted to reboot. Unfortunately the iMac refused to reboot, shut down, or obey any other commands. I had no choice but to force a shutdown by pressing and holding the power button. I waited a minute and restarted my iMac. I heard one more loud scratching noise from the hard drive, and then the machine went silent.

Fortunately I have a portable external hard drive where I’ve installed macOS High Sierra (version 10.13).

By pressing the “option” key during startup, I was able to select my external hard drive as the boot volume and successfully launch Finder. I was immediately shown the following message:

I assumed that this was in reference to my internal hard drive. Not a good sign. At this point, I ran Disk Utility to try to repair the volume so that I could mount the internal hard drive and access its files. Here’s what I saw:

Another bad sign. Disk Utility said that my internal hard drive (ST3000DM001 Media) was “Uninitialized” and that its capacity was 4.14 GB when in reality it is a 3 TB fusion drive (note the SSD portion as indicated by “APFS Physical Store”). First Aid failed to repair either the hard drive or the SSD.

Next I launched TechTool Pro and ran a suite of diagnostics. The hardware tests passed for the most part, until it got to the Surface Scan where every single block was designated a bad block.

My original plan was to mount the volume, perform a 1-pass secure erase, and install a fresh new operating system. However, given that I cannot mount my internal hard drive, I have decided to format one of my spare external hard drives, install a fresh new operating system on it, and run the iMac from the external drive for the time being.

I realize that I could replace the internal hard drive, and while it appears to be rather affordable if you buy the parts and install it yourself, I have a fusion drive so I wasn’t sure if I should attempt the replacement on my own. I asked Google but didn’t find any articles about how to replace a fusion drive with a regular hard drive. I suspect that it is possible, but I would not be surprised if the procedure was slightly different. Also, I prefer not to purchase another Intel Mac just as Apple begins its transition to its own Silicon processors. So meanwhile, assuming nothing unexpected happens, I’ll be using a temporary external hard drive for my iMac boot volume, in hopes that this makeshift configuration will buy me enough time to get a new Silicon iMac.

I Resolve to Back Up My Files (BONUS: How to Start Up in Recovery Mode)

I recently wrote about how I nearly bricked an iMac while upgrading the operating system, but I was able to save the day by starting up in Safe Mode in macOS and fixing the problem. Well, it's been an adventurous year for me since I had another close call.

Normally I am careful to periodically back up my files, especially my photos and videos. While I often sync my "favorite" photos and videos to Google Photos where I have unlimited storage, I also prefer to back up my original RAW photos (in Canon CR2 file format) and AVCHD videos (in MTS file format) to external hard drives. Since February 2018, my 3TB external hard drives reached capacity, and I had a variety of excuses to delay the purchase of additional external hard drives: busy at work, looking for a good deal on higher capacity drives, etc. So I have copies of all of my photos and videos leading up to February 2018 on 2 external hard drives. From February 2018 to today, I have had only 1 copy of my iMac hard drive, and they could potentially vanish in the event of a hard drive crash.

Sometime in mid- to late-2018, I started getting SMART notifications that my iMac internal hard drive was showing signs of wear and tear. I also noticed that on startup, the progress bar would sometimes pause at about three fourths of the way to completion. Sometimes it would eventually finish the boot process, and at other times it would simply hang, and I would be forced to power off the iMac and reboot. All signs of impending disaster.

Black Friday rolled around, and I decided to finally purchase a pair of shiny new 8 TB external hard drives. They were back ordered but finally arrived the second week of December (i.e., a couple weeks ago). However, the 8 TB drives have been sitting in my office unopened ever since. Enter more excuses for not backing up my files: holiday shopping, family gatherings, catching up on paying bills, etc.

Today I wondered if resetting the PRAM would help fix some of those startup issues that I described above. So I went ahead and restarted my iMac while holding down the command, option, P, and R keys (warning: don't try this unless you know what you are doing). As expected, the iMac restarted once, detected the PRAM reset request, and restarted again. All expected behavior so far. But when it restarted the 2nd time, it booted into my TechTool Pro rescue partition. Hmmm, that was strange. But since I was there, I ran some diagnostics and with the exception of the SMART warnings that I already knew about, everything checked out OK. So I decided to restart my computer normally. However, in the startup volume selection dialog box, my Macintosh HD volume was nowhere to be found. That explains why the machine rebooted into the TechTool Pro rescue partition. I tried warm and cold reboots, but now each restart would arrive at the screen with the Apple logo, stop loading, and simply hang.

I spent the next several minutes in disbelief that I have preached to all my friends and family that they should back up their files and that every hard drive is essentially a ticking time bomb. Well, it looks like my hard drive's time bomb exploded today, with nearly a year's worth of photos and videos (304.28 GB to be exact) not backed up.

After 3 or 4 failed attempts to start my iMac, I tried restarting in Safe Mode (again, described here). No luck. However, restarting in Recovery Mode (restarting while holding the Command and R keys) did give me access to macOS Utilities:



From there I was able to run Disk Utility and run First Aid on my Macintosh HD volume. Among a variety of other usual tasks, I noticed that Disk Utility performed some "deferred repairs" on the volume. I think that did the trick, as I was then able to restart the iMac and get access to the Finder.

WHEW! I am backing up files as I write this post. Fingers crossed that I have not lost any precious moments. Normally I don't make any new year's resolutions, but in 2019 I resolve to regularly back up my files.

How Smart is Your S.M.A.R.T. Utility?

The other day I received a S.M.A.R.T. (Self-Monitoring, Analysis and Reporting Technology) warning from TechTool Pro about my Seagate FreeAgent 1.5TB external hard drive:



Digging deeper, here is the full report which shows the issue being related to reallocated bad sectors (the temperature changes were due to me copying a large number of files at the time):



I also ran DriveDx to compare results, and it also identified an issue related to reallocated bad sectors (the temperature change parameter is OK because I was not copying files at the time):



Interestingly, Apple Disk Utility did not seem to think that anything was wrong with my hard drive since it reports the S.M.A.R.T. status as Verified, and I ran this app while copying files so it seems to not have detected either the reallocated bad sectors or the temperature changes:



So my only point is that there may be some value in buying 3rd party S.M.A.R.T. utilities for their seemingly more in-depth analysis as well as real-time alerting. I suppose that the more lead time you have in your early warning system, the better.

So guess what I'm doing this weekend? As you can see from the temperature parameter on the TechTool Pro report, I'm busily backing up data before the drive fails entirely.

PSA: An Ounce of Prevention

Recently I ran some diagnostics on my external backup hard drives, and there are signs that they are starting to fail in their old age (they are about a decade old). You know what they say about an ounce of prevention, so before they crash, I decided to move my backup files onto some newer external hard drives with more storage capacity.

One of my new drives is a WD My Cloud drive. Its setup included plugging in a power source and connecting an ethernet cable between the drive and my router. There is no physical connection between my computer and the backup drive, so the data are streamed over my network connection. I am backing up 2.99 TB of data, and the estimated time to complete this task is currently "About a day":

I don't know how that compares to the data transfer rate of physical USB or FireWire connections, but the setup was pretty straightforward, I don't have to babysit the process, and incremental backups will take merely a fraction of the time.

In any case, I hope you are not only periodically backing up your data but also (1) using multiple backup devices, (2) storing them in multiple locations, and (3) periodically checking the integrity of your backup devices.

iMac (27-inch) 3TB Hard Drive Replacement Program

I received this email from Apple today (click for full size image):

The hyperlink in the email redirects to https://www.apple.com/support/imac-harddrive-3tb/.  From there, the following information is provided (click for full size image):

Even though I haven't had any problems with my hard drive and periodically monitor its SMART status, I guess I plan to get it replaced.  Anyone else affected by this recall, and if you had your hard drive serviced, how long did it take to get your computer back?

Hard Drive Erasure

Are you thinking of donating or recycling an old computer? Better make sure you first erase (or "wipe" or "format") your data. While simply deleting all of your files is one approach, it is not very secure. Did you know that when you delete a file, the contents of the file remain on your hard drive? In fact, deleting a file simply modifies the directory that references the location of the file contents and tells the directory that the space is available to be re-used. That's why if you accidentally delete a file, it is often possible to un-delete the file. But if you delete a file and then save a lot of other information to the hard drive, then chances are that new information may have over-written the same physical location where your deleted file had previously resided, thereby making it far more difficult (but not necessarily impossible) to recover. That is the basis for a variety of hard drive wiping algorithms. In fact, the more times you over-write previous data, the more difficult it is to recover that data in a meaningful way.

In this post, I will address some simple ways to erase hard drives on Windows and Macintosh systems. Needless to say (but I'll say it anyway), make sure you have backed up any information that you intend to keep before wiping your hard drive. Then after you've verified that you've backed up the desired data, check again. Are you sure now? OK, then consider making 2 or more backup copies because when it comes to preserving data, redundancy is a good thing. Are you totally sure now? Just checking. Once you apply one of these techniques, your data will be gone forever. Alright, on with the discussion.

First, a discussion about wiping methods. The quickest method is a 1-pass erase where you simply write zeros over the entire hard drive. While this is far better than simply deleting your files, it is theoretically possible to apply forensic technology to examine the residual magnetic properties of your hard drive and recover the overwritten data. So as long as you're going down this route, you might as well go for at least a 3-pass erase, where most algorithms write a 10101010 pattern on the first pass, followed by a 01010101 pattern on the second pass, and then a random pattern on the third pass.  For the paranoid, there is also a 7-pass option. For the extreme paranoid, there is a 35-pass (Gutmann method) option--geez, what kind of data do you have on your hard drive to need this? Nevermind, I don't want to know. The 3-pass option takes (you guessed it) 3 times as long as the 1-pass option, and the 7-pass option takes... ahem, you get the point. So depending on how large your hard drive is, be prepared to leave it running for a long time (eg, hours or even days depending on how hard drive size and number of passes).

On Windows operating systems, I recommend using an application called Darik's Boot and Nuke (DBAN). A free download is available at www.dban.org. Simply retrieve the latest version and burn it to a CD or DVD. Then boot your machine to the DBAN CD or DVD. Depending on what machine and operating system you have, you might be able to set a target boot destination or get into the machine BIOS by pressing a certain key or key combination upon startup. From there, you can select the wiping method. There are 1-pass, 3-pass, 7-pass, 35-pass, and other options. When finished, you can install an operating system on your hard drive if desired.

On Macintosh operating systems, if you have a recent operating system (e.g., OS X 10.10 Yosemite and OS X 10.9 Mavericks) simply restart your Mac and hold down the Command and R keys. At the menu, select Disk Utility, select the hard drive, and click the Erase tab. You'll have options for 1-pass (Zero Out Data), 7-pass, and 35-pass wipes. After the drive is erased, you'll have the option to re-install the operating system. For older Mac operating systems, you should have an installation DVD or CD that came with your computer. Boot into the DVD or CD (depending on your machine, you may have to hold down a different key or key combination to boot into the CD/DVD drive) to access Disk Utility and erase away.

Well, there you have it. Hopefully these approaches will keep your personal information secure. By the way, if the above methods are too complex or time-consuming for your taste, the alternative is to just smash your hard drive with a hammer--it is probably a faster method and definitely way more fun, but the recipient of your old computer will not have a functioning machine. :-) If you have other recommendations for wiping Windows and Macintosh computers, leave a comment below!