Disk Scrubbing on a Clariion

RRR,
Any data that is classified as Protected Health Information (PHI) or Health Insurance Portability and Accountability Act (HIPAA) carries certain requirements for the handling of that data and the destruction/erasure of devices that contained that data. That is why he needs the certifiable proof of erasure/destruction.

Note that such re-use is not the same as data erasure - if you want to securely erase any existing information before re-using the drives, you would need to check into a data erasure offering from EMC Global Services.

We've had this discussion more than once in the past and since the Clariion doesn't have a data shredding option, there are 2 options left:
- hammer method: you destroy the drive physically by touching it with a hammer, throwing it out of an airplane, setting it on fire and solutions like that.
- writing data like yo already did and perform a data shredding option from a host perspective.

EMC has a service that does this for you, but IMHO you can do this yourself if you have a proper product that can write certain data patterns 3 times, 7 times or whatever you think is needed to not be able to get data back from the disks.

If you are not reusing the array there are recycling services that will destroy drives for and provide certified paperwork on each drive destroyed. We have PHI and HIPPA data on our arrays as well, and for old decomissioned enclosures we contract with a local computer recycling service that provides documented proof of drive destruction.

If you are selling/shipping/reusing the array then your only other option that will satisfy audits that the data on the drive was destroyed is to engage EMC services.

I learned something here

We do every day don't we

I am sure you have something similar in Europe either through the EU or the Netherlands government?

> If you are selling/shipping/reusing the array then your only other option that will satisfy audits that the data on the drive was destroyed is to engage EMC services.

Additional information can be found at;

http://www.emc.com/services/portfolio/implementation/disk-security-services/certified-data-erasure-service.htm

Regards,
DGM

So the one question that hasn't really been answered yet is if you are doing this so you can sell the old array, or if you are just doing it so you can dispose of the array.

We have a few CLARiiON arrays that we decomissioned and have decided to not remove from our sites. Of a pair of FC4700s, our Server Support guys wanted some SAN equipment to play with so we gave them one (with no maintenance on it) and they use the second one for spare parts. It's up to them to find space to store the things, and they will now be responsible if they decide to dispose of the equipment. We just decomitted a pair of CX400s and some of our Corporate technology folks decided they wanted a SAN playground as well. Now they are taking the CX400s under the same arrangement.

If we hadn't made these arrangements we probably would have found a corner of a storage room to put these things in permanently. The cost of erasure and disposal far outweighs the cost of some floor space in a storage room. Mind you we have some fairly large buildings that allow for finding corners to hide equipment we don't want any more :-)

The few arrays we had to send back at the end of a lease, we had to pay EMC to wipe it so we could get the certificates to prove the data did not go offsite.

I've had this discussion with my EMC contacts (Sales, Tech and higher up account managers) and the word is that the purchaser must buy support from EMC, there are licence entitlements for FLARE and Navisphere which EMC need to be paid for.

Essentially if you buy a 2nd hand array you are not entitled to use the software on it which sort of defeats the purpose since support on an old array is very expensive...

EMC Certified Erasure is a very particular process which is garunteed by Engineering to remove all client data from the system to a point wher eit is extremely unlikely it could be recovered.

I'm an EMC service technician and the two procedures available involve an 80 page set of instructions and special software in one case and a special erasure server I would bring on site in the other case.

Can you be satisfied that the sensitive data on the array is no longer available using your homebrewed methods? I'm not saying its impossible, but remember that wht you do yourself isn't the same as asking the designers of the equipment for a method that removes all traces of client information, garunteed.