Data Sanitisation: Securely Erasing and Disposing of Drives
Retiring a server is straightforward until someone asks what happened to the drives. Storage that has held business data cannot simply be thrown away or resold, and the obligations are legal as well as sensible.
This guide covers what sanitisation actually means, which method suits which situation, and what to ask a supplier.
Deleting is not erasing
The foundation, and the thing most often misunderstood.
Deleting a file removes its entry from the filesystem index. The data itself stays on the media until something overwrites it. Recovery tools read it back trivially, which is why deleted files are routinely recovered in forensic work.
Formatting a drive is usually little better. A quick format rebuilds the filesystem structures and leaves the underlying data intact.
So a drive that has been deleted from, formatted, or had its operating system reinstalled should be treated as still containing everything it ever held.
The three approaches
Guidance in this area generally recognises three levels, and choosing between them is a matter of what the media will be used for afterwards.
Clear. Overwriting with standard read and write commands so the data cannot be recovered by ordinary means. Suitable where the media stays within the organisation — redeployed to another department, reused in a different system.
Purge. Using the drive’s own built-in sanitisation commands, or cryptographic erase on self-encrypting drives, so recovery is infeasible even with laboratory techniques. This is the appropriate level when media leaves the organisation intact — sold, returned, donated or handed to a recycler.
Destroy. Physically rendering the media unusable through shredding, disintegration or degaussing. Appropriate for the most sensitive data, and the only option when a drive has failed in a way that prevents it accepting sanitisation commands.
The decision follows the destination and the sensitivity, not the convenience.
Why SSDs need different handling
This is where a lot of procedures written for mechanical drives quietly fail.
Overwriting works on a hard drive because writing to a logical address writes to that physical location. On flash it does not. The controller places writes wherever it chooses for wear levelling, so an overwrite of a logical address may land somewhere entirely different and leave the original data intact in a block you cannot address.
Enterprise SSDs also carry over-provisioned capacity — spare flash the controller uses internally — which is not reachable through normal writes at all and may hold recoverable data.
The consequence: overwriting is not a reliable sanitisation method for SSDs. The correct approaches are the drive’s built-in sanitise command, or cryptographic erase on a self-encrypting drive, or physical destruction.
Degaussing is also worth flagging: it works by disrupting magnetic media, so it does nothing to flash. A degausser will not sanitise an SSD.
Cryptographic erase
Worth understanding because it is fast and increasingly the default.
A self-encrypting drive encrypts everything it writes, transparently, with a key held in the drive. Sanitising it means destroying that key. Without it the stored data is unrecoverable, regardless of what remains physically on the media.
The advantage is speed — seconds rather than the hours a full overwrite of a large drive takes, which matters when decommissioning at scale.
Two caveats. The drive must genuinely support it, not merely encrypt at the operating system level. And you need confidence in the implementation, which is why documented, standards-conformant drives matter for anything regulated.
Failed drives are the hard case
The situation people plan for least and encounter most.
A drive that will not spin up, is not detected, or has failed electronically cannot accept a sanitisation command. It still contains data, and it is still your obligation.
The options narrow to physical destruction, or handing it to a service that destroys it and issues documentation.
This matters for warranty returns in particular. Returning a failed drive to a manufacturer means it leaves your control with data on it. Many organisations negotiate keep-your-drive arrangements on support contracts for exactly this reason, accepting a higher cost to retain failed media. Check whether your support contract includes it before you need it.
Documentation
For regulated environments, doing the work is only half of it. If you cannot demonstrate it happened, an auditor will treat it as not having happened.
A sanitisation record should identify the device by serial number, state the method used and the standard followed, record who performed it and when, and confirm verification. Where a third party does the work, a certificate of destruction or sanitisation serves the same purpose.
Keep those records for as long as your retention policy requires. They are the evidence, and they cost nothing to produce at the time and are impossible to reconstruct later.
What to ask when buying refurbished storage
The reverse of the same question, and a fair one to put to any supplier.
Any data-bearing device should be sanitised before it re-enters the resale channel. A supplier who cannot answer clearly how they handle that is one to be careful with, because the risk runs both ways: they may be passing on someone else’s data, and they may not be protecting yours if you sell equipment back.
If your organisation requires documented sanitisation for compliance purposes, say so before ordering rather than after, so it can be confirmed for that specific stock. Our refurbished process page covers how we handle condition, testing and this question.
A short checklist
Before disposing of or reselling any storage: establish where the media is going, since that sets the required level; use the drive’s sanitise command or cryptographic erase rather than overwriting on flash; physically destroy anything that has failed and cannot accept commands; check whether keep-your-drive applies to warranty returns; and record what was done, to which serial number, by whom.
None of it is difficult. All of it is difficult to fix retrospectively.
Common questions
Is formatting a drive enough to erase it?
No. A quick format rebuilds the filesystem structures and leaves the underlying data intact, and deleting a file only removes its index entry. Treat any drive that has been deleted from, formatted or reinstalled as still containing everything it held.
Why does overwriting not work reliably on SSDs?
Because the controller places writes wherever it chooses for wear levelling, so overwriting a logical address may land elsewhere and leave the original data intact in a block you cannot address. Over-provisioned capacity is also unreachable through normal writes.
Does degaussing work on SSDs?
No. Degaussing disrupts magnetic media, so it does nothing to flash. For SSDs use the built-in sanitise command, cryptographic erase on a self-encrypting drive, or physical destruction.
What do I do with a failed drive that still holds data?
It cannot accept a sanitisation command, so the options are physical destruction or a service that destroys it and issues documentation. For warranty returns, check whether your support contract includes a keep-your-drive arrangement before you need it.
What is cryptographic erase?
A self-encrypting drive encrypts everything it writes with a key held in the drive. Destroying that key renders the stored data unrecoverable in seconds rather than the hours a full overwrite takes. The drive must genuinely support it rather than relying on OS-level encryption.
What should I record?
Device serial number, method used and standard followed, who performed it and when, and confirmation of verification. In a regulated environment, work you cannot demonstrate will be treated as work that did not happen.
If your organisation requires documented sanitisation, tell us before ordering and we will confirm what can be provided for that stock.
