Delete and format both leave data that can be restored with standard tools once hardware is out of your control. The right way to do it depends entirely on the type of media, and in most cases the certificate listing serial numbers is the real deliverable.
We read back each drive once we overwrite it. Confirmation that there are no recoverable items must be obtained before any certificate is issued from our lab.
As far as the disposal of equipment which held personal data is concerned, the UK GDPR imposes a duty upon the person responsible for that disposal to be able to prove destruction was undertaken. In other words, the duty of proof is not satisfied by merely having carried out the destruction. The mere act of placing equipment in a skip, along with a belief that destruction has been completed, does not provide a defence under these circumstances.
Therefore, you will require evidence in some form. At a minimum, you should have the serial numbers of each device, the method(s) used against each device, the date(s) of completion of destruction of each device, and who performed the destruction. This type of documentation is exactly why we offer certified destruction certificates, and why the service exists separately from simply throwing hardware away.
This documentation provides all of the information requested above regarding each individual piece of equipment and lists every piece of equipment destroyed (by serial number). Therefore, if an auditor, a regulatory body or even one of your clients requests information about how you disposed of a particular piece of equipment which contained their data, this documentation would serve as satisfactory evidence.
In cases where the drives are intended for reuse within your own organisation, on the same network with the same trust boundary, the process can typically be handled adequately with a standard format. However, certified destruction is reserved for equipment that will no longer remain under your control after disposal.
If the drive was full-disk encrypted during all of the time in which it existed, and you can demonstrate this fact, then discarding the key alone constitutes a cryptographic wipe. That is, the data is now unrecoverable by anyone. There will be no additional value (security) added to your situation with regard to payment for overwriting your ciphertext, only a certificate.
Likewise, if you have a few older personal drives containing no information that could possibly be considered “sensitive”, simply drilling through those drives' disks will cost you nothing. We'd rather tell you that than charge you to do so.
The price for secure erasure and destruction is quoted by device, but there are also discounted pricing levels available based upon the number of devices being destroyed when disposing of a large quantity of assets. We include a certificate documenting the destruction service rather than charging separately for it. It's our position that a destruction service that does not provide documentation is not one you should purchase.
We do not provide a collection service regardless of how many devices a company wishes to destroy. Simply bring the drives to Vision Park, Monday to Friday 9am–5:30pm, with no prior appointment necessary. Alternatively, you may send them via insured/tracked post.
Yes, on any modern hard drive. The multi-pass advice comes from old recording densities from the 1990s and does not apply today. A single verified overwrite will not be recoverable.
Wear levelling. There's no addressing each one of the physical blocks individually from outside, because the controller distributes writes across them. Cryptographic erase destroys the key, making all blocks unreadable at once.
If the device contains personal information and is leaving your control, you have a responsibility to prove how the disposal of the device occurred. The certificate is evidence of the disposal process.
Yes. Physical destruction is appropriate in this case. If a drive is unresponsive, you can't perform an “erase” on it; therefore, shredding or destroying the platters is the only defensible approach.
No. Regardless of volume, we do not offer collection. Simply take the drives to our facility at Vision Park or post them to us insured and tracked, and you will receive a signed manifest when they reach us.
We are happy to arrange witnessed destruction by appointment. Some customers require this form of verification for their own compliance purposes; this would simply be a reasonable request to make.