Data wiping is a secure procedure for erasing data from storage media, using methods selected according to the device’s technology. Companies use it before returning, transferring or retiring computers, servers and storage systems to protect information belonging to the previous user. The process includes identifying the storage media, performing the erasure, verifying the outcome and producing a report documenting the work carried out.
What Is Data Wiping and Why Formatting Is Not Enough
Data wiping encompasses erasure procedures that make recovering data from a storage medium impracticable at the required level of protection. Ordinary file deletion, by contrast, may only remove the references that the operating system uses to locate a file. Particularly on magnetic hard drives, previous information may remain in areas that have not yet been overwritten and can be recovered using dedicated software.
Quick formatting updates the file system structures but does not guarantee the permanent removal of previously stored data. Even a full format does not necessarily amount to secure erasure, because the outcome depends on the operating system and the type of storage medium. On SSDs, internal memory management can also leave some information in areas that ordinary write operations cannot reach. For this reason, formatting does not replace a data wiping procedure suited to the storage medium and accompanied by verification of the outcome.
When Businesses Need Data Wiping
Secure data erasure mainly concerns devices that change users or destinations while still containing information belonging to the previous owner. It is especially important when equipment leaves the organisation’s control. Common situations include:
- replacing or upgrading company computers, with devices intended for recovery or resale;
- returning equipment at the end of a lease or rental agreement;
- reassigning equipment to another employee, department or site when the new user must not have access to previous information;
- transferring, selling or donating devices that are still usable;
- retiring servers, storage systems or workstations taken out of service.
Corporate storage media may contain contracts, customer data, login credentials, database copies and internal correspondence. Handing over a device with recoverable information can expose this content to unauthorised parties, compromising the confidentiality of personal data and the company’s information assets. During internal reassignment, data wiping also separates the previous user’s information from the data intended for the new employee or department.
How Data Wiping Works
The process begins by identifying the storage medium using information such as its make, model, capacity and serial number. These details link each operation to a specific device. The erasure method depends on the storage technology, the condition of the medium and the required level of protection. Magnetic hard drives can be treated through software overwriting, while SSDs may use sanitisation functions supported by their controllers or, under suitable conditions, cryptographic erasure. The process ends with verification of the outcome and the corresponding documentation.
| Method | How it works | Outcome for the medium |
|---|---|---|
| Software overwriting | Writes new data to logically accessible areas | Medium generally remains reusable |
| Device-based sanitisation | Uses commands supported by the controller to erase data | Medium remains reusable if the procedure succeeds |
| Cryptographic erasure | Makes the keys required to decrypt data unavailable | Medium generally remains reusable |
| Degaussing | Applies a strong magnetic field to magnetic storage media | Medium becomes unusable |
| Physical destruction | Physically destroys the medium through a dedicated process | Medium cannot be reused |
The method chosen also affects what happens to the hardware afterwards. Software-based procedures and cryptographic erasure, when applicable and verified, preserve the functionality of the storage medium. Degaussing, by contrast, is used for magnetic media and is not suitable for flash memory. Damaged media or those that cannot be reliably erased may require an irreversible process such as physical destruction, preventing reuse of the component in order to protect the information stored on it.
Overwriting Data on HDDs
Overwriting a magnetic hard drive involves writing new data to the logically accessible areas of the disk, replacing the previous information. Software can check the result by reading the treated sectors and comparing them with the data expected by the procedure. Historical schemes involving multiple overwrite passes do not automatically provide greater protection on modern drives. The method and number of passes are determined by the characteristics of the medium and the required level of sanitisation.
The main limitation concerns areas the system cannot address. Bad sectors or sectors remapped by the controller may remain outside logical overwriting and retain residual information. When a drive has faults that prevent access to the data or verification of the result, a technical assessment guides the choice of an alternative treatment, such as degaussing or physical destruction.
Secure Data Erasure on SSDs and Flash Memory
In SSDs, the controller distributes writes across memory cells to limit wear, using a mechanism known as wear levelling. During use, blocks are also remapped and areas inaccessible directly to the operating system are managed internally. Overwriting logical addresses may therefore leave residual information in cells that the software cannot reach. A study on data erasure in SSDs documented these limitations and differences between some implementations of sanitisation commands.
For secure SSD erasure, functions managed directly by the controller can be used, such as ATA Secure Erase and NVMe Sanitize commands, where supported by the device. These procedures work through mechanisms internal to the storage medium and can reach areas that ordinary logical overwriting cannot access. Their effectiveness depends on the available command, firmware and condition of the drive. Verification therefore takes account of the indicators returned by the device and the checks required by the method used.
Cryptographic erasure works differently: it makes the keys needed to decrypt stored data unavailable. This method applies when the medium uses appropriate encryption and all the information requiring protection is covered by that encryption. Verification also considers the device configuration and key management, as well as the outcome of the operation.
Data Erasure Verification and Reporting
Verification establishes whether the procedure achieved its intended result. With software overwriting, it may involve reading the treated sectors again, while device sanitisation commands and cryptographic erasure use the checks available for the device and the method applied. The NIST SP 800-88 Rev. 2 guidelines, published in 2025, provide a technical reference for organising storage media sanitisation according to the sensitivity of the information, including method selection and verification of results.
An erasure report documents the treatment of each storage medium. In our projects, we use dedicated tools and, where included in the agreed scope, generate a PDF report containing the available information on the work performed. The document may include:
- the storage medium’s identifier, including make, model, capacity and serial number;
- the method applied and the tool used, including the sanitisation level where relevant;
- the date and time of the operation and verification, when available;
- the outcome of the procedure, any errors detected and the results of the checks.
When personal data is involved, erasure contributes to the security measures adopted by an organisation in relation to the risks addressed by Regulation (EU) 2016/679. The GDPR requires appropriate technical and organisational measures without prescribing specific data wiping software. Documentation of erasure operations helps companies demonstrate the measures taken to protect information stored on their devices.
The technical report records the treatment carried out and its outcome. Where provided for, we can issue a certificate of erasure associated with the treated medium, including identifying details and information about the operation. This document attests to the activities performed under the procedure applied; independent certification of the process, if any, is a separate form of verification.
Data Wiping and the Reuse of Corporate IT Assets
Secure, documented data erasure makes it possible to prepare IT equipment that remains technically suitable for reuse. A computer or server that has undergone a verified sanitisation procedure can be refurbished, reassigned or returned to the market, retaining some of its residual value. When a storage medium cannot be reliably erased, a technical assessment may direct it towards an irreversible treatment, while the device’s other components can be assessed for potential recovery.
At MGK Tech, we integrate secure data erasure into our IT Asset Disposition activities, managing IT assets from collection and handover through technical assessment and the definition of their next destination. We organise each project according to the type of equipment, the condition of the storage media and the requirements agreed with the client. Our activities include:
- we inventory the devices received, identify their storage media and check the available serial numbers;
- we perform software-based erasure using BitRaser on compatible, functioning media, following the procedure agreed with the client and producing the corresponding PDF report;
- we assess hardware condition through testing and grading to identify devices suitable for reuse, refurbishment or remarketing;
- for media that cannot be reliably erased using software, we agree an alternative treatment with the client, which may include degaussing or physical destruction.
We can also perform data erasure on-site at the client’s premises using our technical equipment. Throughout the project, we document the identification of storage media, the work carried out and the results obtained. For assets that cannot be recovered and must be managed as waste electrical and electronic equipment (WEEE), we work with authorised operators while maintaining traceability of the intended destination.
Through documented erasure and equipment assessment, we help companies protect information stored on their media and recover value from IT hardware that is still usable. Devices that pass technical checks can be prepared for a new service life, refurbishment or resale through our asset recovery and remarketing channels.