Data that is actually gone
Deleting a file removes the reference, not the data. Formatting a drive does not either. What it does take depends on the kind of carrier, and on an SSD the method that worked on a hard disk is precisely the one that does not.
The methods
Four ways, and when each applies
The carrier decides the method, not the other way round.
- OverwritingFor a classic hard disk. The whole carrier is overwritten and then verified. The drive stays usable, which makes it the method where there is residual value.
- The built-in erase commandFor SSDs and modern drives: the controller itself discards the key everything is encrypted with. Overwriting works badly on an SSD, because the controller decides where blocks land.
- Making it undecryptableIf a drive was encrypted from the start, throwing away the key is sufficient. That is the cheapest method and it calls for a decision at rollout rather than at disposal.
- Physical destructionShredding or degaussing. Needed for failed carriers that no longer respond, and for classifications where nothing else is accepted. Residual value is then zero, and that is the trade-off.
What you record
Three things that belong in the certificate
Without these three, a certificate is no more than confirmation that something was collected.
- The serial number of the carrierNot of the device but of the drive. A laptop may have had its drive swapped, and then the certificate covers the wrong carrier.
- The method used and the standardWhich method, which standard, and whether the result was verified. "Wiped" without a method is not a statement an auditor can use.
- The date and who did itWhen, by which party and under whose responsibility. This is the chain you have to be able to show, and it starts at collection rather than at wiping.
What belongs with this
Wiping is one step in disposing of equipment.
A certificate that holds up
Tell us which carriers are involved and whether there is residual value in them. You get a proposal with the method per kind of carrier and the certificate that goes with it.
Practical IT knowledge in your inbox
New guides on management, security and the workplace, written by the people doing the work. No sales talk, and you can unsubscribe in one click.