Before you pass an old PC to a family member, donate it to a charity, sell it online, or drop it at a recycling centre, you need to make sure your personal data is genuinely gone. This guide covers the full data sanitisation process - from backing up what you want to keep through to verifying the wipe is complete. Whether you are handling a single home laptop or preparing a batch of office machines, the steps here apply.
I have managed data sanitisation for corporate refresh programmes, charity refurbishment workshops, and school IT departments for over a decade. The biggest lesson: a quick format is not enough, and the right method depends on whether the drive is an SSD or a traditional hard drive. Below we cover the difference between quick format and secure erase, walk through step-by-step wiping procedures, provide a pre-handoff checklist, and answer common questions. For broader guidance on getting the most from older hardware, visit our Guides hub.
Why Proper Data Sanitisation Matters
A study by the University of Hertfordshire found that over half of second-hand drives sold online still contained recoverable personal data - including photos, documents, financial records, and saved passwords. A simple "Delete all files" or quick format only removes the directory index pointing to those files. The actual data remains on the drive's magnetic platters or flash cells until it is deliberately overwritten.
For individuals, the risk is identity theft and personal exposure. For organisations, it is a data protection compliance failure. The good news: properly wiping a drive is straightforward once you know the correct method for your hardware.
Quick Format vs Secure Erase
Understanding the difference is essential. A quick format creates a new, empty file system index but leaves the underlying data intact. A secure erase overwrites every sector of the drive with zeros, random data, or a cryptographic erase command - making the previous contents unrecoverable through normal means.
| Method | Data Removed? | Recoverable? | Time (500 GB) | When to Use |
|---|---|---|---|---|
| Quick format | Index only | Yes, with free tools | Under 1 minute | Only when reusing the drive yourself |
| Full format (Windows) | Overwrites with zeros | Extremely difficult | 1-3 hours | HDDs being donated or sold |
| Single-pass overwrite (DBAN, nwipe) | Full overwrite | No (for modern drives) | 1-3 hours | HDDs - industry standard method |
| ATA Secure Erase | Hardware-level erase | No | Seconds to minutes | SSDs - manufacturer-recommended |
| Physical destruction | Drive destroyed | No | Minutes | Damaged drives or highest-security requirements |
For formal guidance on media sanitisation standards, see NIST Special Publication 800-88, which outlines Clear, Purge, and Destroy methods for different sensitivity levels.
Wiping a Traditional Hard Drive (HDD)
Back up anything you want to keep
Copy important files to an external drive, cloud storage, or another PC. Once the wipe process begins, there is no going back. Double-check photos, documents, browser bookmarks, and application data.
Deauthorise software and sign out of accounts
Sign out of services like iCloud, Google, Microsoft 365, Spotify, and any software that limits the number of authorised devices. Deauthorise iTunes or any licence-locked applications.
Download and create a DBAN or nwipe boot USB
DBAN (Darik's Boot and Nuke) and its actively maintained successor nwipe are free tools that boot from a USB drive and overwrite every sector of the target disk. Download the ISO, write it to a USB drive using Rufus or Etcher, and boot the PC from the USB.
Select the drive and start the wipe
In DBAN or nwipe, select the internal hard drive. Choose a single-pass zero-fill method - this is sufficient for modern drives. A single pass on a 500 GB HDD typically takes one to three hours. Let it run uninterrupted.
Verify completion
Once the wipe finishes, the tool will report success or failure. For additional confidence, you can boot a Linux live USB and use a hex editor or the hexdump command to confirm the drive contents are all zeros.
Wiping a Solid-State Drive (SSD)
SSDs require a different approach because of wear levelling and over-provisioned areas that traditional overwrite tools cannot reach. Using the drive manufacturer's secure erase utility is the most reliable method.
Identify the SSD manufacturer
Check the drive label or use Device Manager in Windows. Common manufacturers include Samsung, Crucial (Micron), Western Digital, Kingston, and Intel.
Download the manufacturer's tool
Samsung provides Samsung Magician, Crucial offers Storage Executive, and Western Digital provides the WD Dashboard. Each includes a secure erase function. For drives without a dedicated tool, you can use the ATA Secure Erase command through hdparm on a Linux live USB.
Run the secure erase
Follow the tool's instructions. Most require the drive to not be the active boot drive, so you may need to boot from a USB or connect the SSD as a secondary drive. The erase itself typically completes in under a minute for SSDs because it issues a firmware-level command rather than writing to every cell individually.
Verify the result
After the secure erase, the drive should appear as unallocated space in any disk management tool. If you plan to donate the machine with a working OS, you can now install a fresh copy of Windows or a lightweight Linux distribution.
Pre-Handoff Checklist
After wiping the drive, run through this list before handing the machine over.
- All personal files backed up to a separate location
- Signed out of all online accounts (email, cloud storage, streaming)
- Deauthorised licence-locked software
- Drive securely wiped using an appropriate method for the drive type
- Fresh OS installed (or drive left blank if the recipient will install their own)
- BIOS password removed (unless intentionally locking the machine)
- Windows product key noted if transferring the licence
- Power adapter, battery, and any accessories included
- External surfaces cleaned