Does drilling a hole into a hard drive suffice to make its data unrecoverable?
Solution 1:
Drilling a hole in the drive enclosure which passes through all the platters will make it impossible to run the drive. Most modern HDDs don't have air inside the enclosure, and you've let what was in there escape. You've filled the cavity with tiny pieces of drill swarf, which will be on everything including the platters, and will crash the heads if someone tries to lower them onto the rotating platters. You've also unbalanced the platters, though I don't have an estimate for whether this will be fatal. The drill bit will likely pass through the controller board on the way, which though not fatal will certainly not help anyone trying to hook the drive up.
You have not prevented someone from putting the platter under a magnetic force microscope and reading most of the data off that way. We can be fairly sure this is possible, because the SANS paper linked from the linked SF article demonstrates that you can't recover data from a platter with an MFM after a single overwriting pass, and such a test would be completely meaningless if you couldn't recover non-overwritten data using the same procedure.
So drilling through the platters will very likely prevent data from being read off the HDD by normal means. It won't prevent much of the data being recoverable by a determined, well-funded opponent.
All security is meaningless without a threat model. So decide what you're securing against. If you're worried about someone hooking up your old company HDDs and reading them, after they found them on ebay / the local rubbish dump / the WEEE recycling bin, then drilling is good. Against state-level actors, drilling is probably insufficient. If it helps, I drill most of my old drives, too, because I am worried about casual data leakage, but I doubt the security services are interested in most of my data. For the few drives I have which hold data that Simply Must Not Leak, I encrypt them using passphrases of known strength, and drill them at the end of their lives.
Solution 2:
The security policy for many companies is to universally physically destroy all data carriers, so plain old paper documents and prints, spinning hard disks, SSD's etc. all get shredded before they get recycled.
In that regard your question might be irrelevant and you may simply need to comply to that policy.
With SSD's becoming more prevalent it is also good to realise that software wipes are not reliable for SSD's.
With regards to physically destroying drives by drilling a hole: That will prevent normal usage, resale and refurbishing.
In many cases that may be sufficient, but while drilling a hole makes the disk inoperable that still only destroys a fraction of the data. With sufficient money to spend a determined attacker can still recover the remaining data. If that is a risk is something you need to determine for yourselves.
Solution 3:
Don't drill all the way through, just through the top of the housing. Pour in thermite and ignite!*
- Definitely safer than drilling one hole all the way through.
- Probably a lot safer than overwriting every bit too.
- This will even take care of SSDs, though they may not have a hollow for powder to fill.
- Your apprentice toolmakers will think this is a lot more fun even than drilling!
*do this outside.
Solution 4:
Its worth remembering that drilling and other physical destruction methods are relatively fast compared to a wipe, and it is simple to verify that the disk has in fact been processed by looking at it, since unlike a wiped and unwiped disk, it is obvious that a disk with a hole in it will not work.
So, either a few hours, or a minute or (less!) with a drill press per disk.
You'd obviously want to tailor your approach for SSDs but the advantage with physical destruction for a lot of disks is speed and relative verifiability that the data on the disks is no longer recoverable.
Solution 5:
While drilling a hole is sufficient against most real-life attackers, why not buy an HDD shredder? It's only $3000 to $5000 for smaller models, and it works pretty well with SSDs too. Also, having your drives shredded will sound much more convincing in case of an audit than "we have drilled holes in them".