The deletion or format of all types of media does leave behind some recoverable data using common recovery software, which matters the moment hardware leaves your control; the method of secure destruction will depend solely upon the type of media. In most cases the certificate showing serial numbers is the actual deliverable.
All drives we receive are read again after they have been over-written. As long as proof exists that no data can be recovered from the drive in question, then the certification will be released by our laboratory staff.
The two methods above may provide an organisation with a false sense of security. Both deleted and formatted data can be easily retrieved with standard software. When you send used equipment outside your control, whether through sale, rental termination, or disposal, there is only one difference between deleting data and destroying it: compliance vs. a breach.
Incorrectly applying technology is why organisations obtain certifications and still experience problems.
The document or documentation is usually what the auditors want, and not the actual disposal.
Every item is listed by manufacturer, model, serial number, method used, date, and whether verification was possible because of the nature of the media. This list can satisfy an audit, a client contract or the ICO if needed; which is why putting a hard drive in the skip is still a problem even though no one could have reasonably accessed it.
UK GDPR requires organisations to destroy personal information securely and to provide evidence they did. Listing the serial numbers on a certificate provides that evidence. Saying "the IT people took the old computers" does not provide that evidence.
We would prefer to tell you there are times when paying for this is unnecessary and we will do so.
If BitLocker or FileVault was activated and the device is undergoing an appropriate rebuild process, the encryption key will be deleted from the system and all of your files are already unreadable.
Re-issuing a device to a different employee typically will require little to no certification for destruction as a normal re-image of the device will likely meet all requirements under most policies.
Not everything is personal data. If what is stored really is irrelevant and unimportant, a simple wipe will suffice.
Personal data, client information, financial or medical information, anything under a contractual obligation, and/or any drives which have failed — these require proper documentation for certified destruction.
Documentation is part of the price of each unit instead of an additional cost.
Destruction pricing is based on both the quantity of equipment and the media type used. For example a few drives will have different pricing than the complete removal of an entire server or rack. Documentation which includes the serial number(s) destroyed, the method of destruction, and date is included in the quote as standard and not separately billed for.
This is one of the three services we charge for whatever the outcome. The work is done and documented regardless of the outcome, because the outcome is the destruction. We offer collection for large quantities throughout Greater Manchester, or you can bring them to us at Peter House, located on Oxford Street.
No. Neither deleting nor formatting destroys data completely. When data is deleted it simply removes the directory reference to the file without touching the data. A simple format does essentially the same thing. It changes the directory information about where a file lives but does nothing to destroy the original data itself. That leaves anyone who wants to take the time to retrieve that data able to do so. If hardware is leaving your control, that gap is the difference between compliance and a breach.
SSDs use wear levelling. This is where the drive stores data in blocks that don't necessarily align with the addressable range of the SSD. Thus, an overwrite of the SSD may not always reach all areas. The encryption-based erase function erases the internal key which renders all blocks unreadable simultaneously.
In cases where a drive has already failed and thus is unable to receive an overwrite/erase command, those drives are destroyed via physical destruction of the media (the platter(s) or flash package(s)) itself, not just the enclosure, and recorded by serial number.
Yes, as part of the service, not as an extra. Each piece of equipment is identified by manufacturer, model and serial number with details of the disposal method and date used. This is exactly what an auditor or the ICO expects to see.
No. We will let you know when it is unnecessary. A modern encrypted laptop that has been reset properly has already discarded its encryption key. Likewise most machines being redeployed within your organisation (for example: PCs for staff use), simply require re-imaging. It is primarily of concern regarding personal data, client records, contractual obligations and failed drives.
Costing is dependent upon volume and media type. Certificates are provided at no additional charge. For larger volumes we can arrange collection from across Greater Manchester.