What “wiping” actually means
The word “wipe” is used loosely, but in the context of data destruction it has a precise meaning: overwriting the entire addressable storage space of a drive with new data, then verifying that overwriting was successful at the sector level. Simply deleting files removes directory entries; the underlying data remains on the drive until new data overwrites it naturally. Formatting a drive similarly leaves most data intact and recoverable.
A genuine wipe uses dedicated software that writes to every sector, including those not visible to the operating system, and produces a log confirming each sector was addressed. This log forms the basis of a certificate of data destruction.
For an overview of how wiping compares to shredding and degaussing, see our guide to data wiping vs shredding vs degaussing.
Step-by-step: how to wipe a hard drive
Step 1: Identify the drive type
Before selecting a wiping tool, establish whether the drive is a traditional magnetic hard drive (HDD) or a solid-state drive (SSD). The distinction matters because SSDs store data differently and require specific commands — typically ATA Secure Erase or NVMe sanitise — rather than conventional overwrite routines. Using a standard HDD overwrite tool on an SSD may not reach all data.
Step 2: Back up any data you need to keep
Once wiping begins, data cannot be recovered. Confirm that any files you need have been transferred to another location before you proceed.
Step 3: Select a certified wiping tool
Choose software that:
- Works to a recognised standard (NIST SP 800-88 “Clear” or “Purge” level, or NCSC-aligned guidance)
- Produces a per-drive verification report showing that every sector was successfully overwritten
- Generates a certificate or report suitable for compliance documentation
Widely used tools in enterprise environments include Blancco Drive Eraser, Certus Software, and similar products. Some tools allow bootable media to be created so the drive can be wiped independently of the operating system.
Step 4: Boot from the wiping tool and run the process
For drives that form part of a working computer, create a bootable USB or disc containing the wiping software and start the machine from that media. This ensures the tool has full access to the drive without the operating system locking any sectors.
For drives that have been removed from a machine, connect them via a USB-to-SATA adaptor or directly to a wiping station.
Launch the tool, select the correct drive — double-check the selection to avoid wiping the wrong device — and start the process. Wiping a standard hard drive takes time proportional to its capacity: allow roughly 30 to 90 minutes per terabyte for a single-pass overwrite.
Step 5: Verify and document
When the process completes, the tool should display a verification result confirming that overwriting succeeded. Save or print this report. It should record:
- Drive make, model, and serial number
- Wiping standard applied
- Date and time of the process
- Verification result (pass or fail)
- Name of the software and its version
This report, combined with a chain-of-custody record, constitutes your evidence of compliant data destruction.
Step 6: Dispose of the drive responsibly
A wiped drive can be reused, donated, or recycled. If the drive passes a health check, it may have value as a refurbished component. If it is to be recycled, it must be handled through an authorised treatment facility under the WEEE Regulations 2013 — it cannot be placed in general waste.
When wiping is not sufficient
Software wiping is not suitable in all circumstances. Consider physical shredding instead when:
- The drive is an SSD and you cannot confirm the wiping tool fully supports it
- The drive has bad sectors that the wiping tool cannot address
- The data held is of the highest sensitivity and the drive has no residual value
- You need absolute certainty without reliance on software verification
For drives destined for shredding, see our guide to how to dispose of hard drives securely.
Business obligations under UK GDPR
Businesses disposing of hard drives that have held personal data are subject to the storage limitation and integrity principles of UK GDPR and the Data Protection Act 2018. These require that personal data is not retained beyond its required period and that it is kept secure throughout its lifecycle, including at the point of disposal.
The Information Commissioner’s Office (ICO) expects organisations to have documented disposal procedures and to keep records demonstrating that those procedures were followed. A per-drive wiping report and a certificate of data destruction together satisfy this requirement.
Using a certified provider
Many businesses find it more practical to use a certified IT asset disposal (ITAD) provider rather than managing the wiping process in-house. A provider should offer:
- Certified wiping to a named standard
- A per-device verification report
- A certificate of data destruction
- Chain-of-custody documentation from collection to completion
- WEEE-compliant recycling for residual material
Recycle4Charity provides certified data destruction for London businesses, including software wiping and physical shredding. Wiped devices in good condition are donated to digitally-excluded Londoners. Find out more on our hard drive and media destruction page, or contact us to arrange a collection.