Deleting isn’t destroying: what’s still on the equipment you retired

The short version

• Deleting marks space as reusable. The contents stay until overwritten.
• A quick format does roughly the same thing, faster and with more confidence.
• Recovery tools that undo both are free and take no skill to operate.
• SSDs cannot be reliably wiped the way spinning disks can, which is why physical destruction matters more on modern hardware.
• A real certificate of destruction lists serial numbers. If it does not, it proves nothing.

What deleting actually does

A drive has a table of contents and a shelf of data. Deleting a file crosses the entry out of the table of contents. The data sits on the shelf, unreferenced, available to be overwritten whenever the operating system needs that space.

Until it is overwritten, it is recoverable. Free tools scan the shelf directly and reassemble what the table of contents no longer mentions. You do not need to be technical to run one.

A quick format rebuilds the table of contents. Same shelf, same data. It feels more thorough because it takes a moment and produces a progress bar.

A full format on a modern operating system does write zeros across the drive, which is genuinely different. Most people do not do that, and most people cannot tell you which one they did.

Why solid-state drives changed this

For years the honest answer for a spinning hard disk was to overwrite the whole thing, and that was that.

SSDs work differently in a way that matters here. They spread writes across memory cells to even out wear, and they keep spare capacity the operating system cannot address directly. Which means when software tries to overwrite a specific location, the controller may write somewhere else entirely, leaving the original data in a cell nothing can reach or clear.

There are drive-level secure erase commands designed for this, implemented by the manufacturer in firmware. When they work correctly they are effective. Whether a given drive implements it correctly is not something you can verify from outside, and there is published research on drives that reported a successful secure erase while retaining data.

The practical consequence: for a drive that held anything sensitive, physical destruction removes the uncertainty. For a drive being redeployed inside your own business, a proper erase is a reasonable choice.

The standard worth naming

The reference document for this is NIST Special Publication 800-88, Guidelines for Media Sanitization. It is free to read and it is the thing a serious provider means when they say “sanitized to standard.”

It defines three levels, and the distinction is the useful part.

Clear uses ordinary read and write commands to overwrite user-addressable space. Protects against someone recovering files with software. Appropriate for a machine staying inside your organisation.

Purge uses more thorough techniques, including drive-level secure erase and degaussing where applicable, to resist laboratory recovery. Appropriate for equipment leaving your control that will be reused.

Destroy physically ruins the media so it cannot be used or read. Shredding, disintegration. Appropriate when the data was sensitive or when you want certainty rather than an argument.

The choice depends on what was on it and where it is going, not on how old the machine is.

If a vendor tells you their process is “certified” without naming a standard, ask which one. It is a fair question and the answer is short if the claim is real.

The certificate is the part that matters

You will be handed a certificate of destruction. Most of them are worthless.

A useful certificate contains, at minimum, the serial number of every device or drive, the method used against each, the date, and the name of the organisation and the person accountable.

A certificate that says “12 assets securely destroyed” on company letterhead is a piece of paper. It cannot be matched against your own asset list, which is the only thing it would be useful for.

Which points at a prerequisite: you need an asset list. If you cannot say how many machines left your building, no certificate can confirm they were all handled. This is one of the quieter arguments for keeping an asset inventory with a replacement year against each line.

The devices nobody thinks of

Laptops and desktops are obvious. These are the ones that get missed.

Multifunction printers and copiers. Most have an internal drive that has stored an image of everything scanned, copied and faxed for years. A leased copier going back to the leasing company is the single most overlooked data exposure in a small office. Ask the vendor, in writing, what happens to that drive.

Network video recorders. Weeks or months of footage, which is personal information about staff and customers.

Firewalls, routers and access points. Configuration, credentials, VPN keys, certificates. Reset to factory defaults before anything leaves.

Phones and tablets. Company-owned and personal devices with company mail on them. This overlaps with what should happen when someone leaves.

Backup media. Old external drives and tapes. By definition these hold complete copies of things, which makes them the highest-value item in the pile.

The server that got replaced and kept “just in case.” Still powered off in a corner, still holding everything.

What this means for your building

A dental or medical office in Whitby is handling health information, which raises the bar. PHIPA applies to health information custodians in Ontario and it has expectations about secure disposal. The copier is the exposure people forget, because it scanned charts for six years.

A professional services firm in Pickering has client files on every machine, and often contractual obligations about how client data is disposed of. Read the client contract before deciding your method, because some specify one.

A warehouse in Courtice usually has less sensitive data on workstations and more on the NVR, plus handheld scanners and label printers that hold configuration and sometimes order data.

Anyone with a leased copier, anywhere, should ask the leasing question today.

What to do about it

1. Walk the building and list what is waiting to be disposed of. Include cupboards, the back of the server room, and anything under a desk. Write down serial numbers as you go.
2. Decide the level per item, not for the pile. Clear for machines staying internal, purge for reuse elsewhere, destroy for anything sensitive.
3. Pull the drives from anything you are unsure about and hold them until you have decided. A machine without its drive can be recycled freely.
4. Ask your copier leasing company in writing what happens to the internal drive at end of lease, and keep the answer.
5. Factory-reset network equipment before it leaves, and check that the reset actually cleared the configuration.
6. Insist on a serialised certificate and reconcile it against your list. If they will not provide serial numbers, use someone who will.

Collection with serial-level inventory, drive wipe or destruction, and certificates is one of the things we handle, usually at the same time as a hardware refresh so the old equipment does not end up in the cupboard in the first place.