Decide What Happens to the Drive

About this interactive

The Decommissioning and Disposal lesson gives the decisions in an order. Keep it: retention comes first. Before destroying anything, make sure you are not required to keep the data. A lawsuit can require you to keep certain data, and some records must be kept for a set period. Those drives are kept until the requirement ends. Sanitize and reuse: a working drive that will be used again, by a new hire, another project or a school receiving donated computers, is sanitized so nothing from before can be recovered, and then goes back into use. Destroy in house: a drive that will not be used again, such as a failed one, can be physically destroyed, for example in a drive shredder or crusher. That works when there are only a few drives and you have the equipment. Destruction service: when there are hundreds of drives, such as a whole SAN, doing them yourself takes too long. If you do not own a shredder or degausser, or a customer wants proof, a third party destroys them and gives you a certificate of destruction to show they were disposed of properly. A quick test for each card: must the data be kept? If not, will the drive be used again? If not, can you do it yourself, or does the volume, the missing equipment or the need for proof call for a service?

What you'll learn

Decide what happens to a drive leaving service: keep it because its data must be retained, sanitize it for reuse, destroy it in house, or send it to a destruction service
Check retention requirements before any data is destroyed
Choose a destruction service, with a certificate of destruction, when there are too many drives, no equipment, or someone needs proof

Aligned to

CompTIA Security+

4.2 Explain the security implications of proper hardware, software, and data asset management.

NIST 800-53

MP-6 Media Sanitization

ISC2 CISSP

2.5 Ensure appropriate asset retention

Key terms

Data Sanitization: The process of permanently and securely removing or destroying data from a storage device before disposal or reuse.
Physical Destruction: The process of physically dismantling or shredding storage media to make data recovery impossible.
Certificate of Destruction: A formal document issued by a third-party disposal vendor confirming that storage media has been securely sanitized or destroyed in compliance with data disposal requirements.
Data Retention: The practice of storing data for a required period of time to meet legal, regulatory, or business obligations before secure disposal.
Legal Hold: A directive that freezes or preserves relevant data and records to prevent alteration or deletion during an anticipated or active legal proceeding.
Decommissioning: The formal process of retiring and safely removing technology resources from service at the end of their useful life.

Topics

Asset Management Data Sanitization Asset Disposal Interactive Categorize

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →