Overview
In today's digital environment, personal and sensitive information is stored across a range of devices. This information may include passwords and authentication data, addresses and phone numbers, health or financial information, photographs, videos, and other personal files. Common storage technologies now include computers and laptops with solid-state drives (SSDs) or traditional hard disk drives (HDDs), cell phones and tablets, USB flash drives, external storage devices, memory cards such as Secure Digital (SD) cards, and other removable media. In addition, personal information may be synchronized or backed up to cloud storage, online accounts, and connected services rather than being stored solely on a physical device.
Because storage technologies differ in how information is retained and erased, simply deleting a file, emptying a recycle or trash bin, or performing factory reset does not necessarily provide the same level of protection on every device. To reduce the risk of personal or sensitive information being recovered, appropriate steps should be taken before transferring, recycling or disposing of devices and storage media.
This document provides an overview on how to securely delete information from commonly used electronic devices. The first section describes methods for devices and storage media that will be reused or recycled (given or sold to someone else for further use). The second section describes secure deletion methods that should be used if the equipment is to be permanently disposed of (not reused).
Why "Deleting" is not Enough
Using the standard "delete" function on a computer is not sufficient to permanently erase sensitive information. When you delete a file or folder using the "Recycle Bin" or "Trash", the operating system simply flags the contents of the file/folder to be overwritten and reused in the future. Until that space is overwritten, the contents of the file still exist on the media and can be recovered with disk/file recovery tools that are readily available online. With large hard drives, "deleted" files can remain, unchanged and recoverable, on the device for a very long time.
Section 1: Equipment will be Recycled
To securely erase the information, it must be overwritten. The more times the information is overwritten, the less likely it can be recovered. However, the more times you overwrite the information, the longer the process will take. This process is called "disk wiping" or "disk shredding." It is recommended that the higher the sensitivity or confidentiality of the information, the more times the information should be overwritten.
There are commercial, shareware, and free disk wiping tools. Some tools will allow you to delete individual files or folders and others will erase an entire hard drive. While there are freeware tools that perform well, these may require a more technical understanding of computers to use them properly. Commercial products tend to be easier to use and understand. Please read the instructions thoroughly for the tool that you select. The files/folders you delete will be permanently erased and cannot be recovered. If you are unsure of how to use your selected tool or don't know which tool to use, please seek assistance from a knowledgeable source.
If you are recycling a computer or device, securely erasing the entire hard drive is recommended. Be aware that doing so will also erase the operating system requiring a complete reinstallation of the operating system before the computer can be used again.
Windows OS:
Eraser is highly-rated free tool for any computer using Windows OS. This tool works well to delete individual files that contain sensitive or personal information that you no longer need. Eraser can be downloaded from here (link). With this tool, you can simply run the application and add your file you wish to overwrite to the task schedule.
To erase an entire hard drive, a recommended free tool is Darik's Boot and Nuke (DBAN), which can be downlaoded here (link). With this tool, you'll need to create a bootable USB flash drive or CD, then boot your computer. The application will launch automatically and you will need to specify which partition or hard drive that you would like erased.
You can also find Microsoft's guidelines on safely disposing of computers here (link).
macOS:
Mac computer hard drives can be securely erased by zeroing their data. Apple provides step-by-step instructions for securely erasing from within macOS using Disk Utility. Note that securely erasing may take a long time, depending on the size of the hard drive.
More detailed information on erasing and reformating a storage device in Disk Utility can be found here (link).
You can also find information on Apple's Reuse and Recycling Program here (link).
In previous versions of macOS, you were able to securely delete items in the trash through the “Secure Empty Trash” command in the Finder to ensure that deleted files were overwritten. This feature has been deprecated in OS X El Capitan (10.11) due to hardware limitations in modern SSDs. To limit access to deleted items and documents, you may want to encrypt your device. You can find out about more about macOS encryption here (link).
Back to Top
Section 2: Equipment will be Disposed of (Destroyed)
Degaussing is a permanent method to securely delete information from most magnetic storage devices. Degaussing is a process by which the storage media is subjected to a very powerful magnetic field which demagnetizes the media and renders it permanently unusable. Degaussing is most commonly used with inoperable hard drives and magnetic tapes in large enterprise environments. Working hard drives in computers should be erased with a tool such as the above mentioned DBAN before disposing of the computer.
Most modern computers use SSDs and do not rely on magnetic plates to store data. For these types of drives, degaussing would not erase the data within them. The most effective way to erase data from SSDs would be to reformat them or physically destroy them.
Physical Destruction
Commercial services are available to physically shred hard disks. Tapes can be unwound from the spools. The magnetic media can then be physically cut into pieces such as running it through a shredder. The same types of services are also available for solid state drives: they can be crushed and shredded.
Cell Phones
For information on how to delete all your information from your cell phone before recycling or disposing of it, check with your cell phone manufacturer.
Back to Top