Retire a USB drive only after identifying its owner and data, verifying every needed copy, selecting a sanitization method that matches the information risk and device capability, checking the result, and documenting reuse, destruction, or recycling. Deleting files or emptying the recycle bin is not a verified retirement process.
Inventory the device and its data
Record the drive manufacturer, model, capacity, serial number when available, asset tag, owner, custodian, encryption status, purchase or issue date, and current condition. Give the device a temporary identifier that follows it through the process. Do not plug an unknown drive into a trusted computer merely to identify it; use the organization's approved removable-media handling procedure.
Classify the information that may be present, including deleted or hidden material. Check whether the device held personal records, customer data, credentials, recovery keys, source code, financial files, health information, licensed media, or regulated information. The highest plausible sensitivity should guide the sanitization decision when the contents are uncertain.
Copy and verify anything that must remain
Identify the authoritative destination for retained files. Copy only material that is authorized and scan it according to the normal security process. Preserve filenames, dates, folder structure, and checksums when those details matter. Open representative files from the destination and compare counts or hashes before changing the source drive.
Record who approved the retention, where the new copy is stored, the verification date, and any file that could not be read. A successful copy does not authorize keeping unnecessary duplicates. Apply the destination's retention and access rules.
Select a risk-based sanitization method
NIST SP 800-88 Revision 2 defines media sanitization as making access to target data infeasible for a given level of effort and guides programs toward methods and controls based on information sensitivity. Use the current NIST publication, organizational policy, device-manufacturer instructions, and applicable legal requirements rather than a generic internet command.
Determine whether the drive supports an approved clear, purge, cryptographic erase, or destruction method and whether that method reaches the device's actual storage. Flash translation, wear leveling, controller behavior, hidden areas, damage, and unsupported interfaces can affect what software can verify. If the required assurance cannot be achieved, escalate to approved physical destruction rather than declaring success.
Do not improvise destruction with fire, household tools, or unsafe handling. Use trained personnel and equipment appropriate to the media. Maintain custody when the drive contains sensitive information, and require a certificate or record when a service provider performs sanitization or destruction.
Validate and document the result
Verification should be defined before the method runs. Record the tool and version, operator, date, device identifier, chosen method, completion status, errors, and validation result. Sample the device or use the approved automated verification required by policy. A progress bar reaching the end is evidence from the tool, not independent proof that every relevant area was addressed.
Mark failed or uncertain media and keep it in controlled storage until it can be destroyed. Do not return a questionable drive to service, donate it, or place it in ordinary waste. Preserve the disposition record without copying the drive's sensitive contents into the record.
Reuse, donate, or recycle responsibly
After successful sanitization, decide whether the drive is reliable enough for internal reuse. Test capacity and read-write operation with non-sensitive data, relabel ownership, and record the new assignment. For donation, confirm that organizational policy allows it and that no license or asset restriction remains.
For recycling, use a local electronics program that accepts removable storage. The US Environmental Protection Agency's certified recycler guidance describes R2 and e-Stewards certification programs and recommends certified electronics recyclers for unwanted equipment. Confirm acceptance and downstream handling rather than placing electronics in curbside recycling.
Close the record with the final state, recipient or recycler, transfer date, certificate number when applicable, and approving person. The device should no longer appear as active inventory, and the verified retained copy should remain accessible to its authorized owner.
Sources
- SP 800-88 Revision 2 Guidelines for Media Sanitization — National Institute of Standards and Technology, Sept. 26, 2025
- Certified Electronics Recyclers — United States Environmental Protection Agency