Destruction or verified erasure: what each one actually proves

Physical destruction and verified erasure both end with a device that cannot yield its data. They differ in what they cost, what they leave you with, and what they prove, and the choice should follow from a data classification rather than from a preference, one of the decisions taken before a project starts.

What destruction gives you

Certainty that is visible. Shredding, disintegration or degaussing produces a device that is obviously beyond recovery, and it can be witnessed. For the highest classifications, and for any device that has failed and cannot be written to, it is the only option.

What it costs you is the residual value of the asset, which on recent equipment is not trivial, and it is why the destruction-versus-erasure conversation is also a budget conversation. See resale and recycling.

What verified erasure gives you

A device that still works, still has resale value, and carries a per-device report proving the erasure ran and verified. For most classifications that report is exactly as defensible as a destruction certificate, and it is frequently more useful because it is machine generated and includes the serial number.

What it requires is that the device be functional and writable, and that the method match the media. Which brings us to the part that gets missed.

The media type decides the method

Different storage technologies do not erase the same way. Techniques appropriate to magnetic media are not appropriate to solid state devices, and a degausser has no effect at all on flash. Applying a magnetic-era method to an SSD and issuing a certificate for it is the most common technical error in this field.

Any credible process therefore starts by identifying the media type per device, and the report says which method was applied to which technology. The three families of method are set out in what data destruction covers, method by method.

On site, witnessed, or under seal

On site. Equipment brought to the floor, work done in front of you. Highest assurance, highest cost per device, and it needs space and power in a hall that is being emptied.

Witnessed at a facility. Assets move under seal and your representative attends the processing. A good compromise on large volumes.

Under seal, unattended. Numbered seals, documented handovers, and a reconciliation on arrival. Sufficient for most classifications, and entirely dependent on the quality of the chain of custody rather than on the destruction itself.

The devices everybody forgets

• Management controllers and their configuration stores.
• Switch and firewall configuration, including credentials.
• Cache modules on storage controllers, and battery-backed cache.
• Multifunction printers and their internal drives.
• Tape, in a cupboard nobody has opened for years.

None of these appears in a rack elevation, and all of them hold something. On a single machine the same list is worked through in retiring one server properly. The full list is on the destruction page.