Every laptop, server and phone you retire still carries a piece of your company’s history. The way you erase that data decides whether end of life is a clean goodbye or the first line of a breach report.
Why deleting is never enough
Formatting a drive or emptying the recycle bin only removes the pointers to your files. The data itself stays in place until something overwrites it, and freely available recovery tools can often bring it back within minutes. For IT managers who retire hundreds of assets a year, decommissioning is one of the quietest risks in the entire hardware lifecycle, and one of the easiest to overlook.
Three methods compared
There is no single best method. The right choice depends on the type of storage, how sensitive the data is and what should happen to the device afterwards.
Software wiping
Wiping overwrites every addressable sector or, on modern SSDs, triggers built-in sanitize commands such as cryptographic erase. The big advantage is that the hardware stays usable.
- Best for: laptops, desktops and servers heading for resale or redeployment
- Watch out for: drives with bad sectors or failing electronics, which cannot always be fully verified
- Keep in mind: classic multi-pass overwriting does not reach every memory cell on an SSD, so use tools built for flash storage
Degaussing
A degausser exposes magnetic media to a powerful magnetic field that scrambles the stored data beyond recovery.
- Best for: hard drives and backup tapes that are faulty or at end of life
- Watch out for: it has no effect on SSDs, USB sticks or smartphones
- Keep in mind: the drive is permanently disabled, so reuse is off the table
Physical shredding
Shredding reduces drives to small fragments. Particle size matters here: a fragment that is harmless for a hard drive platter can still hold an intact memory chip from an SSD, so flash media needs a much finer shred.
- Best for: highly sensitive data, damaged media and devices that failed a wipe
- Watch out for: the highest material loss of the three methods
- Keep in mind: ask which particle size is used per media type
Standards that give you something to point at
Choosing a method is only half the job. You also need to show that it was done properly.
The frameworks that matter
- NIST SP 800-88: the widely used guideline that defines three sanitization levels (clear, purge and destroy) and links them to media types
- IEEE 2883: a newer standard written with modern storage such as NVMe and self-encrypting drives in mind
- ISO/IEC 27001: shows that a provider runs a managed information security system, including how assets are handled
- ADISA: independent certification for IT asset disposal providers, including unannounced audits of their processes
The certificate of destruction
This document is your evidence when an auditor or regulator asks what happened to a specific device.
What it should include
- The serial number of every individual drive or device
- The method and standard applied
- Date, location and the technician responsible
- The verification result, so failed wipes are visible and followed up
Building a policy that holds up in an audit
A solid policy starts with classifying your data, then matching each media type to a method. Add a documented chain of custody from the moment equipment leaves the building, and verification after every wipe or shred. Certified data destruction ties these steps together into one process with evidence per asset, which is exactly what auditors, data protection officers and boards ask for when something goes wrong.
Questions to ask your provider
- Can we see the chain of custody for every collection?
- Which standard do you follow per media type?
- What happens to a drive that fails verification?
- Can devices be wiped on site if data may not leave our premises?
The takeaway
Wiping keeps value in your hardware, degaussing and shredding offer certainty when reuse is not an option, and standards turn good intentions into proof. Pick the method per asset, not per project, and your retired equipment stops being a liability.
