Secure Disposal of Old Computers and Drives

Why deleting files is not enough

When you delete a file and empty the recycle bin, the operating system only removes the pointer to the data. The data itself usually stays on the disk until something else happens to overwrite it. Formatting a drive or reinstalling the operating system is barely better, as that typically marks space as available rather than scrubbing what was there. Inexpensive recovery tools can pull back photos, spreadsheets, email archives and browser profiles from a drive that has been "cleaned" this way, which is why a computer bought second-hand from an online marketplace can be a genuine privacy hazard. If the machine ever held bank statements, payslips, medical letters, passwords or client records, assume that data is still recoverable until you have deliberately destroyed it.

Wiping a drive properly

Before you touch anything, copy across the files you want to keep and check that they open correctly. Sign out of cloud accounts, deauthorise the machine from any licence agreements, and remove it from your device list so you are not locked out later.

• For a traditional spinning hard disk, overwrite the entire drive with a pass of random data using reputable wiping software that follows a recognised standard such as the NCSC's advice. A single pass is enough for modern drives; more passes mostly add time, not security.
• Better still, trigger the drive's own built-in secure erase command, which manufacturer utilities and some system firmware can start for you. It is quicker and reaches areas of the platter that your operating system cannot address.
• For an encrypted drive — one protected by full-disk encryption built into the operating system, for example — you only need to destroy the key. Erase the key and the drive header, and the rest is unreadable noise.
• Verify the result. Boot from a USB stick and confirm the drive no longer appears as a readable volume, and keep the wiping tool's log as a record.

Solid-state drives, phones and other gadgets

Solid-state drives spread data across chips and shuffle spare blocks in the background, so overwriting software cannot guarantee every cell is reached. Use the drive's own secure erase command, a factory reset, or the manufacturer's utility, and make sure the whole drive is targeted rather than a single partition. On phones and tablets, the most reliable route is a factory reset combined with removing the device from your account first; activation locks can otherwise block the reset or leave personal data behind.

Do not forget the smaller items. Memory cards, SIM cards, USB sticks, digital cameras, games consoles, smart TVs, satnav units and printers can all store logs, address books, Wi-Fi passwords and document histories you would rather not pass on. A printer's internal storage, in particular, is easy to overlook and often holds the last few jobs it printed.

When physical destruction is the right answer

Sometimes wiping is not enough, or simply is not possible. Destroy the drive outright if it held financial records, identity documents, medical information or anything you are legally obliged to protect, and it was never encrypted. Do the same if it is failing, has been dropped or exposed to water, or locks itself and refuses commands, because wiping tools cannot work reliably on a dying disk.

• Shredding reduces a drive to small particles, typically a few millimetres across; the finer the particle size, the more certain the outcome. If you are disposing of business equipment, ask for a certificate of destruction.
• Degaussing works only on magnetic media such as hard disks and tape. It does nothing useful to solid-state drives, flash cards or optical discs.
• Drilling is a reasonable do-it-yourself option for one or two drives: several holes straight through the platters or memory chips, avoiding the mounting screws and obvious circuitry. Send the remains for recycling afterwards.

Selling, donating and recycling

Electrical equipment must not go in the household rubbish bin in the UK. Retailers that sell similar goods usually offer take-back schemes, and most council recycling centres accept computers, monitors and peripherals free of charge. If you sell or donate a machine, the safest approach is to remove the drive and keep it, fitting a blank replacement if the buyer expects a working computer. Be honest about what has been removed, so nobody is disappointed and nobody inherits your data.

Keep a simple record for a couple of years: what was disposed of, when, and how. If you run a business, that record is part of your data protection obligations, and it also satisfies any auditor or insurer who asks. For an individual, it is a helpful prompt if a question ever arises later about an old machine.

A short pre-disposal checklist

• Back up everything you want to keep, and open a few files to prove the backup works.
• Sign out of accounts, deauthorise the device, and remove it from any device list.
• Wipe the drive, or remove it and destroy it if the data was sensitive.
• Reset phones, tablets, consoles and smart devices, then remove them from your account.
• Clear memory cards, SIM cards, USB sticks and printer storage.
• Recycle the hardware through a retailer scheme or your local recycling centre.
• Write down what you disposed of, when, and by what method.