DoD 5220.22-M Standard for Drive Erasure
There are numerous standards defined over the past several decades to govern data wiping and other data destruction techniques for safe and compliant media sanitization practices. For data erasure, these standards determine the overwriting patterns and passes set by government agencies and private institutions across the world. For E.g., the U.S. Department of Defense (DoD), the U.S. Navy, and the U.S. Air Force have their data erasure standards. Other examples include New Zealand Government’s Community security bureau (NZSIT), British HMG (Her majesty’s government) Infosec standard, etc.
This article provides an insight into the U.S. Department of Defense (DoD) 5220.22-M standard for drive erasure. It also deep dives into the steps involved in the US DoD data wipe standard for wiping hard drives. Finally, it gives you an overview of how to implement the standard for erasing hard drives at an industrial scale using DoD data wiping software.
What is the DoD 5220.22-M Standard?
DoD 5220.22-M Standard is a widely recognized method for data erasure used by government agencies and organizations worldwide for performing drive erasure. In the media sanitization circles, it is known as US DoD 5220.22-M data wipe standard. The standard involves overwriting the previously stored data on a hard drive with specific binary patterns repeatedly through a specific number of passes.
The DoD method is based on overwriting the addressable memory locations in hard disk drives with ‘zeroes’ and ‘ones’ as the binary patterns. The standard defines the implementation of three secure overwriting passes with verification at the end of the final pass.
The following passes constitute the US DoD data wipe standard:
Pass 1: All addressable locations are overwritten with binary zeroes
Pass 2: All addressable locations are overwritten with binary ones
Pass 3: All addressable locations are overwritten with a random bit pattern
The final overwrite pass is then verified.
In 2001, DoD published the DoD 5220.22-M ECE method, a 7-pass version of the original standard. It runs DoD 5220.22-M twice and an extra pass (DoD 5220.22-M (C) Standard) in between.
Pass 1: All addressable locations are overwritten with binary zeroes
Pass 2: All addressable locations are overwritten with binary ones (the compliment of the above)
Pass 3: All addressable locations are overwritten with a random bit pattern
Pass 4: All addressable locations are overwritten with binary zeroes
Pass 5: All addressable locations are overwritten with binary zeroes
Pass 6: All addressable locations are overwritten with binary ones (the compliment of the above)
Pass 7: All addressable locations are overwritten with a random bit pattern
Verify the final overwrite pass.
Despite the upgrades, the three-pass method is still the standard implementation for DoD level data wipe.
Origins of the US Department of Defense (DoD) Data Erasure Algorithm
The Department of Defense (DoD) standard was developed in 1995 for high-security institutions like Pentagon etc. At the time of its launch, the standard had set a benchmark for data wiping and hardware disposal with its DoD Information Assurance Certification and Accreditation Process (DIACAP).
The DoD 5220.22-M standard was published by the U.S. Department of Defense (DoD) in the National Industrial Security Program Operating Manual (also known as NISPOM or Department of Defense document #5220.22-M).
Why use the DoD 5220.22-M Standard?
The DoD 5220.22-M algorithm provides one of the most recognized data destruction methods, and it is still perceived as one of the industry standards for hard drive erasure in the U.S. If you have a high-capacity hard drive or there are a lot of storage drives in your inventory, DoD 5220.22-M data wipe method will take less time than other more comprehensive data erasure methods like the Gutmann standard that involves 30 passes.
Further, the DoD 5220.22-M data wipe standard performs verification at the end of each pass. This ensures that the data is duly overwritten. In addition to zeroes and ones, DoD 5220.22-M uses random characters to overwrite the storage locations in a hard drive. The inclusion of random characters reduces the probability of data recovery.
How to Implement DoD 5220.22-M Standard?
The information security policy of many federal, state, and private firms require the implementation of DoD 5220.22-M standard as part of their data erasure practice. You can implement DoD 5220.22-M standard with the help of professional DoD data wipe software like BitRaser Drive Eraser that can implement DoD 5220.22-M and other global standards lto help government bodies and private organizations attain regulatory compliance.
|
Limitation of the DoD 5220.22-M Standard
Though DoD data wiping standard was considered as the benchmark standard for data destruction, for many years, it has been succeeded by other latest standards such as NIST SP 800-88. The main reason is the limitations of the DOD 5220.22M data wipe method concerning the erasure of flash memory-based storage. It was not designed to erase chip-based storage e.g. SSD. This is why many government organizations such as the Department of Defense, Nuclear regulatory commission, Department of Energy, Canadian standard association, etc. no longer cite DoD 5220.22-M as a standard for secure erasure (or data destruction in the broader sense).
|
Final Thoughts
DoD 5220.22-M standard still carries a lot of credibility and is held in high esteem as it provides a robust 3-pass erasure that is detailed and efficient. Therefore, many institutions follow the DoD standard as a component of their hard drive erasure and disposition policy.
DoD compliant data wipe software tools such as BitRaser Drive Eraser helps erase the hard drives as per the DoD standard and generating tamper-proof certificates and reports for audit trails.
