Sanitizing disks

About disk sanitization

Disk sanitization is the process of physically obliterating data by overwriting disks with specified byte patterns or random data in a manner that prevents recovery of the original data by any known recovery methods. You sanitize disks if you want to ensure that data currently on those disks is physically unrecoverable. For example, you might have some disks that you intend to remove from one storage system and you want to re-use those disks in another storage system or simply dispose of the disks. In either case, you want to ensure no one can retrieve any data from those disks.

The Data ONTAP disk sanitize command enables you to carry out disk sanitization by using three successive default or user-specified byte overwrite patterns for up to seven cycles per operation. You can start, stop, and display the status of the disk sanitization process, which runs in the background. Depending on the capacity of the disk and the number of patterns and cycles specified, this process can take several hours to complete. When the process has completed, the disk is in a sanitized state. You can return a sanitized disk to the spare disk pool with the disk sanitize release command.

What this section covers

The section covers the following topics:

Disk sanitization limitations

The following list describes the limitations of disk sanitization operations. Disk sanitization

Is not supported on older disks.
To determine if disk sanitization is supported on a specified disk, run the storage show disk command. If the vendor for the disk in question is listed as NETAPP, disk sanitization is supported.
Is not supported on V-Series systems.
Is not supported in takeover mode on clustered storage systems. (If a storage system is disabled, it remains disabled during the disk sanitization process.)
Cannot be carried out on disks that were failed due to readability or writability problems.
Cannot be carried out on disks that belong to an SEC 17a-4-compliant SnapLock volume until the expiration periods on all files have expired, that is, all of the files have reached their retention dates.
Cannot perform the formatting phase of the disk sanitization process on ATA drives.
Cannot be carried out on more than one SES drive at a time.

Licensing disk sanitization

Before you can use the disk sanitization feature, you must install the disk sanitization license.

Attention
Once installed on a storage system, the license for disk sanitization is permanent.

Attention
The disk sanitization license prohibits the following admin command from being used on the storage system:

dd (to copy blocks of data)
Attention
The disk sanitization license prohibits the following diagnostic commands from being used on the storage system:
dumpblock (to print dumps of disk blocks)
setflag wafl_metadata_visible (to allow access to internal WAFL files)

To install the disk sanitization license, complete the following step:

Step	Action
1	Enter the following command: license add disk_sanitize_code disk_sanitize_code is the disk sanitization license code that NetApp provides.

Sanitizing spare disks

You can sanitize any disk that has spare status. This includes disks that exist in the storage system as spare disks after the aggregate that they belong to has been destroyed. It also includes disks that were removed from the spare disk pool by the disk remove command but have been returned to spare status after a system reboot.

To sanitize a disk or a set of disks in a storage system, complete the following steps.

Step	Action
1	Print a list of all disks assigned to RAID groups, failed, or existing as spares, by entering the following command. sysconfig -r Do this to verify that the disk or disks that you want to sanitize do not belong to any existing RAID group in any existing aggregate.
2	Enter the following command to sanitize the specified disk or disks of all existing data. disk sanitize start [-p pattern1\|-r [-p pattern2\|-r] [-p pattern\|-r]]] [-c cycle_count] disk_list `-p` pattern1 `-p` pattern2 `-p` pattern3 specifies a cycle of one to three user-defined hex byte overwrite patterns that can be applied in succession to the disks being sanitized. The default hex pattern specification is `-p 0x55 -p 0xAA -p 0x3c`. `-r` replaces a patterned overwrite with a random overwrite for any or all of the cycles, for example: `-p 0x55 -p 0xAA -r` `-c` cycle_count specifies the number of cycles for applying the specified overwrite patterns. The default value is one cycle. The maximum value is seven cycles. Note To be in compliance with United States Department of Defense and Department of Energy security requirements, you must set cycle_count to six cycles per operation. disk_list specifies a space-separated list of spare disks to be sanitized.
	Example The following command applies the default three disk sanitization overwrite patterns for one cycle (for a total of 3 overwrites) to the specified disks, 7.6, 7.7, and 7.8. disk sanitize start 7.6 7.7 7.8 If you set cycle_count to 6, this example would result in three disk sanitization overwrite patterns for six cycles (for a total of 18 overwrites) to the specified disks.
	Result The specified disks are sanitized, put into the pool of broken disks, and marked as sanitized. A list of all the sanitized disks is stored in the storage system's `/etc` directory. Note If you need to abort the sanitization operation, enter `disk sanitize abort [`disk_list`]` If the sanitization operation is in the process of formatting the disk, the abort will wait until the format is complete. The larger the drive, the more time this process takes to complete. Attention Do not turn off the storage system, disrupt the disk loop, or remove target disks during the sanitization process. If the sanitization process is disrupted, the target disks that are in the formatting stage of disk sanitization will require reformatting before their sanitization can be completed. See If formatting is interrupted.
3	To check the status of the disk sanitization process, enter the following command: *disk sanitize status [disk_list]*
4	To release sanitized disks from the pool of broken disks for reuse as spare disks, enter the following command: disk sanitize release disk_list Attention The `disk sanitize release` command removes the sanitized label from the affected disks and returns them to spare state. Rebooting the storage system or removing the disk also removes the sanitized label from any sanitized disks and returns them to spare state. Verification To list all disks in the storage system and verify the release of the sanitized disks into the pool of spares, enter `sysconfig -r.`

Process description

After you enter the disk sanitize start command, Data ONTAP begins the sanitization process on each of the specified disks. The process consists of a disk format operation, followed by the specified overwrite patterns repeated for the specified number of cycles.

Note
The formatting phase of the disk sanitization process is skipped on ATA disks.

The time to complete the sanitization process for each disk depends on the size of the disk, the number of patterns specified, and the number of cycles specified.

For example, the following command invokes one format overwrite pass and 18 pattern overwrite passes of disk 7.3.

disk sanitize start -p 0x55 -p 0xAA -p 0x37 -c 6 7.3

If disk 7.3 is 36 GB and each formatting or pattern overwrite pass on it takes 15 minutes, then the total sanitization time is 19 passes times 15 minutes, or 285 minutes (4.75 hours).
If disk 7.3 is 73 GB and each formatting or pattern overwrite pass on it takes 30 minutes, then total sanitization time is 19 passes times 30 minutes, or 570 minutes (9.5 hours).

If disk sanitization is interrupted

If the sanitization process is interrupted by power failure, system panic, or a user-invoked disk sanitize abort command, the disk sanitize command must be re-invoked and the process repeated from the beginning in order for the sanitization to take place.

If formatting is interrupted

If the formatting phase of disk sanitization is interrupted, Data ONTAP attempts to reformat any disks that were corrupted by an interruption of the formatting. After a system reboot and once every hour, Data ONTAP checks for any sanitization target disk that did not complete the formatting phase of its sanitization. If such a disk is found, Data ONTAP attempts to reformat that disk, and writes a message to the console informing you that a corrupted disk has been found and will be reformatted. After the disk is reformatted, it is returned to the hot spare pool. You can then rerun the disk sanitize command on that disk.

Stopping disk sanitization

You can use the disk sanitize abort command to stop an ongoing sanitization process on one or more specified disks. If you use the disk sanitize abort command, the specified disk or disks are returned to spare state and the sanitized label is removed. To stop a disk sanitization process, complete the following step.

Step	Action
1	Enter the following command: `disk sanitize abort` disklist Result Data ONTAP displays the message "Sanitization abort initiated." If the specified disks are undergoing the disk formatting phase of sanitization, the abort will not occur until the disk formatting is complete. Once the process is stopped, Data ONTAP displays the message "Sanitization aborted for diskname."

Step

Action

Enter the following command:

disk sanitize abort disklist

Result

Data ONTAP displays the message "Sanitization abort initiated."

If the specified disks are undergoing the disk formatting phase of sanitization, the abort will not occur until the disk formatting is complete.

Once the process is stopped, Data ONTAP displays the message "Sanitization aborted for diskname."

Selectively sanitizing data

Selective data sanitization consists of physically obliterating data in specified blocks while preserving all other data located on the affected aggregate for continued user access.

Summary of the selective sanitization process

Because data for any one file in a storage system is physically stored on any number of data disks in the aggregate containing that data, and because the physical location of data within an aggregate can change, sanitization of selected data, such as files or directories, requires that you sanitize every disk in the aggregate where the data is located (after first migrating the aggregate data that you do not want to sanitize to disks on another aggregate). To selectively sanitize data contained in an aggregate, you must carry out three general tasks.

Delete the selected files or directories (and any aggregate snapshots that contain those files or directories) from the aggregate that contains them.
Migrate the remaining data (the data that you want to preserve) in the affected aggregate to a new set of disks in a destination aggregate on the same storage system using the ndmpcopy command.
Destroy the original aggregate and sanitize all the disks that were RAID group members in that aggregate.

Requirements for selective sanitization

Successful completion of this process requires the following conditions:

You must install a disk sanitization license on your storage system.
You must have enough storage space on your storage system to create an additional destination aggregate to which you can migrate the data that you want to preserve from the original aggregate. This destination aggregate must have a storage capacity at least as large as that of the original aggregate.
You must use the ndmpcopy command to migrate data in the affected aggregate to a new set of disks in a destination aggregate on the same storage system. For information about the ndmpcopy command, see the Data Protection Online Backup and Recovery Guide.

Aggregate size and selective sanitization

Because sanitization of any unit of data in an aggregate still requires you to carry out data migration and disk sanitization processes on that entire aggregate, you should use small aggregates to store data that requires sanitization. Use of small aggregates for storage of data requiring sanitization minimizes the time, disk space, and bandwidth that sanitization will requires.

Backup and data sanitization

Absolute sanitization of data means physical sanitization of all instances of aggregates containing sensitive data; it is therefore advisable to maintain your sensitive data in aggregates that are not regularly backed up to aggregates that also back up large amounts of nonsensitive data.

Procedure for selective sanitization

To carry out selective sanitization of data within an aggregate or a traditional volume, complete the following steps.


rm -rf /nixdir/nixfile.doc
snap delete -a aggr_name -A
aggr status aggr_name -b
aggr create dest_aggr ndisks
ndmpcopy src_aggr dest_aggr 
aggr status src_aggr -r
aggr offline src_aggr
aggr destroy src_aggr
aggr rename dest_aggr src_aggr
exportfs -a


Step	Action
1	From a Windows or UNIX client, delete the directories or files whose data you want to selectively sanitize from the active file system. Use the appropriate Windows or UNIX command, such as rm -rf /nixdir/nixfile.doc
2	From the NetApp storage system, enter the following commands to delete all snapshots of the aggregates and volumes (both traditional and FlexVol volumes) that contain the files or directories that you just deleted. To delete all snapshots associated with the aggregate, enter the following command: snap delete -a aggr_name -A aggr_name is the aggregate that contains the files or directories that you just deleted. For example: `snap delete -a nixsrcaggr -A` To delete all snapshots associated with the volume, enter the following command: snap delete -a vol_name -V vol_name is the traditional volume or FlexVol that contains the files or directories that you just deleted. For example: `snap delete -a nixsrcvol -V` To delete a specific snapshot for either an aggregate or a volume, enter one of the following commands: *snap delete aggr_name* snapshot_name `-A` snap delete vol_name snapshot_name `-V`** Examples: `snap delete nixsrcaggr nightly0 A` `snap delete nixsrcvol nightly0 -V`
3	Enter the following command to determine the size of the aggregate from which you deleted data: *aggr status aggr_name* -b For backward compatibility, you can also use the following command for traditional volumes. vol status vol_name -b Example aggr status nixsrcaggr -b** Calculate the aggregate size in bytes by multiplying the bytes per block (block size) by the blocks per aggregate (aggregate size).
4	Enter the following command to create an aggregate to which you will migrate undeleted data. This aggregate must be of equal or greater storage capacity than the aggregate from which you just deleted file, directory, or snapshot data: *aggr create dest_aggr* ndisks** For backward compatibility with traditional volumes, you can also enter: vol create dest_vol disklist Example aggr create nixdestaggr 8@72G Note The purpose of this new aggregate is to provide a migration destination that is absolutely free of the data that you want to sanitize.
5	Enter the following command to copy the data you want to preserve to the destination aggregate from the source aggregate you want to sanitize: ndmpcopy src_aggr dest_aggr src_aggr is the source aggregate. dest_aggr is the destination aggregate. Attention Be sure that you have deleted the files or directories that you want to sanitize (and any affected snapshots) from the source aggregate before you run the `ndmpcopy` command. Example ndmpcopy nixsrcvol nixdestvol
6	Record the disks currently in the source aggregate. (After that aggregate is destroyed, you will sanitize these disks.) To list the disks in the source aggregate, enter the following command: *aggr status src_aggr* -r Example aggr status nixsrcaggr -r** The disks that you are going to sanitize are listed in the Device column of the `aggr status` `-r` output.
7	In maintenance mode, enter the following command to take the source aggregate offline: aggr offline src_aggr Example aggr offline nixsrcaggr
8	Enter the following command to destroy the source aggregate: aggr destroy src_aggr Example aggr destroy nixsrcaggr
9	Enter the following command to rename the destination aggregate, giving it the name of the source aggregate that you just destroyed: aggr rename dest_aggr src_aggr Example aggr rename nixdestaggr nixsrcaggr
10	Reestablish your CIFS or NFS services: If the original volume supported CIFS services, restart the CIFS services on the volumes in the destination aggregate after migration is complete. If the original volume supported NFS services, enter the following command: `exportfs -a` Result Users who were accessing files in the original volume will continue to access those files in the renamed destination volume with no remapping of their connections required.
11	Use the `disk sanitize` command to sanitize the disks that used to belong to the source aggregate. Follow the procedure described in Sanitizing spare disks.

Reading disk sanitization log files

The disk sanitization process outputs two types of log files.

One file, /etc/sanitized_disks, lists all the drives that have been sanitized.
For each disk being sanitized, a file is created where the progress information will be written.

Listing the sanitized disks

The /etc/sanitized_disks file contains the serial numbers of all drives that have been successfully sanitized. For every invocation of the disk sanitize start command, the serial numbers of the newly sanitized disks are appended to the file.

The /etc/sanitized_disks file shows output similar to the following:

admin1> rdfile /etc/sanitized_disks

Tue Jun 24 02:54:11 Disk 8a.44 [S/N 3FP0RFAZ00002218446B] 
sanitized.

Tue Jun 24 02:54:15 Disk 8a.43 [S/N 3FP20XX400007313LSA8] 
sanitized.

Tue Jun 24 02:54:20 Disk 8a.45 [S/N 3FP0RJMR0000221844GP] 
sanitized.

Tue Jun 24 03:22:41 Disk 8a.32 [S/N 43208987] sanitized.

Reviewing the disk sanitization progress

A progress file is created for each drive sanitized and the results are consolidated to the /etc/sanitization.log file every 15 minutes during the sanitization operation. Entries in the log resemble the following:

Tue Jun 24 02:40:10 Disk sanitization initiated on drive 8a.43 [S/N 
3FP20XX400007313LSA8]

Tue Jun 24 02:40:10 Disk sanitization initiated on drive 8a.44 [S/N 
3FP0RFAZ00002218446B]

Tue Jun 24 02:40:10 Disk sanitization initiated on drive 8a.45 [S/N 
3FP0RJMR0000221844GP]

Tue Jun 24 02:53:55 Disk 8a.44 [S/N 3FP0RFAZ00002218446B] format 
completed in 00:13:45.

Tue Jun 24 02:53:59 Disk 8a.43 [S/N 3FP20XX400007313LSA8] format 
completed in 00:13:49.

Tue Jun 24 02:54:04 Disk 8a.45 [S/N 3FP0RJMR0000221844GP] format 
completed in 00:13:54.

Tue Jun 24 02:54:11 Disk 8a.44 [S/N 3FP0RFAZ00002218446B] cycle 1 
pattern write of 0x47 completed in 00:00:16.

Tue Jun 24 02:54:11 Disk sanitization on drive 8a.44 [S/N 
3FP0RFAZ00002218446B] completed.

Tue Jun 24 02:54:15 Disk 8a.43 [S/N 3FP20XX400007313LSA8] cycle 1 
pattern write of 0x47 completed in 00:00:16.

Tue Jun 24 02:54:15 Disk sanitization on drive 8a.43 [S/N 
3FP20XX400007313LSA8] completed.

Tue Jun 24 02:54:20 Disk 8a.45 [S/N 3FP0RJMR0000221844GP] cycle 1 
pattern write of 0x47 completed in 00:00:16.

Tue Jun 24 02:54:20 Disk sanitization on drive 8a.45 [S/N 
3FP0RJMR0000221844GP] completed.

Tue Jun 24 02:58:42 Disk sanitization initiated on drive 8a.43 [S/N 
3FP20XX400007313LSA8]

Tue Jun 24 03:00:09 Disk sanitization initiated on drive 8a.32 [S/N 
43208987]

Tue Jun 24 03:11:25 Disk 8a.32 [S/N 43208987] cycle 1 pattern write 
of 0x47 completed in 00:11:16.

Tue Jun 24 03:12:32 Disk 8a.43 [S/N 3FP20XX400007313LSA8] 
sanitization aborted by user.

Tue Jun 24 03:22:41 Disk 8a.32 [S/N 43208987] cycle 2 pattern write 
of 0x47 completed in 00:11:16.

Tue Jun 24 03:22:41 Disk sanitization on drive 8a.32 [S/N 43208987] 
completed.

Sanitizing disks

About disk sanitization

What this section covers

Disk sanitization limitations

Licensing disk sanitization

Sanitizing spare disks

Example

Result

Verification

Process description

If disk sanitization is interrupted

If formatting is interrupted

Stopping disk sanitization

Result

Selectively sanitizing data

Summary of the selective sanitization process

Requirements for selective sanitization

Aggregate size and selective sanitization

Backup and data sanitization

Procedure for selective sanitization

Example

Example

Example

Example

Example

Example

Example

Result

Reading disk sanitization log files

Listing the sanitized disks

Reviewing the disk sanitization progress