Before retiring an external drive or USB device, inventory it, copy the records you still need, and prove the backup opens. Then choose a sanitization method that fits the media type, sensitivity, future use, and manufacturer support. Deleting files or quick-formatting a volume is not a complete retirement plan; verify the sanitization result and use an appropriate recycler or destruction service.
Identify the device and its obligations
Record the device type, manufacturer, model, serial number, capacity, owner, encryption status, connection type, physical condition, and current location. Note whether it is a hard disk, solid-state drive, flash drive, memory card, optical disc, or an enclosure containing another device. Media type matters because supported erase commands and physical behavior differ.
List the information that may be present and why it was retained. Separate ordinary replaceable files from personal, financial, health, customer, employment, tax, legal, or regulated records. Check active retention rules, litigation holds, warranties, organizational policies, and contracts before destruction. When a legal or regulatory duty is unclear, pause for the responsible professional rather than guessing.
NIST defines media sanitization as making access to target data infeasible for a chosen level of effort. Its current Guidelines for Media Sanitization organizes decisions around the information, media, risk, and available sanitization methods. That is more reliable than applying one generic erase instruction to every drive.
Back up and verify what must survive
Create a manifest of folders, applications, licenses, encryption keys, and archives that need to move. Copy them to the approved destination without deleting the source. Verify the transfer by opening representative documents, photos, videos, archives, and specialized files. Compare counts and sizes where useful, and use checksums when the process already supports them.
Test recovery from the backup, not merely browsing. An encrypted archive without its key, a proprietary backup without compatible software, or a cloud folder that has not finished syncing can look complete while remaining unusable. Record the destination, verification date, verifier, and any exclusions.
The FTC's computer disposal guidance recommends backing up important information before erasing a drive and then disposing of the device safely. The same sequence applies to standalone storage: preserve, verify, sanitize, and release.
Select the correct sanitization path
Decide whether the media will be reused internally, transferred outside your control, recycled, returned under warranty, or destroyed. Use the manufacturer's supported secure-erase or sanitize function when it matches the drive and your risk. For encrypted media, cryptographic erase can be appropriate only when encryption and key handling meet the required conditions. For damaged or unsupported media, qualified physical destruction may be the safer route.
NIST distinguishes clearing, purging, and destruction and requires method selection based on the media and protection need. A technique that works for a magnetic disk may not be suitable for flash storage. Do not improvise with magnets, drills, fire, or household shredders. Those methods can fail to address all storage components and can create injury, fire, toxic-material, or equipment hazards. Use an authorized service for physical destruction.
If the drive will remain in the household, a supported erase followed by reinitialization may be sufficient for the chosen risk. If it held highly sensitive or regulated data and will leave controlled custody, follow the applicable organizational or professional sanitization standard. Preserve the sanitization certificate when a service provides one.
Verify before the device leaves custody
Confirm that the tool completed without error and that the expected partitions or data are no longer accessible through ordinary inspection. Verification requirements depend on the method and policy. Record the tool or service, method, operator, date, device identifier, result, and any error. Keep the record free of copied sensitive contents.
Remove the drive from backup software, device inventories, shared folders, encryption-key lists, and auto-mount workflows. Revoke any vendor account or remote-management association tied to the enclosure or storage service. Remove labels that expose names, addresses, asset details, or recovery clues, while retaining identifiers needed for the disposal record.
Recycle or transfer responsibly
Use a manufacturer take-back program, reputable electronics recycler, organizational disposal vendor, or other approved channel. The FTC notes that computers contain materials that do not belong in a landfill and points consumers toward electronics donation and recycling information. Check local requirements for standalone drives and batteries in enclosures.
For a transfer, document the recipient and date only after sanitization is verified. For destruction, obtain evidence appropriate to the sensitivity and policy. Keep the verified backup until the new storage has operated successfully through a normal review period.
A completed retirement record should show custody, media type, data classification, retention decision, backup verification, sanitization method, verification result, destination, and approver. That record proves the device was retired deliberately instead of simply disappearing from a desk drawer.
Sources
- Guidelines for Media Sanitization — National Institute of Standards and Technology
- How To Remove Your Personal Information Before You Get Rid of Your Computer — Federal Trade Commission
- Guidelines for Media Sanitization publication page — National Institute of Standards and Technology