How to Wipe Data Before Recycling a Computer

Last updated: July 21, 2026

Key Takeaways on Secure Computer Recycling

• Data must be wiped before computer recycling to prevent identity theft and regulatory violations. Simple deletion or factory reset leaves recoverable data on HDDs and SSDs.
• Studies show 40% to 60% of resold or recycled devices still contain recoverable data. IBM’s 2025 report places the average U.S. data breach cost at $10.22 million.
• Factory resets remove the file directory but do not fully erase data. Modern encrypted Apple devices can achieve cryptographic erasure through Erase All Content and Settings.
• Organizations must follow NIST 800-88 Purge or Destroy methods with serialized certificates of destruction to meet HIPAA, CMMC, GLBA and GDPR requirements.
• Premier Logitech delivers NIST 800-88 Rev. 2 and CMMC-aligned ITAD services with real-time chain-of-custody visibility and serialized certificates. Get started today.

Why Data Must Be Wiped Before Computer Recycling

Skipping a proper wipe exposes sensitive information long after a device leaves its first owner. A Blancco Technology Group and Kroll Ontrack study found that 42% of used drives sold online still held recoverable data, including passport scans and financial records, even though sellers believed the drives had been wiped. A separate analysis reported that 40% to 60% of resold or recycled devices contain recoverable data from previous owners.

The financial impact of exposed data is significant. IBM’s 2025 Cost of a Data Breach Report found the average U.S. breach cost reached $10.22 million, an all-time high. Morgan Stanley paid a combined $95 million in fines from the OCC and SEC after decommissioned servers with unencrypted customer data were resold at auction.

Electronics recyclers typically do not wipe drives before resale or material recovery. Drives removed during recycling often enter secondary markets or travel to countries with limited data protection laws.

For organizations: Regulatory frameworks including HIPAA, CMMC, GLBA and GDPR require documented proof of sanitization. A basic reset does not satisfy these requirements. Organizations must apply NIST 800-88 Rev. 2 Purge or Destroy methods and retain serialized certificates of destruction. Talk to a lifecycle expert about building a compliant ITAD program.

Why a Factory Reset Does Not Delete Everything

A factory reset does not fully erase data. It removes the file directory but leaves underlying information on storage sectors, which remains recoverable with standard tools. Pat Clawson, former CEO of Blancco Technology Group, explained it clearly: “All you are doing with a factory reset is removing the table of contents. The rest of the chapters are sitting there, waiting to be discovered.”

On SSDs, residual data risk increases. Consumer resets often fail to address hidden areas or over-provisioned cells on SSDs. Studies indicate that many second-hand devices still contain recoverable data after a basic factory reset or deletion.

Modern encrypted devices behave differently. On Apple Silicon Macs and Intel Macs with a T2 chip, Erase All Content and Settings instantly renders data unreadable by erasing the hardware encryption key, a process known as cryptographic erase. On iOS devices and recent Android devices, factory reset achieves cryptographic erasure because storage is encrypted by default and the reset discards the encryption key.

For organizations: Enterprise devices running Windows or Linux rarely use the same hardware-encryption defaults as consumer Apple devices. Factory resets on these machines reach, at best, the NIST 800-88 Clear level, which is insufficient for media leaving organizational control or containing regulated data.

How to Wipe a Hard Drive Before Recycling on Windows 11

Windows 11 includes a reset path that, when configured correctly, triggers the drive’s internal erase functions. For consumer devices and personal use, this reset option provides stronger protection than a basic factory reset.

Before starting, confirm the following:

• The device remains plugged into AC power throughout the process.
• All personal files and accounts have been backed up.
• BitLocker or Device Encryption is enabled, which supports cryptographic erase on SSDs.
• The Windows 11 installation is functional and can boot normally.

To perform the reset:

1. Open Settings and navigate to System, then Recovery.
2. Select Reset this PC.
3. Choose Remove everything.
4. Select Change settings and enable the Clean data option.
5. Choose whether to affect only the drive where Windows is installed or all drives.
6. Review the summary and confirm the reset.

After the reset completes, confirm that no personal files or accounts remain accessible. This method is less comprehensive than some manufacturer tools for full SSD secure erasure. For HDDs, a dedicated overwrite tool such as DBAN provides additional assurance.

For organizations: Windows 11 Reset with Clean data does not produce a serialized certificate of destruction. It does not satisfy chain-of-custody requirements under HIPAA, CMMC or GDPR. Organizations must use certified ITAD processes that generate auditable records tied to device serial numbers.

How to Secure Erase an SSD Before Recycling

On macOS, the recommended path depends on the chip generation. On Apple Silicon (M-series) and Intel Macs with a T2 chip, use the built-in erase workflow.

1. Sign out of iCloud, iMessage and all linked accounts.
2. Open System Settings, or System Preferences on older macOS versions.
3. Navigate to General, then Transfer or Reset.
4. Select Erase All Content and Settings.
5. Follow the on-screen prompts to confirm.

This process destroys the hardware encryption key and performs a cryptographic erase that renders data unreadable on Apple Silicon and T2 Macs.

For non-Apple SSDs, manufacturer tools such as Samsung Magician, Western Digital Dashboard, Crucial Storage Executive and Kingston SSD Manager provide reliable SSD data removal. These tools address wear-leveling and over-provisioned areas that simple overwrites miss. Many modern motherboards also support secure SSD erasure through the BIOS or UEFI interface.

For organizations: Manufacturer utilities do not produce audit-grade certificates. For SSDs leaving organizational control or containing regulated data, NIST 800-88 Rev. 2 calls for cryptographic erase with verified key destruction or physical destruction. Talk to a lifecycle expert about certified SSD sanitization at scale.

SSD vs. HDD: How Secure Erasure Methods Differ

HDDs and SSDs require different sanitization approaches because they store data in different ways.

For HDDs:

• Data sits at fixed locations on magnetic platters, so a full overwrite reaches all user-addressable sectors.
• NIST 800-88 Rev. 2 states that a single verified overwrite pass is sufficient to meet the Clear level on modern HDDs.
• Degaussing achieves Purge level on HDDs but renders the drive permanently inoperable.
• Multi-pass overwrite methods such as the legacy DoD 5220.22-M are no longer required. The Gutmann 35-pass method is obsolete for current drives.

For SSDs:

• Overwriting alone is often insufficient because data may remain in hidden over-provisioned cells due to wear-leveling.
• NIST 800-88 Rev. 2 maps the NVMe Sanitize command, including Block Erase or Crypto Erase, to the Purge level.
• Cryptographic erase qualifies as Purge only when AES-256 encryption was confirmed active at the controller level from initial use.
• Degaussing is ineffective for SSDs because SSDs use non-magnetic flash memory chips.

Physical Destruction Options for Drives

Physical destruction is appropriate when software-based sanitization cannot be executed or verified, when drives are damaged or non-functional, or when policy mandates destruction for high-sensitivity data.

Approved physical destruction methods include:

• Industrial shredding: Industrial shredding or pulverization to a particle size of 2 mm or smaller is the only NIST SP 800-88 Destroy method that ensures irrecoverability for SSDs when cryptographic erasure cannot be verified.
• Crushing: Hydraulic crushing deforms platters and achieves the NIST 800-88 Destroy level, though shredding is preferred for the highest assurance environments.
• Degaussing (HDDs only): Degaussing is effective for magnetic media but has no effect on SSDs and renders the device permanently inoperable.

Several requirements govern defensible physical destruction. SSDs require a finer shred profile than HDDs because a surviving NAND package can contain recoverable data fragments. To prove that destruction met this standard, a defensible certificate of destruction must name the certifying organization, list each drive by serial number, identify the destruction method, capture the date and location, reference applicable standards such as NIST 800-88 and include the signature of an authorized representative. Organizations seeking independent verification should look for NAID AAA certification, which mandates annual third-party audits, background-checked personnel, witnessed destruction modes, sealed-bin chain of custody and verified particle-size reduction.

Choosing Between Free Resets and NIST 800-88 or CMMC-Compliant Destruction

The appropriate sanitization path depends on device ownership, data sensitivity and final disposition.

Consumer path:

• The device is personally owned with no regulated data.
• Use Windows 11 Reset with Clean data enabled, macOS Erase All Content and Settings or a manufacturer secure erase utility.
• For older HDDs without hardware encryption, use a verified overwrite tool such as DBAN.
• For broken or non-functional drives, physical destruction is the only option.

Organizational path:

• The device held regulated data such as PHI, PII, CUI or financial records.
• The device is leaving organizational control through recycling, resale, donation or transfer.
• Apply NIST 800-88 Rev. 2 Purge for functional drives using cryptographic erase on self-encrypting drives or NVMe Sanitize or ATA Secure Erase with verification.
• Apply NIST 800-88 Rev. 2 Destroy for non-functional drives, highest-sensitivity data or when Purge cannot be verified, using industrial shredding to the appropriate particle size.
• Obtain serialized certificates of destruction for every device.
• Retain documentation for the period required by applicable regulation, such as six years under HIPAA.

For organizations: Improper sanitization of media containing CUI risks inadvertent disclosure, loss of government contracts, FAR penalties, reputational damage and incident response costs. CMMC 2.0 Level 1 requires organizations to map sanitization methods to media type and disposition intent. Premier Logitech delivers NIST 800-88 Rev. 2 and CMMC-aligned ITAD with real-time chain-of-custody visibility and serialized certificates.

When to Use Professional ITAD Services

Consumer-grade tools work for personal devices with no regulated data. Several conditions signal the need for a certified ITAD partner.

• The organization is subject to HIPAA, CMMC, GLBA, PCI DSS, GDPR or CCPA.
• Devices held CUI, PHI, PII or financial records.
• The organization needs serialized certificates of destruction for audit purposes.
• The fleet includes a mix of HDDs, SSDs and NVMe drives that require different sanitization methods.
• Drives are non-functional and cannot be wiped with software.
• The organization requires chain-of-custody documentation from pickup through final disposition.

NIST does not certify vendors or issue NIST certification for media sanitization providers. Any vendor claiming such certification misuses the term. Organizations should instead look for NAID AAA certification, R2v3 or e-Stewards credentials and documented alignment with NIST 800-88 Rev. 2 and IEEE 2883-2022.

Premier Logitech provides end-to-end IT asset disposition services for enterprises, OEMs and government agencies. Services include secure data destruction, compliance reporting aligned with NIST, CMMC and SOC 2 frameworks, serialized certificates of destruction and real-time lifecycle visibility. Premier Logitech holds a CAGE Code (4WAJ9) as a pre-vetted federal government partner and operates across three DFW facilities with nationwide reach.

Talk to a lifecycle expert to build a certified ITAD program that meets regulatory requirements and eliminates data exposure risk at end of life.

Frequently Asked Questions

Is a factory reset enough before dropping a computer at a recycler?

A factory reset removes the file directory but leaves underlying data on storage sectors intact and recoverable with standard forensic tools. For personal devices with no sensitive data, a Windows 11 Reset with the Clean data option enabled or macOS Erase All Content and Settings provides meaningful protection because both use hardware encryption. For older HDDs without hardware encryption, a dedicated overwrite tool is necessary before recycling. Electronics recyclers typically do not wipe drives before processing, so the responsibility rests with the device owner before drop-off.

Can a computer be sold safely after a factory reset?

Safe resale depends on the device type and the sensitivity of stored data. On Apple Silicon and T2 Macs, Erase All Content and Settings performs a cryptographic erase that renders prior data unreadable. On Windows machines, Reset this PC with the Clean data option enabled is the minimum acceptable step for SSDs with BitLocker active. For HDDs, a verified overwrite using a tool such as DBAN provides stronger assurance. For any device that held regulated data, health records, financial information or business credentials, a certified ITAD process with a documented certificate of destruction is the appropriate path before resale.

What does NIST 800-88 Rev. 2 require for computer disposal?

NIST SP 800-88 Rev. 2, finalized in September 2025, defines three sanitization levels based on data sensitivity and disposition intent. The Purge and Destroy levels described earlier in this article represent the minimum acceptable methods for media leaving organizational control, with the specific choice depending on whether the drive is functional and whether firmware-level sanitization can be verified. The standard also requires organizations to classify data sensitivity using FIPS 199 impact levels before selecting a method and to document verification results with serialized records tied to each device’s serial number.

What is a certificate of destruction and when is it required?

A certificate of destruction is a documented record that a storage device has been sanitized or physically destroyed in line with an applicable standard. A defensible certificate identifies the certifying organization, lists each device by serial number, specifies the destruction method, references the applicable standard such as NIST 800-88 and captures the date, location and signature of an authorized representative. Certificates are required under HIPAA, with a six-year retention requirement, as well as CMMC, GLBA, PCI DSS and GDPR. Organizations that perform self-service wipes without third-party verification typically cannot produce the level of documentation regulators expect during audits.

Does CMMC require physical destruction of all drives?

CMMC 2.0 does not mandate physical destruction for all drives. It requires that sanitization methods align with NIST SP 800-88 and match media type, data sensitivity and disposition intent. For functional SSDs and NVMe drives containing CUI, Purge-level sanitization via cryptographic erase or a verified firmware sanitize command is acceptable when the process is documented. Physical destruction is required when Purge cannot be executed or verified, such as on non-functional drives or when the drive’s encryption status cannot be confirmed. In all cases, CMMC expects chain-of-custody documentation and auditable records. Organizations working with federal contracts should engage a certified ITAD partner to ensure their sanitization program meets current CMMC and FAR 52.204-21 requirements.