Wipe, destroy and dispose of devices properly

A laptop that held three years of payroll files goes to a buyer next week, and the plan is a quick format. Microsoft documents what that does: it deletes the file table and the root directory, and the option that zeroes every sector is ignored in a quick format. The contents of the files stay on the drive, and recovery tools exist to find exactly that.

Disposal is the last moment a support desk controls a device’s data. This lesson works through the decision: why delete and format are not erasure, NIST’s three methods of clear, purge and destroy, why encryption from the first day reduces erasure to destroying one key, the erase tools built into Macs, Windows PCs and phones, when only destruction will do, and the record and the registered recycler that close a device’s life in India.

A delete or a quick format removes the index, not the data

Deleting a file removes its entry from the file system’s index; the blocks that held its contents are only marked as available for reuse. That is why restore and data recovery can still bring a deleted file back from an image of a healthy drive. A quick formatquick format: A format that deletes a volume's file table and root directory and builds an empty one, without overwriting the files' contents, which recovery tools can still find. goes one step further and builds a new, empty index, but it leaves the contents alone as well. Microsoft’s format reference says that /Q deletes the file table and the root directory, while /P zeroes every sector and is ignored when /Q is given.

Data sanitisationdata sanitisation: Making the data on a storage device unrecoverable for a given level of effort. NIST SP 800-88 names three methods for it: clear, purge and destroy. means making the data itself unrecoverable, and a full overwrite looks like the answer. On a hard drive it is: every block is written in place. A solid-state drivesolid-state drive (SSD): A storage device with no moving parts, using flash memory for faster reads and writes than an HDD. More in “Storage drives, drive health and RAID” works differently. Its controller writes new data to fresh flash blocks and keeps spare blocks the computer cannot address, so an overwrite through the normal interface may never reach an old copy. NIST warns that repeated overwrite passes give very little protection on SSDs with spare capacity.

The program below models three drives in memory: a hard drive, an SSD with 4 spare blocks for every 12 it shows, and the same SSD encrypted. Each saves three files, deletes one, quick-formats and then either zeroes every block or erases the encryption key. Read the scan column: it counts the files a lab could still read straight from the chips.

"""
What a delete, a quick format, an overwrite and a key erase leave behind.

Three small model drives live in memory, so nothing on this computer is
touched. The hard-drive model writes every block in place. The SSD models
have spare blocks, as flash drives do: a write goes to a fresh physical
block, and the old block keeps its data until the controller reuses it.
The encrypted SSD stores only ciphertext, made with a key the drive keeps.
After each step a raw scan reads every physical block, as a recovery lab
would, decrypting with the drive's key while that key still exists, and
lists the files whose content it can still read.
"""

import hashlib

BLOCK = 16
FILES = {  # name -> (content, the logical blocks it occupies)
    "offer.pdf": (b"OFFER LETTER: CTC 18 LPA, JOIN 1 DEC", [0, 1, 2]),
    "photo.jpg": (b"JPEG DATA: TEAM OFFSITE, GOA", [3, 4]),
    "payroll.csv": (b"PAYROLL: EMP 1042, ACCT 50100012345678", [8, 9, 10]),
}


def chunks(data, count):
    data = data.ljust(count * BLOCK, b".")
    return [data[i * BLOCK:(i + 1) * BLOCK] for i in range(count)]


def xor_block(data, key, physical_no):
    stream = hashlib.sha256(key + physical_no.to_bytes(4, "big")).digest()[:BLOCK]
    return bytes(a ^ b for a, b in zip(data, stream))


class Drive:
    """A drive of `logical` blocks the user can address, plus `spare` hidden ones."""

    def __init__(self, logical, spare=0, key=None):
        self.chips = [bytes(BLOCK)] * (logical + spare)  # physical blocks
        self.where = list(range(logical))  # logical block -> physical block
        self.free = list(range(logical, logical + spare))  # spare blocks, in order of use
        self.key = key
        self.table = {}

    def write(self, logical_no, data):
        if self.free:  # flash: write to a fresh block, keep the old one for later reuse
            old = self.where[logical_no]
            self.where[logical_no] = self.free.pop(0)
            self.free.append(old)
        physical_no = self.where[logical_no]
        if self.key is not None:  # the chips hold ciphertext only
            data = xor_block(data, self.key, physical_no)
        self.chips[physical_no] = data

    def save(self, name, content, blocks):
        for logical_no, part in zip(blocks, chunks(content, len(blocks))):
            self.write(logical_no, part)
        self.table[name] = blocks

    def raw_scan(self):
        """The files whose first block a lab can still read from the chips."""
        if self.key is None:
            raw = b"".join(self.chips)
        else:
            raw = b"".join(xor_block(c, self.key, i) for i, c in enumerate(self.chips))
        return sorted(name for name, (content, _) in FILES.items() if content[:BLOCK] in raw)


def report(step, drive):
    found = drive.raw_scan()
    print(f"  {step:<20} table {len(drive.table)}, scan {len(found)}: {' '.join(found) or '-'}")


def run(title, drive):
    print(title)
    for name, (content, blocks) in FILES.items():
        drive.save(name, content, blocks)
    report("3 files saved", drive)
    del drive.table["payroll.csv"]
    report("payroll.csv deleted", drive)
    drive.table.clear()
    report("quick format", drive)
    if drive.key is None:
        for logical_no in range(len(drive.where)):
            drive.write(logical_no, bytes(BLOCK))
        report("every block zeroed", drive)
    else:
        drive.key = None  # cryptographic erase: only the key is destroyed
        report("key erased", drive)
    print()


run("Hard drive model, 12 blocks written in place:", Drive(12))
run("SSD model, 12 blocks plus 4 spare:", Drive(12, spare=4))
run("Encrypted SSD model, 12 blocks plus 4 spare:", Drive(12, spare=4, key=b"model key"))

Hard drive model, 12 blocks written in place:
  3 files saved        table 3, scan 3: offer.pdf payroll.csv photo.jpg
  payroll.csv deleted  table 2, scan 3: offer.pdf payroll.csv photo.jpg
  quick format         table 0, scan 3: offer.pdf payroll.csv photo.jpg
  every block zeroed   table 0, scan 0: -

SSD model, 12 blocks plus 4 spare:
  3 files saved        table 3, scan 3: offer.pdf payroll.csv photo.jpg
  payroll.csv deleted  table 2, scan 3: offer.pdf payroll.csv photo.jpg
  quick format         table 0, scan 3: offer.pdf payroll.csv photo.jpg
  every block zeroed   table 0, scan 1: payroll.csv

Encrypted SSD model, 12 blocks plus 4 spare:
  3 files saved        table 3, scan 3: offer.pdf payroll.csv photo.jpg
  payroll.csv deleted  table 2, scan 3: offer.pdf payroll.csv photo.jpg
  quick format         table 0, scan 3: offer.pdf payroll.csv photo.jpg
  key erased           table 0, scan 0: -

After the delete and the quick format, all three files are still readable on every model, although the file table lists none. Zeroing every block clears the hard drive, but on the plain SSD payroll.csv survives in spare blocks the overwrite never reached. On the encrypted SSD, erasing the key alone leaves nothing readable, without rewriting a block.

Clear, purge and destroy are NIST’s three levels

NIST SP 800-88 Rev. 2, Guidelines for Media Sanitization, defines sanitisation as making access to the data infeasible for a given level of effort, and it names three methods that differ in the effort they defeat:

• Clearclear (sanitisation): The NIST sanitisation method that overwrites or resets every location a user can address, through the device's normal interface. It stops simple recovery tools, and the device keeps working. uses the device’s own interface on every location a user can address, for example an overwrite or a reset to factory state. It protects against simple recovery tools through that same interface, and the device works as before.
• Purgepurge (sanitisation): The NIST sanitisation method that makes recovery infeasible even with laboratory techniques while the device stays reusable, using a technique suited to the media, such as cryptographic erase. uses a technique chosen for the media, physical or logical, so that recovery is infeasible even with a laboratory’s best techniques, and the device can still be reused. NIST says to use purge instead of clear whenever possible, and points to the IEEE 2883 standard for the techniques that suit each kind of media.
• Destroydestroy (sanitisation): The NIST sanitisation method that makes recovery infeasible even in a laboratory and leaves the media unable to store data, for example by disintegrating or incinerating it. makes recovery infeasible in a laboratory too, and leaves the media unable to store data again.

Which method fits depends on three facts about the device: whether it still works, how sensitive its data is and where it goes next. Answer the three questions in the table below and watch which methods it rules out:

The policy in the table is a common one, and this lesson uses it throughout: a failed drive is destroyed, high-sensitivity media is destroyed, a device that leaves the organisation is purged, and a device that stays with another employee is at least cleared. Your organisation’s written policy may set the lines elsewhere, and it is the one to follow.

Cryptographic erase destroys the key, not every block

If every block on a drive was encrypted from the first day, there is a faster purge than rewriting the blocks: destroy the key. NIST calls this cryptographic erasecryptographic erase: A purge technique for encrypted media: the keys that encrypt the data are destroyed, so every block, spare ones included, holds ciphertext that can no longer be read. No copy of the key may survive elsewhere. and classes it as a purge technique. Without the key, every block, the spare ones included, holds ciphertext that nobody can turn back into data, which is what the encrypted SSD in the first example showed.

The platforms build on this. A Mac with Apple silicon or the T2 chip encrypts its internal volume even when FileVaultFileVault: Apple's full-disk encryption for the Mac startup disk. The login password opens the disk at start-up, and a recovery key or an institutional key can open it if that password is lost. More in “BitLocker and FileVault recovery keys” was never turned on; Apple’s platform security guide says that erasing the media key that wraps the volume keys leaves the volume cryptographically inaccessible, and Apple designed that key to be erased on demand, by Erase All Content and Settings or by a remote wipe from a device management service. Apple’s Disk Utility guide adds that secure erase options are not available for an SSD and suggests turning on FileVault when you start using one. Android has supported file-based encryption since Android 7.0, and Windows PCs use BitLocker or device encryption, as BitLocker and FileVault keys explains.

The table compares the two purge approaches on an SSD:

NIST names two limits. Cryptographic erase is only as good as the key’s disappearance: it should not be trusted when copies of the key were backed up or placed in key escrowkey escrow: Storing a copy of an encryption recovery key with a third party that can return it, such as a directory or a management service, so a lost device or forgotten password is not a lost disk. More in “BitLocker and FileVault recovery keys”, unless the organisation knows exactly where those copies are and sanitises them under their own policy. And for data that must stay secret for decades, ciphertext left on the media may one day be broken, so cryptographic erase may not be enough.

Built-in erase tools, after the accounts come off

Every platform ships an erase tool, and every one of them has a step that must come first: removing the owner’s accounts. An Apple or Google account left on a device links it to that owner, and an erased phone can then refuse to work for anyone else. The table lists what each platform needs:

A Mac with Apple silicon or a T2 chip that runs macOS Monterey 12 or later has Erase All Content and Settings. It asks for the Apple Account password, signs the Mac out of Apple services, and restarts into a setup assistant as if the Mac were new. On an older Mac, sign out of iCloud first, then erase it in Disk Utility from macOS Recovery, as install and erase macOS shows. On a Windows PC, Reset this PCReset this PC: The Windows recovery option that reinstalls Windows on the same PC. It always removes apps and settings, and you choose to keep personal files or remove everything, from Settings or from WinRE. More in “Reset, reimage or repair: choose and do it” with Remove everything reinstalls Windows; for a PC you donate, recycle or sell, Microsoft says to turn on Clean data, which takes longer but makes removed files harder to recover.

On an iPhone, sign out of iCloud and the stores, unpair an Apple Watch, then choose Settings, General, Transfer or Reset iPhone, Erase All Content and Settings. On Android, removing the Google Account turns off factory reset protectionfactory reset protection: Android's device protection: after a factory reset the phone asks for the screen lock or the Google Account that was on it, and cannot be used if that is not given. More in “Reset, reimage or repair: choose and do it”; Google adds that after a recent password change you should wait 24 hours before a factory reset. A company device enrolled in mobile device managementmobile device management: Software that enrols phones, tablets and computers, sends them settings and apps, checks them against a security policy and can lock or wipe them remotely. Microsoft Intune is one example. More in “MDM, BYOD and lost or stolen devices” is wiped and then removed from it, as MDM, BYOD and lost devices covers.

A drive that cannot be sanitised is destroyed

A failed drive cannot be cleared or purged, because both need a drive that answers its commands, and NIST notes that destruction may be the only option when media has failed or its interface is no longer supported. Destruction is also the method when policy says the data is too sensitive for anything else, as in this lesson’s policy for high-sensitivity media.

NIST lists five destruction techniques, with a warning about data density:

Two warnings come with the list. Bending, cutting or drilling a hole through a drive may damage only part of it and leave the rest readable in a laboratory. And as data density rises, NIST advises against pulverising and shredding for anything but the lowest security categories of data, because a small fragment of a dense chip can still hold a lot.

In practice a support desk rarely destroys media itself. A destruction vendor collects the drives, destroys them, ideally with a witness from the organisation present, and issues a certificate of sanitisationcertificate of sanitisation: A signed record of how a device was sanitised: its make, model, serial number and media type, the method, technique and tool, how the result was verified and where the device went. that lists the serial number of every drive. A failed drive that policy says to destroy does not go back to the maker for a warranty swap with its data on it.

The record and the registered recycler close the asset

A disposal is finished only when it is written down. NIST’s sample certificate of sanitisation asks for the device’s make, model, serial number and media type, the method and technique used, the tool and its version, how the result was verified, where the device went (internal reuse, external reuse, a recycling facility or the manufacturer) and a signature. The device’s entry in the asset registerasset register: An organisation's list of its devices, each with an asset tag, serial number, user and status. A device's entry is closed with its disposal record when it leaves. is closed with the same details.

The program below checks two sample records against those fields before they are filed. Read why the second is refused:

"""
Check disposal records before a device leaves the building.

The fields follow the sample certificate of sanitization in NIST SP 800-88
Rev. 2 (media information, sanitization details, destination), plus the
asset tag that closes the entry in the asset register. Both records are
made-up samples: the serial numbers and the recycler are not real.
"""

REQUIRED = ["asset_tag", "serial", "media", "method", "technique", "tool", "verified", "destination", "operator"]
METHODS = {"clear", "purge", "destroy"}
DESTINATIONS = {"internal reuse", "external reuse", "registered recycler", "manufacturer"}


def problems(record):
    """Return what stops the record from being filed, as a list of short reasons."""
    found = [f"missing {field}" for field in REQUIRED if not record.get(field)]
    if record.get("method") and record["method"] not in METHODS:
        found.append(f"method must be clear, purge or destroy, not {record['method']!r}")
    if record.get("destination") and record["destination"] not in DESTINATIONS:
        found.append(f"unknown destination {record['destination']!r}")
    if record.get("verified") == "no":
        found.append("sanitisation not verified")
    if record.get("method") == "destroy" and not record.get("certificate"):
        found.append("destroyed by a vendor without a certificate number")
    if record.get("destination") == "external reuse" and record.get("method") == "clear":
        found.append("clear is not enough for a device leaving the organisation")
    return found


RECORDS = [
    {
        "asset_tag": "LAP-0311",
        "serial": "SAMPLE-7Q2K-0311",
        "media": "NVMe SSD, 512 GB, encrypted from the first day",
        "method": "purge",
        "technique": "cryptographic erase",
        "tool": "Erase All Content and Settings",
        "verified": "yes, Setup Assistant shown",
        "destination": "external reuse",
        "operator": "service desk, technician 2",
    },
    {
        "asset_tag": "SRV-0042",
        "serial": "",
        "media": "SATA HDD, 2 TB, failed",
        "method": "destroy",
        "technique": "disintegrate",
        "tool": "vendor disintegrator",
        "verified": "yes",
        "destination": "registered recycler",
        "operator": "service desk, technician 1",
    },
]

for record in RECORDS:
    issues = problems(record)
    print(f"Record {record['asset_tag']}: {'ready to file' if not issues else 'refused'}")
    if issues:
        for issue in issues:
            print(f"  - {issue}")
    else:
        for field in REQUIRED:
            print(f"  {field:<12} {record[field]}")
    print()

Record LAP-0311: ready to file
  asset_tag    LAP-0311
  serial       SAMPLE-7Q2K-0311
  media        NVMe SSD, 512 GB, encrypted from the first day
  method       purge
  technique    cryptographic erase
  tool         Erase All Content and Settings
  verified     yes, Setup Assistant shown
  destination  external reuse
  operator     service desk, technician 2

Record SRV-0042: refused
  - missing serial
  - destroyed by a vendor without a certificate number

A record with no serial number cannot prove which drive was destroyed, and a destruction without the vendor’s certificate number has nothing to point at if an auditor asks.

In India, the hand-over is set by law. Old laptops and phones are e-wastee-waste: Discarded electrical and electronic equipment, such as old laptops, phones and tablets. In India, the E-Waste (Management) Rules, 2022 set who may take it and recycle it. under the E-Waste (Management) Rules, 2022. An organisation that used at least 1,000 units of the listed equipment in a financial year is a bulk consumerbulk consumer: Under India's E-Waste (Management) Rules, 2022, an entity that used at least 1,000 units of the listed electrical and electronic equipment in a financial year. It hands its e-waste only to a registered producer, refurbisher or recycler., and must hand its e-waste only to a registered producer, refurbisher or registered recyclerregistered recycler: A recycler registered on the Central Pollution Control Board's portal under India's E-Waste (Management) Rules, 2022, and one of the parties to which a bulk consumer may hand its e-waste.; the Central Pollution Control Board publishes the list of recyclers and dismantlers. Under the Battery Waste Management Rules, 2022, a consumer keeps waste batteries apart from other waste and gives them to an entity that collects, refurbishes or recycles them.

Step through the whole chain below, from the register entry to the recycler:

Practise

Turn this lesson’s policy into code: the function returns the method for a device from whether it works, its data and where it goes next.

def sanitisation_method(device):
    """Return "clear", "purge" or "destroy" for a device at the end of its life."""
    return "clear"

from sanitisation_method import sanitisation_method


def device(works=True, data="moderate", goes="reuse inside"):
    return {"works": works, "data": data, "next": goes}


def test_reuse_inside_is_cleared():
    """clears a working device that stays inside the organisation"""
    assert sanitisation_method(device(data="low")) == "clear"
    assert sanitisation_method(device(data="moderate")) == "clear"


def test_leaving_is_purged():
    """purges a working device that leaves the organisation"""
    assert sanitisation_method(device(goes="leaves")) == "purge"
    assert sanitisation_method(device(data="low", goes="leaves")) == "purge"


def test_failed_drive_is_destroyed():
    """destroys a drive that no longer works, wherever it goes"""
    assert sanitisation_method(device(works=False)) == "destroy"
    assert sanitisation_method(device(works=False, data="low", goes="leaves")) == "destroy"


def test_high_sensitivity_is_destroyed():
    """destroys high-sensitivity media even when it still works"""
    assert sanitisation_method(device(data="high")) == "destroy"
    assert sanitisation_method(device(data="high", goes="leaves")) == "destroy"

Interview questions

Warm-up (fresher to 2–5 years): a colleague plans to quick-format a laptop’s SSD before it goes to a buyer. What do you tell them, and what do you do instead?

A quick format only builds a new, empty file table; the files’ contents stay on the drive, where recovery tools find them. Even a full overwrite is not enough on an SSD, because its spare blocks are out of reach of the operating system. The laptop leaves the organisation, so it needs a purge, and the quickest purge is a cryptographic erase. On a recent Mac, Erase All Content and Settings does exactly that: it erases the key the always-encrypted volume depends on. On a Windows PC, Reset this PC with Remove everything and Clean data is Microsoft’s choice for a PC that is sold, and I check our policy on whether that is enough for an SSD that was never encrypted. Before any erase, I back up and remove the user’s accounts; afterwards I check the setup screen and record the serial number, the method and the check.

Two harder disposals follow: a Mac whose storage has to travel with its board to a warranty repair, and an office refresh whose receipt comes back three devices short. Decide what you would check first in each case, then open it:

Key takeaways

• A delete or a quick format removes only the index, so the contents stay recoverable, and an overwrite cannot reach the spare blocks of a flash drive.
• NIST SP 800-88 names three methods: clear defeats simple recovery, purge defeats a laboratory and keeps the device usable, and destroy defeats a laboratory and ends the device.
• Cryptographic erase is a purge that destroys the key instead of every block, provided no other copy of the key survives in a backup or an escrow.
• Every built-in erase, on a Mac, a Windows PC, an iPhone or an Android phone, comes after backing up and removing the owner’s accounts, and ends with a check of the setup screen.
• A failed drive, or one that policy rates too sensitive, is destroyed by a vendor that issues a certificate listing serial numbers.
• A disposal is complete when the record is filed and, in India, the device and its battery have gone to a registered recycler or the producer’s take-back.