1

I work with some folks who do disaster relief in different parts of the world. One concern that they have is that unfriendly governments or local officials might come into their offices at anytime and steal their data, etc. So I was wondering whether there is anything like a hard drive panic button, where you can press a key and it would instantly securely erase your hard drive? That way in case of a raid they could kill their drives?

I would need a solution for Windows, Mac, and Linux if possible.

  • 5
    For which OS? What is your price limit? Not that I have something in mind, but some essential details are needed for good recommendations :) – Izzy Mar 16 '17 at 17:55
  • I would advise trying to avoid collecting any data that the locals would be looking for - it may make operations less efficient, but the sort of people who would just walk off with your HDs are likely to be none too pleased when they find the HDs have been wiped. – Michael Kohne Mar 16 '17 at 18:36
  • 1
    I would also suggest that a panic button is a terrible approach to the problem. Using a panic button requires that you be able to get to the HDs before the bad guys do. That's a laughably bad assumption in the sort of place where the local officials can't be trusted. – Michael Kohne Mar 16 '17 at 18:37
  • 3
    Using instead encrypted filesystem? – sgargel Mar 16 '17 at 18:42
  • 1
    I don't think there is a silver bullet for this type of issue. Yes, we can have encryption on the drive. That will help. The panic button just adds an additional layer of security. Drive encryption can be broken, given enough time and computing power. So figured there should be additional measures that could be taken. – krishnab Mar 16 '17 at 18:49
4

These days there are many readily available consumer SED self-encrypting drives and OPAL drives which encrypt all the data written to the disk memory (for SSD's) or surface, using a key that must be configured every time the disk is powered up. By resetting the key inside the drive all data on the drive is instantly lost and cannot be recovered. (This is nothing like the old BIOS password protection).

So you could put the key on a small usb storage device, and the computer will only boot successfully if you have this device plugged in at the time. You can therefore move the problem into one of destroying this usb key, and powering off or resetting the computer, or just of having enough time to send a command to the disk asking it to destroy the internal key (which is practically instantaneous).

You might further encrypt the key with another key on another usb storage device, and so need 2 keys to boot... It is important that no one usually types in the key, for example, or they can be coerced into giving up that information.

There's an archlinux page on using OPAL disks in Linux. They were initially only supported by Windows. Note there are security implications in just hibernating or putting the computer to sleep.

1

If the data can be kept on external hard drives, then something from Apricorn might do the trick. They don't have a panic button per-say (nothing consumer-focused does, to my knowledge), but if input the wrong pin too many times, they'll wipe the key.

Downside of course is that they are pretty pricey.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.