Data Destruction: Wiping, Shredding, and What Actually Counts as Secure

By Tom Langston · 11 July 2026

Security
Privacy
Storage
Compliance

TL;DR

“Delete” and “format” do not destroy your data; they just stop showing it to you, and it stays recoverable until something overwrites it. Properly destroying data depends on the type of drive and how sensitive the data is. The modern shortcut that makes all of this easy: if the drive was encrypted, destroying the encryption key makes the data unrecoverable instantly.

Hard drives (spinning HDDs): a single full overwrite is enough for almost everyone; for high sensitivity, physically destroy them.
SSDs, NVMe, and flash (phones, USB sticks): overwriting is unreliable because of how flash works. Use the drive’s built-in Secure Erase, or crypto-erase (wipe the key), or physically destroy it.
Encryption is your friend: if a drive or phone is encrypted (BitLocker, FileVault, LUKS, modern phones), a factory reset or key wipe is effectively a secure erase.
What is acceptable rises with sensitivity: a quick wipe for a reused personal drive, certified erasure or physical destruction for sensitive or regulated data.

Now for the more technical explanation

Does deleting or formatting actually erase data?

When you delete a file or quick-format a drive, the operating system just removes the pointers to the data and marks the space as free. The actual bytes stay on the media until something writes over them, which is why file-recovery tools work so well. So “I deleted it” and “I destroyed it” are very different claims.

The three levels (a useful mental model)

Security guidance (notably NIST 800-88, the widely used standard for media sanitisation) splits destruction into three levels. It is a clean way to think about it:

Clear: overwrite or reset using normal commands, so the data cannot be recovered with ordinary tools. Fine for reuse within an organisation or for low-sensitivity disposal.
Purge: use stronger methods (a firmware Secure Erase, a cryptographic erase, or degaussing) so the data cannot be recovered even in a lab. Appropriate for sensitive data leaving your control.
Destroy: physically destroy the media (shred, disintegrate, incinerate) so it can never be used again. For the highest sensitivity.

Match the level to the risk. Most personal situations need Clear or Purge; Destroy is for the genuinely sensitive.

It depends on the media

This is the part people get wrong, because the right method for a hard drive is the wrong method for an SSD.

Spinning hard drives (HDDs). Magnetic platters store data in fixed locations, so overwriting actually replaces it.

A single full-disk overwrite (all sectors written once) is enough to prevent recovery; the old idea that you need many passes is outdated for modern drives.
Tools that do this include a bootable wipe utility or the drive’s own erase command.
Degaussing (a strong magnetic field) destroys an HDD’s data and usually the drive with it. It does not work on SSDs (they are not magnetic).

SSDs, NVMe drives, and flash (USB sticks, SD cards, phone storage). Flash uses wear-levelling, which spreads writes across the chips and keeps spare capacity, so when you “overwrite a file” the controller may write elsewhere and leave the original data sitting in a block you cannot address. That makes plain overwriting unreliable on flash. Instead:

Use the drive’s built-in Secure Erase (ATA Secure Erase for SATA SSDs, or the NVMe format/sanitize command), which tells the controller to wipe everything including the spare areas.
Or crypto-erase: most modern SSDs are self-encrypting internally, so erasing the internal key makes all stored data unreadable at once. This is fast and effective when supported.
For high sensitivity, physically destroy the chips (shredding rated for SSDs), because you cannot rely on overwriting.

The encryption shortcut (crypto-erase)

The easiest modern answer is to encrypt from day one. If the whole drive is encrypted, the data is only meaningful with the key, so destroying the key destroys access to the data, everywhere on the drive, instantly.

Windows (BitLocker), macOS (FileVault), Linux (LUKS): if the volume was encrypted, wiping or discarding the key effectively sanitises it.
Phones and tablets: modern iOS and Android devices encrypt storage by default, so a factory reset performs a crypto-erase and is generally acceptable for personal disposal. Sign out of the account first (to clear activation locks), and for very sensitive data, still consider physical destruction.

⚠ Caution: "encrypt used space only" does not protect what you deleted earlier

When you switch BitLocker on, it offers to encrypt used disk space only rather than the entire drive. It is quicker and it is the sensible default for a new drive, but the words matter: it encrypts the space currently holding files, and leaves the free space untouched. If you deleted a sensitive file before turning encryption on, its contents are still sitting in that free space in the clear, unencrypted and potentially recoverable, so a later crypto-erase does not touch them. This is exactly why the advice is to encrypt from day one, on a fresh drive, before any sensitive data has been written and deleted. On a drive that has already been in use, choose encrypt the entire drive instead, so the old free space is scrambled too.

The payoff is that full-disk encryption turns “how do I securely wipe this” into “delete the key,” which is why it is worth turning on regardless.

Cloud data is different

You cannot physically destroy a drive you do not control. For cloud data:

Deleting removes your access, but the provider may retain backups for a period, and you are trusting their deletion process.
The real protection is to have stored it encrypted with your own key in the first place (client-side encryption, for example a VeraCrypt container), so provider copies are meaningless without the key you control.
For compliance, rely on the provider’s documented deletion and retention commitments, and keep records.

What is acceptable, by sensitivity

Reusing a drive yourself (low risk): a quick wipe or crypto-erase is plenty. If it was encrypted, a reset is enough.
Selling, donating, or recycling personal kit: Clear-level for an HDD (full overwrite) or Secure Erase / crypto-erase for an SSD or phone. Remove or destroy anything you are unsure about.
Sensitive personal or business data leaving your control: Purge-level (Secure Erase, crypto-erase, or degaussing for HDDs), and keep a record of what was done.
Highly sensitive or regulated data: physical Destroy, often with a certificate of destruction from a certified provider for your audit trail. When in doubt at this level, destroy the media.

Verify, and keep proof where it matters

After a wipe, verify where you can (a recovery-tool spot check, or the drive reporting a successful sanitise).
For anything regulated, keep a record or certificate: what device, serial number, method, date, and who did it.

The short version

Deleting is not destroying. Overwrite works for hard drives; SSDs and phones need Secure Erase or crypto-erase because overwriting is unreliable on flash. The cleanest approach is to encrypt everything up front, so destruction becomes “wipe the key.” Scale the method to the sensitivity: a quick erase for personal reuse, certified erasure or physical destruction for anything sensitive or regulated, and keep proof when it counts.

Written by Tom Langston, IT Infrastructure and Cybersecurity.