A clinic sends forty retired workstations to a recycler. Before handing them over, a technician deletes the patient files and runs a quick format on each drive. Months later, someone who bought one of the refurbished PCs runs a free recovery tool and finds thousands of patient records. The clinic now has a reportable breach caused by equipment it no longer owns.
Disposal is the last stage of the asset life cycle, and it's a common way for data to leave an organization without anyone noticing. On the CompTIA Security+ SY0-801 exam it sits under objective 4.2, which expects you to explain why careful tracking of hardware, software and data, all the way to final disposal, matters for security. This lesson covers how to choose a sanitization method for each kind of media, how to prove disposal happened, and how to retire devices and cloud resources so nothing they left behind can be used against you.
Deleting or formatting a drive doesn't sanitize it
Deleting a file removes the file system's pointer to it and marks the space as free. The data stays on the disk until something overwrites it. A quick format does much the same for a whole volume: it writes new file system structures and leaves the old contents in place. Recovery tools read that leftover data, called data remanence, in minutes.
Sanitization means making recovery infeasible for the level of effort you expect an adversary to spend. The standard reference is NIST Special Publication 800-88, Guidelines for Media Sanitization, which groups methods into three levels:
| Level | What it does | Examples | Media reusable? |
|---|---|---|---|
| Clear | Defeats simple recovery with ordinary software tools | Overwriting all addressable locations, factory reset | Yes |
| Purge | Defeats recovery even with laboratory techniques | Drive sanitize commands, cryptographic erase, degaussing | Yes, except after degaussing |
| Destroy | Defeats laboratory recovery and ends the media's life | Shredding, disintegrating, pulverizing, incinerating | No |
The level you need depends on two things: how sensitive the data is, and where the media goes next. A drive staying inside the organization for reuse by the same department can usually be cleared. A drive leaving the organization's control, to a buyer, a lessor or a recycler, needs purge or destroy. Highly sensitive data on media that is being retired anyway is a candidate for destruction. Whichever method you choose, verify it: sample the media afterward and record the result.
Overwriting suits hard drives, and degaussing works only on magnetic media
On a traditional hard disk drive (HDD), overwriting every sector is a reliable way to clear it. A single pass of zeros or random data is enough for modern drives. Multi-pass schemes, such as the three-pass method still labeled "DoD 5220.22-M" in many wiping tools, date from older, less dense drives and add time without adding meaningful protection.
A software overwrite works through the operating system, so it can miss sectors the drive has remapped after errors or hidden areas reserved by the firmware. That's why it counts only as clear. The drive's built-in secure erase or sanitize command runs inside the drive firmware, is designed to cover those areas too, and counts as purge:
# ATA secure erase: set a temporary drive password, then erase
hdparm --user-master u --security-set-pass Temp123 /dev/sdb
hdparm --user-master u --security-erase Temp123 /dev/sdb
Degaussing exposes media to a powerful magnetic field that scrambles the magnetic domains holding the data. It works on magnetic media only: hard drives, backup tapes and older floppy disks. The degausser must be rated for the media's coercivity, its resistance to being re-magnetized, or it may leave data behind. Degaussing a modern HDD also wipes the servo tracks the drive needs to position its heads, so a degaussed hard drive won't work again. Degaussing has no effect on SSDs, USB flash drives, memory cards or optical discs, because none of them store data magnetically.
On the exam, "degauss the SSDs" is always wrong, and "degauss the tapes" or "degauss the failed hard drives" is often right.