You wiped the drive, reinstalled Windows, and shipped the laptop to its new owner. The new owner booted a recovery tool and pulled your tax returns, your kid’s baby photos, and the spreadsheet of every password you had ever saved. This is not a worst-case scenario. It is the default outcome for most used laptops sold between private buyers, and the reason is that the steps most people think of as “wiping the drive” do not actually wipe the drive.
This is a guide for people who are about to get rid of a laptop, a phone, a USB stick, or a desktop, and who want to know what to do instead of dragging files to the bin. The mechanism is more interesting than the practical steps, but the practical steps are what pay the rent, so the practical steps come first.
The four-step checklist that actually works
The shortest version of this article is the following four steps, in order. Pick the path that matches the drive type.
- Hard drive, encryption off, want to keep the OS. Boot a Linux live USB, run
sudo dd if=/dev/zero of=/dev/sdX bs=1M status=progressonce, then reinstall. The myth that you need thirty-five passes or random data is outdated. The current NIST guidance reflects what drive manufacturers have known for years: one pass of zeros is enough for a magnetic drive that is leaving your possession. - Hard drive, encryption off, drive is leaving the house. Do the zero-fill above, then physically destroy the platters. A drill through the disk, or a hammer through the case, costs nothing and rules out the rare cases where a recovery service is still pulling data from edge cases.
- SSD, encryption off. Run the manufacturer’s secure-erase tool. Intel, Samsung, Crucial, and the rest all ship a downloadable tool that issues the underlying command the drive understands. The SSD’s own controller erases the flash pages the host cannot see. A software overwrite is not enough, because the controller is allowed to keep old copies in flash pages the host cannot address.
- Drive, encryption on from the start. Discard the key. BitLocker, FileVault, and LUKS all support a key-destruction flow that renders the existing ciphertext unreadable. This is the cheapest option, and it is the option that modern phones use when you factory-reset them. The data is not gone. The ability to read it is.
If the drive is sensitive and you are guessing, choose the physical destruction option. A drill is $30 and a hammer is $10. The data breach is not.
The bin is a signpost, not a shredder
The reason the four-step checklist looks like overkill is that the operating system has trained you to think of deletion as a single action. A file goes into the bin. The bin is emptied. The progress bar finishes. The file is gone.
The file is not gone. The operating system edited a small table at the front of the filesystem and stopped tracking the file. The actual bytes, the JPEG, the PDF, the DOCX, are still on the disk. The next program that needs storage is allowed to overwrite them, but until that happens, they are still there.
Pretty much every general-purpose filesystem on the planet works this way, from the old Microsoft format on early PCs to the newer ones shipping on Windows, Linux, and macOS today. The reason is performance. Writing zeros over a folder of holiday photos would take many minutes, and most users would find that annoying. So the operating system skips it. The trade-off is that files you wanted gone are still there, and the trade-off is accepted because the alternative is too slow for the typical case.
The typical case is fine. The asymmetric case is the used-laptop sale, where “the typical case” never applied.
How a recovery tool finds what you meant to delete
A recovery tool walks the raw disk sectors looking for patterns that files leave behind. Every common file format has a recognizable header and footer. A JPEG starts with the byte sequence FF D8 FF and ends with FF D9. A PNG opens with a fixed eight-byte signature. A PDF begins with the string %PDF- and closes with %%EOF. A tool that knows these patterns can reconstruct the file between them, even if every trace of the filename, the folder, and the modification date is gone.
For a hard drive that has had a single full-disk overwrite, this approach finds nothing. The bytes are zeros, and the file headers are not there to find. For an SSD that has run its own erase command, the same is true. For an SSD without TRIM, or an SSD that has copies stranded in flash pages the host cannot see, the picture is different, which is why the four-step checklist sends SSDs to the manufacturer’s secure-erase tool instead of relying on a software overwrite.
How long a deleted file survives is not really a matter of weeks or months on the clock. It is a matter of how much the drive has been written to since. A drive that sat in a drawer will still hold the data. A drive used heavily for video editing will overwrite it in hours. The “weeks or months” figure quoted in consumer coverage is a rough estimate for a typical desktop with light day-to-day use, and it is wrong for any drive that has been written heavily.
The five-minute audit before you ship
The four-step checklist is the action. The five-minute audit is the part that catches the cases the checklist misses.
- Check the drive type first.
lsblkon Linux, Disk Management on Windows, “About This Mac > Storage” on macOS. Solid-state drives need the secure-erase path, not the zero-fill path. - Check the encryption history. If the drive was encrypted from the start, the key-destruction path is enough. If you turned on BitLocker last week, the data that was written before you turned it on is still in plaintext on the disk.
- Check the secondary drives. Most laptops have one drive, but desktops often have two, and external backup drives are easy to forget. Pull every drive before you ship the box.
- Check the cloud accounts. A full-disk wipe does not log you out of Google Drive, Dropbox, OneDrive, or iCloud. Those accounts hold another copy of the file. Sign out, or change the password, or both.
- Check the TPM and the firmware. A factory reset on a laptop with a TPM chip (a hardware security module that holds the encryption keys for the rest of the system) may not clear the TPM by default. The new owner cannot read the encrypted disk, but they can also not reinstall the OS cleanly. Clear the TPM if you want a clean handoff.
If any of those checks come up wrong, the four-step checklist is the wrong starting point. The right starting point is the manual for the specific drive and the specific operating system.
Trade-offs
The cost of being thorough now is a few minutes. The cost of skipping it is on a different scale.
- Drive type matters more than effort. A zero-fill on an SSD is not the same as a zero-fill on a hard drive. The SSD controller can keep old copies in flash pages the host cannot see. Match the path to the drive, not the other way around.
- Encryption in place from the start is the cheapest option. If you turned it on last week, the data written before that is still plaintext. If you turned it on the day the laptop shipped, you are golden.
- Software overwrites are not enough for SSDs. The drive’s own secure-erase command is. Manufacturers ship the tools for free. The cost of using them is the cost of downloading a file the size of a photo.
- Physical destruction is the only method that cannot be second-guessed. A drill through the platters, or a hammer through the NAND package, costs less than a data breach. There is no firmware update that can recover from a hammer.
- The cloud is a separate drive. Full-disk wipe does not log you out of Google Drive, Dropbox, OneDrive, or iCloud. Treat cloud accounts as a parallel risk surface and clean them too.
Bottom line
Empty the bin and sell the laptop is not a wipe. It is a signpost removal. The bytes are still on the drive. A recovery tool will find them. The four-step checklist in this article is the minimum amount of work that gets a hard drive, an SSD, or an encrypted drive into a state where the new owner cannot read what was on it before. Do that work before you ship the box. The new owner will not tell you what they find, and the news will not either.