CAS-003 · Question #897
A security engineer is performing a routine audit of a company's decommissioned devices. The current process involves a third-party firm removing the hard drive from a company device, wiping it…
The correct answer is C. Wipe the drives using a 21-pass overwrite. Cluster tip data surviving a 7-pass wipe indicates the tool did not overwrite every physical sector; a 21-pass full-disk overwrite applies additional passes across all sectors to eliminate residual slack space data.
Question
A security engineer is performing a routine audit of a company's decommissioned devices. The current process involves a third-party firm removing the hard drive from a company device, wiping it using a seven-pass software placing it back into the device and tagging the device for reuse or disposal. The audit reveals sensitive information is present m the hard drive duster tips. Which of the following should the third-party firm implement NEXT to ensure all data is permanently removed?
Options
- ADegauss the drives using a commercial tool,
- BScramble the file allocation table.
- CWipe the drives using a 21-pass overwrite,.
- DDisable the logic board using high-voltage input.
How the community answered
(16 responses)- C94% (15)
- D6% (1)
Why each option
Cluster tip data surviving a 7-pass wipe indicates the tool did not overwrite every physical sector; a 21-pass full-disk overwrite applies additional passes across all sectors to eliminate residual slack space data.
Degaussing permanently destroys the magnetic field of the drive and renders it unusable for reuse, which conflicts with the current process of tagging devices for reuse or disposal.
Scrambling the file allocation table makes files inaccessible through the operating system but does not overwrite the underlying data in cluster slack space, leaving sensitive information fully recoverable with forensic tools.
A 21-pass overwrite performs repeated writes using multiple patterns across every physical sector of the drive, including file slack (cluster tip) space, ensuring remnant data that survived the 7-pass process is thoroughly eliminated; unlike physical destruction methods, a properly configured 21-pass full-disk wipe addresses the gap while still preserving the drive for potential reuse as the current process requires.
Disabling the logic board with high-voltage input destroys the drive controller but does not overwrite the magnetic platters, leaving all data on the platters potentially recoverable through platter transplant or direct read techniques.
Concept tested: Media sanitization and data remanence in cluster slack space
Source: https://csrc.nist.gov/publications/detail/sp/800-88/rev-1/final
Topics
Community Discussion
No community discussion yet for this question.