How to Wipe Retired Computers Without Risk

Retired computers rarely leave an organisation empty. Desktops and laptops that have been replaced still hold email caches, saved credentials, customer files, browser sessions and local copies of documents that were never meant to leave the building. Wiping them properly is what turns old hardware from a data risk into something that can be reused, resold, donated or recycled with confidence.

This guide sets out a documented, standards-aligned process for erasing retired computers. It draws on NIST SP 800-88 Rev. 2, Guidelines for Media Sanitization (approved September 2025), and IEEE Std 2883-2022, IEEE Standard for Sanitizing Storage, which together describe how organisations should choose, apply and record a sanitisation method.

How do you wipe a retired computer without risk?

Record the computer and its drives, keep any data you are required to retain, erase every drive from a bootable tool using a method suited to the storage (overwrite for hard drives, sanitise commands or cryptographic erase for SSDs), check the result, and file a record before the machine leaves your control. The steps below explain each stage.

Is deleting files or reinstalling Windows enough to wipe a computer?

No. Deleting files usually removes only the reference to the data. A quick format rebuilds the file system but leaves most of the underlying information in place. Reinstalling the operating system overwrites some areas of the drive and leaves others untouched. Each of these can leave data that ordinary recovery software can find, which is why none of them counts as sanitisation. Our guide to whether deleted data can be recovered explains the mechanics in more detail.

Step 1: What should you record before wiping a retired computer?

Record the asset tag, make, model, serial number, each drive's type and serial number, the last user and the intended destination, before anything is erased. Start with an inventory entry for each computer: asset tag, manufacturer, model, serial number, the drives it contains (type, model and serial number), the last assigned user and the intended destination. Do this before erasure, because some of that information becomes harder to confirm once the drive is blank. NIST SP 800-88 Rev. 2 stresses tracking equipment from arrival to final destination, because that tracking is what makes the eventual sanitisation record meaningful.

Keep retired machines in a controlled area while they wait. Devices sitting in an unlocked store room are a common gap in otherwise sound processes.

Step 2: Keep what you must, and nothing more

Confirm that business records on the machine have been retained according to policy, legal hold or operational need, using approved systems. Avoid making informal backups to external drives just to speed up the retirement. That simply moves the same data to a less controlled place.

Step 3: Which sanitisation level do retired computers need?

For computers leaving your control intact, Purge is usually the right level; Destroy is for faulty or unsupported drives. The right sanitisation method depends on where the computer is going and how sensitive its data was. NIST and IEEE describe three levels:

• Clear: logical techniques applied to all user-addressable storage, protecting against simple, non-invasive recovery. The device stays usable.
• Purge: techniques that make recovery infeasible even with state-of-the-art laboratory methods, while leaving the media potentially reusable.
• Destroy (IEEE calls it Destruct): recovery is infeasible and the media can no longer store data.

NIST advises that, where possible, Purge should be used in preference to Clear. IEEE 2883 also notes that Clear is not appropriate for sensitive data, because it need not reach areas of the drive that the host cannot address. For computers that will leave your control intact, for resale, donation, lease return or recycling for reuse, Purge is usually the sensible target. Destruction is for media that is faulty, unsupported or holds data so sensitive that policy forbids reuse.

IEEE 2883.1-2025 frames these choices around use cases such as internal reuse, external reuse and recycling, and encourages reuse where it can be done safely. A properly purged drive keeps its value; a shredded one does not.

Step 4: Match the technique to the drive

Retired fleets usually mix older hard drives with SATA and NVMe solid-state drives, and each needs a different approach.

Hard disk drives

For magnetic hard drives, overwriting every addressable location is effective. IEEE 2883 notes that a single pass with a fixed pattern can be sufficient for some devices, and NIST Rev. 2 explicitly drops the old idea that multiple passes are required. Before overwriting, hidden areas such as a Host Protected Area or Device Configuration Overlay should be reset so that the whole capacity is reached.

Solid-state drives

SSDs spread writes across spare cells through wear levelling, so ordinary overwriting cannot be relied on to reach every copy of old data. NIST warns that applying magnetic-era overwrite habits to flash storage can increase disclosure risk. For SSDs, use the drive's own sanitise commands, such as block erase or cryptographic erase, where the drive supports them. Our article on whether overwriting SSDs is safe covers this in more depth.

Encrypted and self-encrypting drives

Cryptographic erase works by destroying the encryption key so that only unreadable ciphertext remains. IEEE sets conditions for treating it as Purge: all data must have been encrypted before it was written, with sufficient key strength, and every copy of the key must be sanitised. If encryption was switched on after sensitive data was already stored, cryptographic erase alone is not enough. See how to erase encrypted drives for the full checklist.

Step 5: How do you wipe a PC with a USB drive?

Start the computer from a bootable erasure USB using its boot menu, select the disks to erase and let the tool run until it confirms completion. Retired computers are often slow, partly broken or still joined to old accounts. Booting the machine from a dedicated erasure tool avoids depending on the installed operating system, reaches every detected drive, and gives technicians the same process on every machine.

That is the job we designed RedKey USB to do. It boots most Intel and AMD PCs made since around 2000, and most Intel Macs from 2006 to 2020, and erases the drives it detects. It is a one-time purchase with unlimited use. The Professional and Ultimate editions produce a PDF report for each erasure, while the Home edition shows the result on screen. It does not support Apple silicon Macs, so use Apple's own erase options for those.

Step 6: How can you verify the data is unrecoverable?

Confirm the erasure completed without errors, verify the outcome (IEEE 2883 calls for full verification after Purge and sampling after Clear), and have someone validate that the method suited the media. NIST Rev. 2 describes sanitisation assurance in two parts: verification of the technique's outcome, and validation, which is the decision to accept or reject the result. In practice that means confirming each erasure completed without errors, checking that the method suited the media, and treating any failure as an exception. IEEE 2883 recommends retrying or escalating: if Clear fails, retry or move to Purge; if Purge fails, retry or move to Destruct.

Drives that will not complete erasure should go into a separate, controlled queue for physical destruction rather than being waved through.

Step 7: What should a disposal log include?

At minimum: the device and drive serial numbers, date, sanitisation method and result, and the person responsible. NIST SP 800-88 Rev. 2 recommends a certificate of sanitisation for each item. Useful fields include manufacturer, model, serial number, asset number, media type, the sanitisation method (Clear, Purge or Destroy), the technique used, the tool and version, the verification method, and the name, date and signature of the person who performed and validated the work. Store that record against the asset so you can answer questions months later. Our guide on why audit-ready erasure reports matter explains what makes a record useful.

Remember that a certificate is a record of what was done. It supports compliance, but it is not proof of compliance on its own.

Step 8: What should you do with old laptops once they are wiped?

Redeploy, resell or donate them if they work, or send them to a licensed recycler, keeping custody records for each handover. Once a computer has been erased and recorded, label it, update its status and move it to its destination: redeployment, resale, donation or a licensed recycler. If a third party collects the equipment, keep their collection paperwork alongside your own erasure records. A recycler's certificate shows what they did; it does not show that you erased the data before it left.

What is the simplest way to make sure old laptops are wiped properly before reuse, donation or recycling?

Use the same short checklist for every machine:

1. Record the asset and its drives before erasure.
2. Retain required business data through approved systems.
3. Choose the destination, then the sanitisation level (Purge for most external reuse).
4. Use a technique that suits each drive type: overwrite for hard drives, sanitise commands or cryptographic erase for SSDs.
5. Erase from a bootable tool so every detected drive is covered.
6. Verify each result and route failures to destruction.
7. Keep a sanitisation record for every device.
8. Hand over with matching custody paperwork.

Following the same documented steps every time is what makes the process defensible. It protects the people whose data was on those machines, and it lets working hardware go on to a useful second life.

Frequently asked questions

Can I wipe a computer that will not boot?

Often, yes. A bootable erasure tool runs from USB rather than the installed operating system, so a broken Windows installation does not stop it, provided the hardware itself starts and the drive is detected. If the drive cannot be detected or erasure fails, remove it and send it for physical destruction.

Does reinstalling Windows erase the old data?

No. Reinstalling overwrites only part of the drive and leaves much of the old data in place, where recovery software can find it. Use a sanitisation method applied to the whole drive.

Is drilling a hole through a hard drive enough?

Not on its own. NIST SP 800-88 Rev. 2 notes that drilling, bending or cutting only partly damages a drive and can leave data recoverable in a laboratory. Erase first, or use destruction to a recognised standard.

How long should we keep erasure records for retired computers?

Keep them for as long as your disposal policy, contracts and regulators require, and store them against the asset record so they can be found by serial number. Many organisations align retention with their audit cycle and contract terms.

For teams retiring several machines at once, the RedKey USB Professional 5-Pack gives each technician or site its own reusable tool with PDF reports. Related reading: How to Verify Hard Drive Wiping Before Disposal and How to Prepare Devices for Resale Securely.