Disk sanitization

About disk sanitization

Disk sanitization is the process of physically obliterating data by means of overwrite patterns on filer or NearStore appliance disks in a manner that precludes recovery of that data by any known recovery methods. The Data ONTAP disk sanitize feature enables you to carry out disk sanitization by using three successive byte overwrite patterns per cycle and a default six cycles per operation, in compliance with United States Department of Defense and Department of Energy security requirements.

You might choose to sanitize filer or NearStore appliance disks for the following reasons:

You have some disks that you have deactivated for use in one filer or NearStore appliance and you either want to reuse those disks in another filer or NearStore appliance or simply dispose of them but want to ensure that data currently on those disks is physically unrecoverable in any case.
You want to selectively sanitize information from specified files or directories in a filer or NearStore appliance volume while preserving the remainder of the data that is stored on that volume.

What this section covers

The section covers the following topics:

Disk sanitization limitations

The disk sanitization operations described in this section are subject to the following limitations:

The operations are not supported on gFiler appliances.
The operations are not supported in takeover mode on clustered systems or on disabled cluster systems.
Disk sanitization cannot be carried out on disks that were failed due to readability or writability problems.
Disk sanitization cannot be carried out on disks that have ever belonged to an SEC 17a-4-compliant SnapLock volume.
The formatting phase of the disk sanitization process is skipped on Advanced Technology Attachment (ATA) drives.

Licensing disk sanitization

The disk sanitization feature for Data ONTAP 6.5 requires installation of a license. Once installed, the license enables the disk sanitize command and limited SnapMirror replication abilities that facilitate selective sanitization operations.

Caution
Once installed on a NetApp appliance, the license for disk sanitization is permanent.

To install the disk sanitization license, complete the following step:

Step	Action
1	Enter the following command: license add sanitize_code sanitize_code is the disk sanitization license code that Network Appliance provides.

Sanitizing disks

You can sanitize any disk that has "spare" status. This includes disks that exist on the filer or NearStore appliance as spare disks after the volume that they belong to has been destroyed and disks that were removed from the spare disk pool by the disk remove command but have been returned to spare status after an appliance reboot.

To sanitize a disk or a set of disks on a filer or NearStore appliance, complete the following steps:

Step	Action
1	To print a listing of all disks assigned to RAID groups, failed, or existing as spares, enter the following command. sysconfig -r Do this to verify that the disk or disks that you want to sanitize do not belong to any existing RAID group in any existing volume.
2	Enter the following command to physically sanitize the specified disk or disks of all existing data. disk sanitize start [-p pattern1 [-p pattern2] [-p pattern3]] [-c cycle_count] disk_list In the preceeding example, pattern specifies a cycle of one to three user-defined hex byte overwrite patterns that can be applied in succession to the disks being sanitized. The default hex pattern specification is -p 0x55 -p 0xAA -p 0x36. `-c cycle_count` specifies the number of cycles for applying the specified overwrite patterns. The default value is 6 cycles. The maximum value is 7 cycles. `disk_list` specifies a space-separated list of spare disks to be sanitized. Example The following command applies the default three disk sanitization overwrite patterns for the default six cycles (for a total of 18 overwrites) to the specified disks, 7.6, 7.7, and 7.8. disk sanitize start 7.6 7.7 7.8 Result The specified disks are sanitized, put into the pool of broken disks, and marked as "sanitized." A list of all the sanitized disks is stored in the filer or NearStore appliance's `/etc` directory. Verification To check the status of the disk sanitization process, enter the following command: *disk sanitize status [disk_list]* Note If you need to abort the sanitization operation, enter `disk sanitize abort [`disk_list`]` Caution Do not turn off the filer, disrupt the disk loop, or remove target disks during the sanitization process. If the sanitization process is disrupted, the target disks that are in the formatting stage of disk sanitization will require reformatting before their sanitization can be completed. See If formatting is interrupted.
3	To release sanitized disks from the pool of broken disks for reuse as spare disks, enter the following command: disk sanitize release disk_list Caution The `disk sanitize release` command removes the "sanitized" label from the affected disks and returns them to spare state. Rebooting the filer or removing the disk also removes the sanitized label from any sanitized disks and returns them to spare state. Verification To list all disks on the filer or NearStore appliance and verify the release of the sanitized disks into the pool of spares, enter `sysconfig -r.`

Step

Action

To print a listing of all disks assigned to RAID groups, failed, or existing as spares, enter the following command.

sysconfig -r

Do this to verify that the disk or disks that you want to sanitize do not belong to any existing RAID group in any existing volume.

Enter the following command to physically sanitize the specified disk or disks of all existing data.

disk sanitize start [-p pattern1 [-p pattern2] 

[-p pattern3]] [-c cycle_count] disk_list

In the preceeding example, pattern specifies a cycle of one to three user-defined hex byte overwrite patterns that can be applied in succession to the disks being sanitized. The default hex pattern specification is -p 0x55 -p 0xAA -p 0x36.

-c cycle_count specifies the number of cycles for applying the specified overwrite patterns. The default value is 6 cycles. The maximum value is 7 cycles.

disk_list specifies a space-separated list of spare disks to be sanitized.

Example

The following command applies the default three disk sanitization overwrite patterns for the default six cycles (for a total of 18 overwrites) to the specified disks, 7.6, 7.7, and 7.8.

disk sanitize start 7.6 7.7 7.8

Result

The specified disks are sanitized, put into the pool of broken disks, and marked as "sanitized." A list of all the sanitized disks is stored in the filer or NearStore appliance's /etc directory.

Verification

To check the status of the disk sanitization process, enter the following command:

disk sanitize status [disk_list]

Note
If you need to abort the sanitization operation, enter
disk sanitize abort [disk_list]

Caution
Do not turn off the filer, disrupt the disk loop, or remove target disks during the sanitization process. If the sanitization process is disrupted, the target disks that are in the formatting stage of disk sanitization will require reformatting before their sanitization can be completed. See If formatting is interrupted.

To release sanitized disks from the pool of broken disks for reuse as spare disks, enter the following command:

disk sanitize release disk_list

Caution
The disk sanitize release command removes the "sanitized" label from the affected disks and returns them to spare state. Rebooting the filer or removing the disk also removes the sanitized label from any sanitized disks and returns them to spare state.

Verification

To list all disks on the filer or NearStore appliance and verify the release of the sanitized disks into the pool of spares, enter sysconfig -r.

Process description

After you invoke the disk sanitize start command, Data ONTAP begins the sanitization process on each of the specified drives. The process consists of a disk format operation, followed by the specified overwrite patterns repeated for the specified number of cycles.

Note
The formatting phase of the disk sanitization process is skipped on Advanced Technology Attachment (ATA) drives.

The time to complete the sanitization process for each drive varies with the size of the drive, the number of patterns specified, and the number of cycles specified.

For example, the following command invokes 1 format overwrite pass and 18 pattern overwrite passes of disk 7.3.

disk sanitize start -p 0x55 -p 0xAA -p 0x37 -c 6 7.3

If disk 7.3 is 36 GB and each formatting or pattern overwrite pass on it takes 15 minutes, then the total sanitization time is 19 passes times 15 minutes, or 285 minutes or 4.75 hours.
If disk 7.3 is 73 GB and each formatting or pattern overwrite pass on it takes 30 minutes, then total sanitization time is 19 passes times 30 minutes, or 570 minutes or 9.5 hours.

If disk sanitization is interrupted

If the sanitization process is interrupted by power failure, filer panic, or a user-invoked disk sanitize abort command, the disk sanitize command must be re-invoked and the process repeated from the beginning.

If formatting is interrupted

If the formatting phase of disk sanitization is interrupted, the Data ONTAP attempts to reformat any drives that were corrupted by an interruption of the formatting. After a system reboot and once every hour Data ONTAP checks for any sanitization target disk that did not complete the formatting phase of its sanitization. If such a disk is found, Data ONTAP attempts to reformat that disk and writes a message to the console informing the user that a corrupted disk has been found and will be reformatted. After the disk is reformatted, it is returned to the hot spare pool. The user can then rerun the disk sanitize command on that disk.

Stopping disk sanitization

You can use the disk sanitize abort command to stop an ongoing sanitization process on one or more specified disks. If you use the disk sanitize abort command, the specified disk or disks are returned to "spare" state and the "sanitized" label is removed.

Step	Action
1	Enter the following command: `disk sanitize abort` disklist Data Ontap displays the message "Sanitization abort initiated." If the specified disks are undergoing the disk formatting phase of sanitization, just prior to the overwrite pattern phase, the abort will not occur until the disk formatting is complete. Once the process is stopped, ONTAP displays the message "Sanitization aborted for diskname."

Step

Action

Enter the following command:

disk sanitize abort disklist

Data Ontap displays the message "Sanitization abort initiated."

If the specified disks are undergoing the disk formatting phase of sanitization, just prior to the overwrite pattern phase, the abort will not occur until the disk formatting is complete.

Once the process is stopped, ONTAP displays the message "Sanitization aborted for diskname."

Selectively sanitizing data

Selective data sanitization consists of physically obliterating data in specified files or directories while preserving all other active file data located on the affected volume for continued user access.

Summary of the selective sanitization process

Because data for any one file on a filer or NearStore appliance is physically stored on any number of data disks in the volume containing that data, and because the physical location of data within a volume can change, sanitization of selected data, such as files or directories, requires that you sanitize every disk in the volume where it is located (after first migrating the volume data that you do not want to sanitize to disks on another volume). To selectively sanitize data contained in a volume, you must carry out three general tasks.

Delete the selected files or directories (and any volume snapshots that contain those files or directories) from the volume that contains them.
Migrate the remaining data (the data that you want to preserve) in the affected volume to a new set of disks in a destination volume on the same filer or NearStore appliance.
Destroy the original volume and sanitize all the disks that belong to that volume.

Requirements for selective sanitization

Successful completion of this process requires the following conditions:

You install a disk sanitization license which enables the disk sanitizing feature and also enables limited SnapMirror functionality, such as the snapmirror initialize and snapmirror migrate commands for local operations on your filer or NearStore appliance.
You have enough storage space on your filer or NearStore appliance to create an additional destination volume to which you can migrate the data that you want to preserve from the original volume. This destination volume must have a storage capacity at least as large as that of the original volume.

Volume size and selective sanitization

Because sanitization of any unit of data in a volume still requires you to carry out data migration and disk sanitization processes on that entire volume, Network Appliance recommends that you use small volumes to store data that will require sanitization. Use of small volumes for storage of data requiring sanitization minimizes the time, disk space, and bandwidth that sanitization of that data will require.

Backup and data sanitization

Absolute sanitization of data means physical sanitization of all instances of volumes containing sensitive data; it is therefore advisable to maintain your sensitive data in volumes that are not regularly backed up to volumes that also back up large amounts of nonsensitive data.

Procedure for selective sanitization

To carry out selective sanitization of data within a volume, complete the following steps:


rm -rf /nixdir/nixfile.doc
snap delete -a vol_name
vol status vol_name -b 
vol create dest_vol disklist
vol restrict dest_vol 
snapmirror initialize -S src_vol dest_vol 
snapmirror migrate src_vol dest_vol
vol status src_vol -r
vol offline src_vol
vol destroy src_vol
vol rename dest_vol src_vol
Run exportfs -a


Step	Action
1	From a Windows or UNIX client, delete from the original volume, the directories or files whose data you want to selectively sanitize from the active file system. Use the appropriate Windows or UNIX command, such as: rm -rf /nixdir/nixfile.doc
2	Through the filer CLI, in the original volume, enter one of the following command forms to delete all volume snapshots containing the files or directories that you just deleted. To delete all snapshots associated with the volume, enter the following command syntax: snap delete -a vol_name For example: `snap delete -a nixsrcvol` To delete a specific snapshot, enter the following command syntax snap delete vol_name snapshot_name For example: `snap delete nixsrcvol nightly0`
3	Enter the following command to determine the size of the volume from which you deleted file, directory, or snapshot data: *vol status vol_name* -b Example vol status nixsrcvol -b** Calculate the volume size in bytes by multiplying the bytes per block (block size) by the blocks per volume (volume size).
4	Enter the following command to create a volume to which you will migrate undeleted data. This volume must be of equal or greater storage capacity than the volume from which you just deleted file, directory, or snapshot data: vol create dest_vol disklist Example vol create nixdestvol 8@72G Note The purpose of this new volume is to provide a migration destination that is absolutely free of the data that you want to sanitize. No previous mirror or backup relationship between the new volume and the source volume can exist.
5	Enter the following command to put the volume that you just created in restricted state: vol restrict dest_vol Restricted state is a requirement of the SnapMirror destination volume. Example vol restrict nixdestvol
6	Enter the following command to establish a SnapMirror source/destination relationship between the volume whose data you want to sanitize and the volume to which you will migrate the data that you want to preserve: snapmirror initialize -S src_vol dest_vol src_vol is the source volume. dest_vol is the destination volume. Caution Be sure that you have deleted the files or directories that you want to sanitize (and any affected snapshots) from the source volume before you run the `snapmirror initialize` command. Example snapmirror initialize -S nixsrcvol nixdestvol Verification To confirm that the SnapMirror relationship is established enter the following command: snapmirror status dest_vol
7	Enter the following command to migrate all the undeleted data from the source volume to the destination volume: snapmirror migrate src_vol dest_vol Example snapmirror migrate nixsrcvol nixdestvol Results The `snapmirror migrate` command transfers all content--including the contained qtrees, directories, files, and all NFS filehandles--from the source volume to the destination volume. The process does the following: Checks the source and destination volumes for readiness. Stops NFS and CIFS service to the source volume. This prevents changes to the source volume data, which makes it appear to clients as though nothing has changed during the migration. Runs a regular SnapMirror transfer between the two volumes. Migrates the NFS filehandles to the destination volume. Puts the source volume in restricted mode Makes the destination volume writable.
8	Record the disks currently in the source volume. (After that volume is destroyed, you will sanitize these disks.) To list the disks in the source volume, enter the following command syntax: *vol status src_vol* -r Example vol status nixsrcvol -r** The disks that you are going to sanitize are listed in the Device column of the `vol status` -r output.
9	Enter the following command to take the source volume offline: vol offline src_vol Example vol offline nixsrcvol
10	Enter the following command to destroy the source volume: vol destroy src_vol Example vol destroy nixsrcvol
11	Enter the following command to rename the destination volume, giving it the name of the source volume that you just destroyed: vol rename dest_vol src_vol Example vol rename nixdestvol nixsrcvol
12	Reestablish your CIFS or NFS services: If the original volume supported CIFS services, restart the CIFS services on the destination volume after migration is complete. If the original volume supported NFS services, enter the following command: Run `exportfs -a` Result Users who were accessing files in the original volume will access those files in the renamed destination volume with no remapping of their connections required.
13	Use the `disk sanitize` command to sanitize the disks that used to belong to the source volume. Follow the procedure described in Sanitizing disks.

Reading disk sanitization log files

The disk sanitization process outputs two types of log files.

One file, sanitized_disks, lists all the drives that have been sanitized.
For each disk being sanitized, a file is created where the progress information will be written.

Listing the sanitized disks

The /etc/sanitized_disks file contains the serial numbers of all drives that have been successfully sanitized. For every invocation of the disk sanitize start command, the serial numbers of the newly sanitized disks are appended to the file.

A read of the /etc/sanitized_disks file shows output similar to the following:

admin1> rdfile /etc/sanitized_disks

Tue Jun 24 02:54:11 Disk 8a.44 [S/N 3FP0RFAZ00002218446B] 
sanitized.

Tue Jun 24 02:54:15 Disk 8a.43 [S/N 3FP20XX400007313LSA8] 
sanitized.

Tue Jun 24 02:54:20 Disk 8a.45 [S/N 3FP0RJMR0000221844GP] 
sanitized.

Tue Jun 24 03:22:41 Disk 8a.32 [S/N 43208987] sanitized.

Reviewing the disk sanitization progress

A progress file is created for each drive sanitized and the results are consolidated to the /etc/sanitization.log file every 15 minutes during the sanitization operation. Entries in the log resemble the following:

Tue Jun 24 02:40:10 Disk sanitization initiated on drive 8a.43 [S/N 
3FP20XX400007313LSA8]

Tue Jun 24 02:40:10 Disk sanitization initiated on drive 8a.44 [S/N 
3FP0RFAZ00002218446B]

Tue Jun 24 02:40:10 Disk sanitization initiated on drive 8a.45 [S/N 
3FP0RJMR0000221844GP]

Tue Jun 24 02:53:55 Disk 8a.44 [S/N 3FP0RFAZ00002218446B] format 
completed in 00:13:45.

Tue Jun 24 02:53:59 Disk 8a.43 [S/N 3FP20XX400007313LSA8] format 
completed in 00:13:49.

Tue Jun 24 02:54:04 Disk 8a.45 [S/N 3FP0RJMR0000221844GP] format 
completed in 00:13:54.

Tue Jun 24 02:54:11 Disk 8a.44 [S/N 3FP0RFAZ00002218446B] cycle 1 
pattern write of 0x47 completed in 00:00:16.

Tue Jun 24 02:54:11 Disk sanitization on drive 8a.44 [S/N 
3FP0RFAZ00002218446B] completed.

Tue Jun 24 02:54:15 Disk 8a.43 [S/N 3FP20XX400007313LSA8] cycle 1 
pattern write of 0x47 completed in 00:00:16.

Tue Jun 24 02:54:15 Disk sanitization on drive 8a.43 [S/N 
3FP20XX400007313LSA8] completed.

Tue Jun 24 02:54:20 Disk 8a.45 [S/N 3FP0RJMR0000221844GP] cycle 1 
pattern write of 0x47 completed in 00:00:16.

Tue Jun 24 02:54:20 Disk sanitization on drive 8a.45 [S/N 
3FP0RJMR0000221844GP] completed.

Tue Jun 24 02:58:42 Disk sanitization initiated on drive 8a.43 [S/N 
3FP20XX400007313LSA8]

Tue Jun 24 03:00:09 Disk sanitization initiated on drive 8a.32 [S/N 
43208987]

Tue Jun 24 03:11:25 Disk 8a.32 [S/N 43208987] cycle 1 pattern write 
of 0x47 completed in 00:11:16.

Tue Jun 24 03:12:32 Disk 8a.43 [S/N 3FP20XX400007313LSA8] 
sanitization aborted by user.

Tue Jun 24 03:22:41 Disk 8a.32 [S/N 43208987] cycle 2 pattern write 
of 0x47 completed in 00:11:16.

Tue Jun 24 03:22:41 Disk sanitization on drive 8a.32 [S/N 43208987] 
completed.

Disk sanitization

About disk sanitization

What this section covers

Disk sanitization limitations

Licensing disk sanitization

Sanitizing disks

Example

Result

Verification

Verification

Process description

If disk sanitization is interrupted

If formatting is interrupted

Stopping disk sanitization

Selectively sanitizing data

Summary of the selective sanitization process

Requirements for selective sanitization

Volume size and selective sanitization

Backup and data sanitization

Procedure for selective sanitization

Example

Example

Example

Example

Verification

Example

Results

Example

Example

Example

Example

Result

Reading disk sanitization log files

Listing the sanitized disks

Reviewing the disk sanitization progress