Why a Factory Reset Doesn’t Equal Data Destruction

Getting rid of an old phone, laptop, or hard drive can feel simple. You sign out of your accounts, reset the device, and the screen comes back looking brand new. But an empty screen doesn’t necessarily mean the data is gone.

A factory reset is designed to remove your access to the device and prepare it for its next user. It isn’t the same as securely destroying the information stored on the drive. Depending on the device and how the data was erased, some information may still be recoverable.

That isn’t a theoretical concern. In late 2018, Blancco Technology Group bought 159 used drives on eBay across the US, UK, Germany and Finland, and had its partner Ontrack analyse them in early 2019. Every seller said the data had been properly removed. Sensitive data was still present on 42% of the drives, and 15% held personally identifiable information: passports, birth certificates, financial records, internal company email.

The study is now seven years old, and drive encryption has become far more common since. What hasn’t changed is the underlying cause: sellers who believed a reset or a format was enough. That belief is still the default, and it is still wrong for most of the equipment leaving offices today.

What a Factory Reset Actually Does to a Hard Drive

A reset almost always removes your access to the data. It does not reliably remove the data from the drive.

On a traditional hard drive

A spinning hard drive stores files in physical sectors and keeps a separate index, the file table, mapping filenames to those sectors. Deleting a file, or running a standard reset, edits the index. It marks the sectors as available for reuse. It does not touch the magnetic patterns in the sectors themselves.

Until something else writes over that space, the original data is physically intact and sitting there. Recovery software simply ignores the index and reads the sectors directly. On a lightly used drive, files deleted months ago come back whole: filenames, folder structure, timestamps and all.

On an SSD or flash storage

Solid-state drives are frequently assumed to be safer. They aren’t, and the reasons are structural.

SSDs cannot overwrite a block in place. They write to a fresh block and mark the old one invalid, leaving the original contents until the controller’s garbage collection gets around to erasing it. On top of that, every SSD ships with over-provisioned capacity: reserve blocks the operating system cannot see or address at all. Wear levelling deliberately spreads writes across the whole pool, so fragments of your data end up in regions no file-level tool can reach.

The practical consequence is that overwriting an SSD from the operating system, even repeatedly, cannot guarantee it touches everything. You have to use the drive’s own internal sanitize command, or destroy the media.

On a phone or tablet

Modern iPhones and Android devices are the genuine good-news story. They encrypt storage by default, and a factory reset destroys the encryption key rather than the data. Without the key, the remaining ciphertext is unreadable in any practical sense.

That protection holds on two conditions: the device was actually encrypted, which older, budget, and some heavily customised Android devices weren’t by default, and the reset completed properly. Removable microSD cards are a separate matter entirely. They are usually unencrypted, and a device reset does nothing to them.

The IT Equipment Everyone Forgets

Most guidance stops at laptops and phones. In practice, the leaks come from equipment nobody thinks of as a computer.

Printers, copiers, and multifunction devices.

An office MFP has an internal hard drive, and it keeps images of documents it has scanned, copied, printed, and faxed. Thousands of them, sometimes years’ worth. Payroll runs, contracts, medical forms, signed cheques. When the lease ends and the device goes back to the vendor, that drive frequently goes with it, untouched. This has produced real regulatory penalties, and it is still routinely overlooked.

Servers, networking gear, and management controllers.

Switches and routers store configurations, VPN credentials, and certificates. Servers carry out-of-band management controllers with their own credentials and logs. RAID controllers cache data. A rack that has been “decommissioned” by unplugging it is a rack full of live credentials, which is why proper data center decommissioning treats every component as data-bearing until proven otherwise.

The loose drives in the drawer.

Every IT department has them: pulled drives kept just in case, backup disks from a migration three years ago, a shoebox of USB sticks. They sit outside every asset register, which means they are outside every disposal process too. They are also the easiest thing in the building to walk out with.

Who Can Actually Recover Data From a Reset Drive?

“Recoverable” means very different things depending on the device, the data, and who is trying to access it. What matters is whether your discarded drive could realistically be read by someone else.

Free software, ten minutes, no skill required. Free recovery tools are a search away and install like any other application. Point one at a factory-reset hard drive and it will surface deleted files with original names and folder structure intact. This is the tier that matters most, because it requires nothing but curiosity. Anyone who buys your old laptop can do this tonight, on a machine they already own, for nothing.

Commercial data recovery, a few hundred dollars. Professional recovery services reconstruct data from partially overwritten media, damaged platters, and corrupted file systems. It costs money, so it implies motive: a competitor, a litigant, someone who knows what was on the device. Well within reach for anyone with a reason.

Chip-off and lab forensics. Desoldering flash chips and reading them directly, bypassing the controller entirely. Expensive, specialist, and the province of law enforcement, state actors, and high-end forensic labs. Relevant to classified material and serious litigation, not to an average office refresh.

What NIST SP 800-88 Rev. 2 Actually Changed

NIST published Revision 2 of Special Publication 800-88 on 26 September 2025, and withdrew Revision 1, which had stood since December 2014, in its entirety on the same day. A great deal of advice online, including material published well after the revision, still describes the 2014 document. If your disposal policy cites Rev. 1, it cites an archived publication.

NIST stopped specifying techniques

Revision 1 was built around per-media technique tables. You looked up your device type and read off the approved method. Revision 2 removes almost all of that. Apart from cryptographic erase, technology-specific sanitization techniques are now explicitly out of scope, and NIST directs readers to IEEE 2883 and, for government applications, NSA policy manuals for the actual techniques.

Storage technology changes faster than a NIST revision cycle. The practical effect is that Rev. 2 tells you which outcome you need, and IEEE 2883 tells you how to achieve it on your specific media. Any vendor quoting a “NIST-approved technique” for a specific drive type today is describing something the document no longer contains.

Rev. 2 also introduces the term information storage media (ISM), replacing “electronic media,” to cover cloud, object and container storage alongside physical drives.

The three outcomes are unchanged, but the preference order is explicit

• Clear: logical sanitization through the device’s standard read/write interface. Protects against straightforward, non-invasive recovery. The device stays usable.
• Purge: physical or logical techniques that make recovery infeasible even with state-of-the-art laboratory techniques, while leaving the device potentially reusable.
• Destroy: renders recovery infeasible by laboratory techniques and leaves the media permanently unusable.

Rev. 2 adds a line worth quoting in any policy document: where possible, use purge instead of clear. Clear is the floor, not the target.

Multi-pass overwriting is formally retired

The folklore of three, seven or thirty-five passes is over. Rev. 2 clarifies that multi-pass overwriting is not needed for clear, explicitly countering the obsolete DoD 5220.22-M language. The Department of Defense itself removed overwriting specifications from NISPOM back in 2006.

On flash storage, extra passes are actively harmful: they add write wear without reaching the over-provisioned regions a software wipe never touches. If a vendor is selling a seven-pass wipe as a premium service today, you are being charged for drive wear.

Degaussing has been reclassified, not abolished

This is the change most often reported incorrectly, including in a lot of ITAD marketing.

Degaussing remains a physical purge technique for legacy magnetic media. What Rev. 2 says is that, at the time of writing, degaussing is not considered an approved destroy technique, even when it renders a drive permanently inoperable. Damaging a drive and sanitizing its data are two distinct outcomes, and degaussing can achieve the former while failing the latter.

The degausser’s field strength must be matched to the media’s coercivity, and many degaussers in service today lack sufficient force for modern high-coercivity drives. Degaussing also does nothing whatsoever to SSDs and flash media, which store data electrically rather than magnetically.

The correct policy action is not to delete degaussing. It is to reclassify it: a purge technique for magnetic media only, using equipment matched to the media’s coercivity.

Verification and validation are now two separate steps

Rev. 1 had a single verification step. Rev. 2 splits sanitization assurance into two:

• Verification inspects the immediate outcome. Did the technique complete, without errors or anomalies?
• Validation is a judgement call. It reviews the verification data against the sensitivity of the data involved, and either approves the sanitization as effective or rejects it, requiring a different technique or escalation to a stronger method.

Rev. 2 also states that elaborate full or representative sampling of a drive’s contents after clear or purge is not necessary unless organizational policy requires it. The old sampling ritual is gone; the judgement step replaced it.

The consequence for anyone buying data destruction: “the software reported success” is verification. It is not validation, and on its own it is no longer sufficient evidence.

Cryptographic erase now has hard pre-conditions

Destroying the encryption key instead of the data remains valid, but Rev. 2 attaches conditions that most “it’s encrypted” claims will not survive:

• No prior plaintext. No sensitive data can ever have been stored unencrypted on the media before the keys were established. If encryption was switched on after the fact, cryptographic erase does not qualify.
• Cryptographic strength. The algorithm’s security strength must be at least 128 bits, and the entropy of the random number source must match or exceed the key length.
• Zeroization. Target keys must be permanently sanitized by zeroization, and all copies of those keys must be sanitizable.
• Validated modules. Federal agencies must use cryptographic modules validated to the current FIPS 140 standard.
• Key scope. Rev. 2 defines which key types count, and requires that keys hierarchically below the target keys are eliminated too.

Rev. 2 adds one more caution: cryptographic erase should not be trusted on media that has been backed up or escrowed unless you have high confidence in how those keys were stored and managed. And for information that must stay confidential for decades, the ciphertext still sits on the drive, which makes CE a questionable choice for genuinely long-lived secrets.

A self-encrypting drive with poor key management does not qualify simply because the marketing says “encrypted.”

Which Data Destruction Method Should You Use?

When security is the priority, physical destruction provides the highest level of certainty. For drives that hold sensitive information, cannot be reliably wiped, or must never leave your control, on-site destruction removes the chain-of-custody risk entirely: the drives are destroyed at your location, and only fragments leave.

For everything else, off-site shredding at a certified facility meets the same standard at lower cost, provided the chain of custody is documented from collection onward. Where equipment can safely be reused or resold, secure wiping and remarketing is the better option, both financially and environmentally.

The Certificate That Proves It Happened

Sanitization you cannot evidence is, from a regulator’s or a litigant’s perspective, sanitization that did not occur.

What documentation should contain

Rev. 2 expanded the requirements for a Certificate of Sanitization. A defensible record should identify:

• The make, model, and serial number of every device, not a line item reading “12 laptops”
• The method and the specific technique used
• A validation step distinct from verifying that the tool completed
• The date, the location, and who performed the work
• Additional traceability where cryptographic erase was the method

Why “we wiped it” is not a defence

Under the FTC Safeguards Rule, HIPAA, and state privacy laws including CCPA and CPRA, the obligation is to demonstrate a documented process, not to assert good intentions. A serial-numbered certificate turns an unbounded liability into a closed record. It is also, bluntly, what makes the difference between a manageable incident and a reportable breach.

Ask any vendor for a sample certificate before you hire them. If what comes back is a generic thank-you letter with no serial numbers, keep looking. The same goes for their certifications: R2v3 is an auditable claim, and a real one can be produced on request in seconds.

So Why Does Everyone Still Just Reset?

A factory reset is free, takes about twenty minutes, and requires no vendor, procurement process, scheduling, or budget approval. Certified data destruction requires someone to own the process. For a business replacing 40 laptops during a busy quarter, a reset is simply the path of least resistance.

The economics change when you account for the downside. The real cost isn’t the recycling invoice. It’s breach notification, regulatory exposure, and the difficulty of proving what happened to data after the equipment left your control. Against those risks, per-drive destruction is one of the cheapest data security controls available.

There’s also inertia. Equipment nobody has decided how to handle doesn’t disappear. It accumulates in a storeroom, becoming a growing liability while losing value. Scheduling a single free e-waste pickup for the backlog is far easier than letting it sit indefinitely.

Data Destruction Checklist

For an individual

1. Confirm full-disk encryption is on before you reset. FileVault on Mac, BitLocker or Device Encryption on Windows, on by default on modern phones.
2. Back up what you want, and open the backup to check it worked.
3. Sign out of and deauthorize every account: cloud storage, email, streaming, password manager, 2FA app, Find My.
4. Remove SIM and microSD cards. Resets do not touch them.
5. Then factory reset.
6. If the device is old, unencrypted, or you’re not sure, take the drive out. Five minutes with a screwdriver beats any amount of uncertainty.

For a business

1. Inventory everything data-bearing, including printers, MFPs, networking gear, and the drawer of loose drives.
2. Classify by data sensitivity, not hardware value. A ten-year-old server holding patient records outranks a new laptop that never left the marketing team.
3. Pick a method per class using the table above, and write it into a documented policy.
4. Reclassify degaussing in that policy if it’s still listed as a destroy method.
5. Use a certified processor, and ask what certifications they hold for recycling and for data destruction specifically.
6. Require serial-numbered certificates, and store them with your compliance records.
7. Include offboarding in the process. Returned remote-employee laptops are the most commonly missed category in the whole chain.
8. Schedule it. Annually or semi-annually, so equipment never accumulates into a project.

When to Choose Destruction Over a Reset

Physical destruction removes uncertainty. The drive cannot be read by any of the three recovery tiers above. It’s the right choice in three situations: drives holding sensitive or regulated records, drives that have failed and can no longer be reliably wiped, and equipment that will not be reused at all.

When destruction is performed by a certified provider, you also receive documentation identifying exactly which drives were destroyed. Keep that certificate with your compliance records. For regulated data, it’s the part that matters most.

Frequently Asked Questions

Does a factory reset delete everything?

No. On a hard drive it removes the index, not the data. On an SSD it cannot reach over-provisioned blocks. On a modern encrypted phone it is effectively sufficient, because it destroys the encryption key.

Is a factory reset enough before selling a laptop?

Only if the drive was fully encrypted before the reset. If it wasn’t, or you can’t confirm, remove the drive or have it destroyed. That single check is the difference between the two outcomes in the Blancco study. If the laptop isn’t worth selling, you can recycle it for free in San Diego.

How many overwrite passes do I need?

One. NIST SP 800-88 Rev. 2 retires multi-pass overwriting for modern media. Additional passes add wear, not security.

Is degaussing still acceptable?

Not as an approved destroy technique under Rev. 2, and it has never done anything to SSDs. Physical destruction or drive-native sanitize commands have replaced it.

What about a drive that’s already dead?

It cannot be wiped, and it may still be readable in a lab. Failed drives should be physically destroyed. This is the clearest case for shredding there is.

Do I get proof that my data was destroyed?

You should. Ask for a Certificate of Destruction listing individual serial numbers, the method used, and the date. Without serial numbers it proves very little.

Destroy It Properly, and Get It in Writing

Dream Electronic Recycling is an R2v3-certified recycler serving San Diego County since 2015. We destroy every data-bearing drive we receive, provide Certificates of Destruction listing serial numbers, and offer on-site destruction for organizations whose data can’t leave the building.

Call (619) 889-1305 or email [email protected] to arrange collection, or schedule a free pickup for five or more devices.