Somewhere in your office there's probably a closet with a few old laptops, a retired server, or a box of hard drives. They're out of service, so they feel harmless. They aren't. In most cases every file that was ever on them is still there.
Deleted doesn't mean gone
When you delete a file, the operating system typically just marks that space as available. The data stays on the disk until something else happens to overwrite it. Free recovery tools can bring it back in minutes.
Reformatting isn't much better. A quick format rebuilds the file system's index but leaves the underlying data largely intact. Even a "factory reset" may skip recovery partitions or fail silently on some hardware.
$ recover --scan /dev/sdb # "formatted" drive
found ... payroll_2025.xlsx
found ... client_contracts/ (412 files)
found ... saved_passwords.csv
found ... Outlook.pst (3.1 GB)
result: drive was not sanitizedWhere retired data ends up
Retired equipment tends to leave a business through one of a few doors: donated to a school or charity, sold online, handed to an employee, dropped at a recycling event, or thrown out. Unless the data was properly sanitized, each of those doors leads somewhere you can't control.
For organizations handling health, financial, or payment data, an improperly disposed device can become a reportable breach — with notification costs, regulatory scrutiny, and reputational damage attached.
SSDs are a special case
Solid-state drives spread data across memory cells and keep spare capacity the operating system can't see. That means traditional overwrite tools can miss data entirely. SSDs need firmware-level secure erase, cryptographic erase, or physical destruction.
What proper sanitization looks like
The widely used reference is NIST Special Publication 800-88, which describes three levels:
- Clear — overwrite user-addressable storage so data can't be recovered with standard tools.
- Purge — use techniques like cryptographic erase or degaussing to defeat even lab-grade recovery.
- Destroy — physically shred, crush, or disintegrate the media.
Whatever the method, two things separate real sanitization from wishful thinking: verification that the process succeeded, and documentation tying each device's serial number to what was done.
If you can't prove a drive was sanitized, you have to assume it wasn't.
A simple disposal checklist
- Keep an inventory of devices that store data, including phones, printers, and copiers.
- Store retired equipment securely until it's processed.
- Sanitize or destroy media using a recognized standard, and verify the result.
- Get a certificate listing each device by serial number.
- Recycle or resell only after sanitization is confirmed.
Have a closet full of old equipment? SYNTRA's data sanitization and IT asset disposition services handle it end to end, with documentation for every device.