Security Compliance, Electronic Data, Disk, SSD, or Other Storage Device Disposal
Data, Disk, SSD, Media, and Storage Device Disposal FAQ
Q: What's the university policy regarding disposal or surplus of electronic storage media and/or storage devices?
Q: What actions must I take before releasing or disposing of storage devices or storage media?
Data Classification | Storage device or media | Action | Notes |
High-risk data (Health information/PHI, payment card, SSN, DL#, banking, export control, compartmentalized, etc.) |
ANY* |
Physical destruction |
Includes crushing and degaussing |
Sensitive data (FERPA, etc.) | ANY* | Physical destruction | Includes crushing, shredding, and degaussing |
Sensitive data (FERPA, etc.) |
M.2, SSD, or flash |
Overwrite or scrub |
Overwrite must be verified |
Sensitive data (FERPA, etc.) | HARD DRIVE (magnetic, spinning platter-type) |
Overwrite or scrub |
Overwrite must be verified |
Sensitive data (FERPA, etc.) | Magnetic tape | Overwrite or scrub | |
Sensitive data (FERPA, etc.) | Any university-managed device with strong, full-disk encryption for its entire service life | Verify device is completely encrypted, then delete all encryption keys such that they are completely irrecoverable and officially document. | File-level encryption does not meet this requirement, nor does a device that was unencrypted for any length of time. Actions must be complete, and auditable |
Internal data | ANY* | Physical destruction | Includes crushing, shredding, and degaussing |
Internal data | ANY* | Overwrite or scrub | |
Public data | ANY* | Overwrite or scrub |
Q. What do you mean by "scrub" or "overwrite"?
A. Scrubbing or overwriting means writing over
each bit on spinning-platter-type hard drives with random ones and
zeroes.
Q. Can I just RMA or throw away a digital
storage device?
A. No. The device must be scrubbed, overwritten, or destroyed before it is
released or discarded, per the data classification requirements.
Q. What if the device to be RMA'd or discarded
is broken?
A. All broken storage devices with University
data are required to be degaussed or destroyed
before they are released.
Q. How might I scrub or overwrite a digital storage device?
Spinning-platter HDD |
DBAN, Liveboot CLI++ |
++ use a Linux live-boot distro and "dd" to overwrite* the target HDD |
SSD |
"ATA Secure erase" |
See e.g. https://www.makeuseof.com/tag/securely-erase-ssd-without-destroying/ |
Q. What needs to be done before sending a machine to surplus?
A. See the OBFS page on how to Dispose of Unneeded Equipment .