How Is Data Destroyed on Hard Drives?

When it comes to disposing of old computers and hard drives, most people want confidence that their data is genuinely gone — not just hidden from easy view. Understanding how data destruction actually works helps you make an informed decision about what level of protection you need. Here's a straightforward explanation of the main methods, their limitations, and what we do in practice.

Why Deleting Files & Factory Reset Isn't Enough

There's a widespread misconception that deleting files or doing a factory reset removes data from a drive. It doesn't — at least, not in the way most people assume.

When you delete a file on a computer, the operating system removes the reference to that file in the directory — essentially removing its name from the index. The actual data sitting on the drive is not overwritten. It remains in place until the storage space is needed for something new. This means that deleted files are, in many cases, fully recoverable using data recovery software that is widely available and often free to download.

A factory reset goes further — it reinstalls the operating system, removes user accounts, and returns the device to a fresh state. But on traditional hard drives (HDDs), the underlying data in the sectors of the drive is typically not securely overwritten during this process. A determined person with access to recovery tools can often retrieve significant amounts of user data from a device that has been factory reset.

Modern operating systems have improved somewhat in this area — some now offer options specifically designed for data wiping rather than simple reset. But relying on a standard factory reset for data security when disposing of equipment is not best practice, and for business or compliance purposes it is generally not acceptable.

Method 1: Software Data Wiping (Overwriting)

Software wiping — also called overwriting — uses specialised programs to write new data across every sector of the storage device, replacing the original content with random or predetermined patterns. Once every sector has been overwritten, the original data is gone.

The effectiveness of overwriting is well-established. Several recognised standards define the procedures:

• NIST 800-88 (Guidelines for Media Sanitisation) — a widely referenced US government standard that covers both overwriting and physical destruction methods. It's the current benchmark for most compliance-focused environments.
• DoD 5220.22-M — a US Department of Defense standard specifying multiple overwrite passes. While older and in some contexts superseded by NIST 800-88, it remains widely recognised.
• Gutmann method — a multi-pass overwrite method developed in the 1990s. It has largely been superseded for modern drives but established many foundational concepts in the field.

Software wiping is a good option when you want to keep the drive functional — for repurposing, reselling, or transferring the device. A wiped drive can be reformatted and used again. Certificates of erasure can typically be generated to document that wiping was performed to a specific standard, which is useful for audit trails and compliance records.

Method 2: Physical Destruction

Physical destruction involves rendering the storage medium itself permanently unreadable through mechanical or electromagnetic means. Common approaches include shredding (passing the drive through an industrial shredder designed for hard drives), crushing (applying force to bend and distort the platters), and degaussing (exposing the drive to a powerful magnetic field that disrupts the magnetic domains storing data).

Physical destruction is the highest-assurance method available. When a drive has been properly shredded, there is no mechanism by which data could be recovered — the physical medium that held the data no longer exists in a form that can be read. This makes physical destruction the preferred approach for high-security environments and for compliance frameworks that require the strongest available guarantees.

The trade-off is irreversibility. A physically destroyed drive cannot be repurposed or resold. For equipment being permanently decommissioned, this isn't a drawback — but it rules out options like reusing the drive or selling the device on.

Physical destruction is also documented. A record of what was destroyed, when, and by whom provides an audit trail that can be invaluable in a compliance or regulatory context.

SSDs vs HDDs: Does the Method Differ?

Yes — and this is an important distinction that isn't always well understood.

Traditional hard drives (HDDs) use spinning magnetic platters to store data. Overwriting software works straightforwardly on HDDs — write new data to every sector, and the original content is replaced.

Solid-state drives (SSDs) work differently. SSDs use flash memory cells and manage data through a controller that handles wear levelling — distributing writes across the available cells to prevent any single cell from being written to too many times. This means that when overwriting software targets a specific logical sector on an SSD, the controller may redirect the write to a different physical cell, potentially leaving the original data in a "reserved" area of the drive that overwriting software never touches.

This doesn't mean SSD wiping is impossible — many modern SSDs support the ATA Secure Erase command, which instructs the controller to wipe all cells including reserved areas. But it does mean that standard overwriting approaches designed for HDDs may not be fully effective on SSDs.

For these reasons, physical destruction is often the preferred or required method for SSDs in compliance-sensitive contexts. If your data security requirements are high and the drive is being decommissioned, destroying the SSD physically is the clearest path to certainty.

What We Do in Townsville

We assess each device and use the method appropriate to the situation. For drives in equipment that will be refurbished and reused, we use software wiping to a recognised standard. For drives being permanently decommissioned as part of disposal, physical destruction is our default approach — it provides the highest level of assurance and removes any ambiguity.

Certificates of data destruction are available on request. If you need documentation for compliance, audit, or business records purposes, let us know when you submit your quote request and we'll ensure the paperwork is provided.

For more information on our data destruction service, visit our Secure Data Destruction page, or learn about our specific hard drive destruction service. If you need a certificate, see our page on certificates of data destruction.