Joint analysis shows that sensitive data remains fully readable on
“re-certified” tape media
The joint analysis by Fujifilm and
“Organizations that sell their used tape media must understand the inherent risk of having sensitive data out in the public or being maliciously used by third parties,” said
About the study
Fujifilm confirmed the dangers of selling and buying used media through a study conducted with OvationData, a leading provider of data recovery, migration and data tape services with headquarters in
Fujifilm randomly acquired a total of 50 “re-certified” LTO data tapes of various brands from five “re-certified” tape resellers, and submitted them to OvationData for analysis. OvationData found that 48 out of 50 tapes still contained usable information, even though some reinitializing was performed on the beginning of the tape to make it appear that any prior data was deleted. Additional analysis on a sub-set of these tapes did in fact reveal the existence of highly confidential customer data.
“It is astonishing to find that the LTO tapes were only quickly ‘initialized,’ and not completely overwritten or properly erased. We determined that no physical form of ‘certification’ appears to have been performed on the tapes other than writing of a single end-of-data marker at the beginning of tape,” said Gregory Servos, president of OvationData. “This means that there was no writing or reading of test data to or from the tapes to check for potential errors or physical tape damage and that the existing data was not fully erased.”
To effectively and securely erase data on an LTO format tape (or other tape utilizing a magnetic servo) requires a complete overwrite of the entire length and all tracks of the tape. This process takes several hours and would not prove to be economically feasible for the “re-certifier.” Otherwise, simply initializing with a new end-of-data marker can be overcome with the appropriate data recovery techniques.
The study also highlights the fact that there are no industry standards for “re-certifying” used media despite claims by “re-certifiers,” so the quality and reliability of used media is questionable. Furthermore, the past handling and storage history of used media can never be ascertained, potentially exposing future users to risks.
In addition to the 48 used tapes containing user data, a number had significant quality issues. 16 tapes had unacceptably high read, write, and servo error rates, likely due to excessive wear and edge damage from mishandling or misaligned tape drives. Additionally, one third of the tapes had manufacturing dates prior to June of 2006 according to OvationData, raising concerns about the tape’s environmental exposure history.
Protecting your business
Re-certified data tapes pose a serious data security concern for organizations because sensitive data can be accessible after resale. Any data retention policy that causes a company to fall out of regulatory compliance can result in severe penalties that can include fines or criminal charges. Fujifilm recommends that organizations immediately review their media management policies from purchase to end-of-life and make sure to:
Data media buyers also need to be aware of resellers that are repackaging used tape and selling them as “new” in counterfeited manufacturer packaging. These counterfeit products are sold to unsuspecting customers, usually via discount websites. Fujifilm is working closely with several customers who found that they had purchased used tape sold as “new” – and taking action against resellers engaged in this business.
Fujifilm actively works with partners and resellers in the industry and provides educational materials that encourage “best practices” for handling, storing, transporting and disposing of data to protect a company’s information assets.
For more information on Fujifilm’s data storage products, please go to:
FUJIFILM Recording Media
FUJIFILM Holdings Corporation,
* At an exchange rate of
All product and company names herein may be trademarks of their