When you delete a file, the operating system removes the pointer to it. The data stays on the disk until something else overwrites that block. A quick format rewrites the file table, not the contents. Free recovery tools will pull most of it back.
A full format on a current Windows build does write zeros across the volume, which is better. It still cannot reach reallocated sectors, host-protected areas or an SSD's spare blocks.
That is the gap between deleting data and destroying it.
What Clear and Purge mean
NIST SP 800-88 Rev. 1 is the guideline most UK auditors recognise. It sets three levels of sanitisation.
Clear overwrites every location the drive's normal read and write commands can address. It defeats software recovery but not the areas the drive interface hides.
Purge uses a command in the drive's own firmware to reset every cell, hidden and spare areas included. Laboratory recovery is no longer feasible.
Destroy is physical: shred, disintegrate, incinerate.
We work to Clear or Purge depending on the drive, and to HMG Infosec Standard 5 Enhanced where a contract names it, as school and academy trust tenders sometimes do. These are the standards we work to, not certifications we hold.
How the erasure runs
We use Parted Magic, booted from external media so the drive's own operating system is never in the way. We never open, index or list what is on the drive: it is sanitised before anything else is done to the machine.
Where the drive supports it, we issue ATA Secure Erase on SATA disks or NVMe Format with a secure erase setting on NVMe SSDs. These are firmware-level commands: the drive's own controller clears every block it manages, spare capacity included. That is Purge.
An SSD or NVMe drive resets its cells in minutes. A spinning disk works through the whole surface, so a large one takes hours and may be left going overnight.
Some drives also support a cryptographic erase, which discards the internal key and leaves the ciphertext meaningless. On NVMe that is an NVMe Format set to cryptographic erase. On SATA it is ATA Sanitize with crypto scramble, which arrived in ACS-2 and is not on every drive. That holds only where the drive supports it and we invoke it. Internal encryption on its own is not sanitisation.
Where a drive does not support those commands, or reports them as failed, we fall back to a verified multi-pass overwrite of the full addressable range. That is Clear, and it is the weaker option: an overwrite issued over the interface reaches what the interface can address and nothing else, so reallocated sectors and spare blocks are left as they are.
Either way we finish by reading data back off the drive and checking it. That verifies the addressable range, which is as far as reading over the interface can reach. The hidden areas are not verified that way. They are covered by the firmware command itself, and by the drive reporting the sanitise complete.
That asymmetry is why we use a firmware command wherever the drive supports one, and why a drive that will not run one, or reports it as failed, is physically destroyed rather than trusted to an overwrite. Where a drive held anything you would not want reconstructed at any cost, say so and we will destroy it rather than sanitise it, whatever it claims to support.
Drives that fail
Some drives will not accept a sanitise command, will not complete one, or will not spin up. Those are physically destroyed, serial recorded first, so the asset still appears on your paperwork with its outcome stated.
The certificate, and what an auditor does with it
You get a Certificate of Data Erasure for every drive. Not one sheet for the collection, and not one per machine either: a laptop with two drives in it produces two certificates. Each one carries:
- the drive serial, and the serial of the asset it came out of
- make, model and capacity
- the method used and the standard it maps to
- the date, and who did the work
- the verification result
An auditor is not asking if you care about data. They are asking which device held which data and what happened to it. A per-drive certificate answers that; "12 laptops wiped" does not.
The parent asset serial ties each certificate back to the manifest, signed by both of us before the van leaves and copied to you on the day, so the chain runs from the desk the machine came off to the outcome. Collection is covered under IT asset recovery.
Where this sits in UK GDPR
Article 5(1)(f) requires appropriate security for personal data, including protection against unauthorised processing and accidental loss. Article 32 names ongoing confidentiality among the measures you are expected to have.
Neither names an erasure standard. They require measures that suit the risk and that you can demonstrate, which documented per-drive erasure gives you once the hardware has gone. Sector rules sit on top: a law firm answers to the SRA as well, a healthcare provider to the Data Security and Protection Toolkit.
This is the hardware half of the problem. The copies already sitting in someone else's database are the other half, which is what Obex is for.
Tell us how many drives you have, spinning or solid state, and we will tell you what we would do with each one. Get a quote, or email oliver@kiverefresh.com.