Safely Disposing of an Old Computer

It seems that many businesses have accumulated old computers that they no longer use, and there comes a time when you may choose to sell or to dispose of one of these antiquated machines. However, one must be careful to ensure that old files, such as financial records, passwords, family pictures, and confidential reports do not stay with the computer once they leave your business. Common sense says that deleting everything on or reformatting the hard drive is enough to prevent old data from being released. The truth is that neither of these methods effectively deletes your data under any circumstances. Accessing these seemingly “deleted” files is a simple operation, and there are identity thieves who buy old computers just to harvest this data with malicious intent. My goal for this article is to teach you how to make sure that your deleted data is actually gone before you sell or dispose of a computer.

When you click the delete button for a file on your computer, the data remains on the drive. Rather than removing an old file, the computer marks that file as able to be overwritten. Think of it like that ugly wallpaper in your bathroom- while you would imagine that “delete” means that the wallpaper is torn off, the computer defines “delete” as hanging a sign on the wallpaper saying “feel free to paint over.” The file remains on the drive until the computer needs the space, at which point the computer covers up the old data with the new data, essentially erasing it (e.g. putting a layer of paint on the wallpaper, covering it up). Until a new file replaces its space on the drive, the original file is still readily recoverable. A surfeit of computer programs are available, some even for free, that specialize in recovering these “deleted” files. Just try googling data recovery software.

Luckily for consumers, programs are also available to cover up deleted files so that they cannot be recovered. At its core, securely deleting a file means that you cover up the file with enough random data that the original file cannot be retrieved. At the very least, you should overwrite all data on your old hard drive once before disposing of it. This single-overwrite operation is referred to as “zeroing out” the disc (because every bit is changed to a zero).

Covering up all of the data on your drive once will stop the majority of thieves from being able to access the data. The gap in the Watergate Tapes were overwritten once, and access to the overwritten data to this day has not been possible. However, theoretical methods for recovering overwritten data exist. Because of this, the Department of Defense mandates that data be overwritten eight times for it to be considered deleted. So, how many times should you overwrite your old hard drive before selling or trashing it? The truth is that, once you’ve overwritten the data once or twice, it is rather easy to continue overwriting it with more cycles. Because of this, the unofficial standard among geeks is that, if all you have to lose is time, old drives should be overwritten 35 times for maximum (albeit excessive) safety.

Now that we have sufficiently established a sense of paranoia, what is the best software for deleting old data? For deleting an entire hard drive that you are about to sell, I suggest Derek’s Boot and Nuke (DBAN). You burn the program (available for Windows, Linux and Apple computers) onto a CD or floppy disk, then boot the computer off of the disk. The program then can wipe all of the hard drives in the computer. Complete instructions from the University of Kansas are available here in a PDF for carrying out the operation. The program allows you to select the number times data is overwritten, too. Three overwrites should be sufficient, but if you have time, you might as well do the Gutmann wipe, which is a full 35 overwrites of random data. Again, 35 overwrites is overkill, but if you have no pressing need to dispose of the computer, all it takes for more overwrites is more time. I suggest that you set this program to run on the computer at night before sleeping, and depending on the size of the hard drive(s), the speed of the computer, and the number of wipes, expect the program to run for about a day or two. At that point, the data has been sufficiently obfuscated so that you can sell or dispose of the drive without fear of your data being recovered. If, after five days, the program is still on its seventh of 35 overwrites and you are getting antsy, feel free to crash the program because a full six overwrites have been completed, which is sufficient to protect data.

Now, I present an alternative: If the thought of your data being recovered is chilling, you can simply remove the hard drive from the computer and sell the system without a drive. Extra hard drives are easy to obtain, so don’t be worried about selling the computer without a drive- there is still demand. Once you have removed the drive, you can keep it in a safe location or you can physically destroy it. The military’s method of destroying old drives is by using thermite to melt the drive. However, the thermite mixture is quite dangerous and I don’t suggest trying this at home. To see why, watch this video- thermite’s power is quite entertaining, but not something that most home businesses would want to try. Instead, you can just take apart the drive, unscrewing and prying it apart until you reach the magnetic disk on which data is stored. Run this disk over a magnet, send it through a paper shredder (or shred it with scissors) and then it should be safe for disposal.

Whether you decide to erase your old data with a program or with a hammer, just remember that you must proactively destroy computer data just like you must shred credit card statements. Keeping this in mind, you can take the steps to sell or to dispose of old or unused computers.

Philip Thomas is a guest blogger. See his blog at http://SagaciousOnlooker.com