.png)
What to Do with Old Computers Before You Sell or Recycle Them
Article Summary: Before selling, donating, or recycling a work computer, keep usable copies of the records you need and arrange secure erasure or destruction of its storage. Include every drive, coordinate account and device-management changes with IT, and keep the equipment secure until the work is complete. Disposal records should show what happened to each computer and drive.
If an employee asks to take home a laptop your business has replaced, you might be happy to say yes. It still works, and you’d rather someone used it than leave it sitting in a cupboard.
But what’s still saved on it? If the laptop belonged to someone in accounts, it could still contain old payroll spreadsheets alongside files you've already moved to the new computer.
Backups and business records
Suppose your business changed accounting software a few years ago. An old database may still be on one of the computers you’re replacing, so you copy it across with the other files.
A few months later, you need a customer’s old record. You find the database, but the new computer can’t open it because it doesn’t have the software it needs.
You’d rather find that out while the old computer is still available. Then IT can check the software you need, or find another way to keep the records usable, before erasing the drive.
That’s why opening the files you’ve copied is worth doing before the computer goes. Everyone being able to carry on with their daily work doesn’t necessarily tell you whether those older records are usable too.
Deleted files and drive erasure
Once you’ve checked the copies you’re keeping, IT can prepare the old computer for handover. That includes dealing with information left by earlier deletions, as well as files still on the computer.
On a mechanical hard drive, deleting a file normally makes its space available for reuse. The contents can remain there until that space is overwritten. The NCSC’s device-erasure guidance explains why deleted information can still be recoverable.
Drive types and encryption
Solid-state drives, or SSDs, have a controller that manages where information is stored in their memory chips. When the drive reorganizes data, it can copy information to a different location before erasing the old block. Kingston describes this process in its explanation of SSD garbage collection.
SSDs also keep spare storage areas. Overwriting the files you can access won’t necessarily reach every place the drive has stored data, so IT needs to account for those areas when choosing and verifying an erasure method for the drive.
IT also needs to check how many drives are inside the computer. A second drive could contain files and software from an earlier user, even if the current employee never opened them.
On an encrypted drive, IT may be able to use cryptographic erase to securely erase the keys needed to read the information. It depends on the encryption used and on how all relevant copies of those keys are handled. The NIST guidance explains those conditions.
Your provider also needs to know whether sensitive information was ever stored without encryption. Any unencrypted copies still on the drive will need a different erasure method.
Windows and Mac reset options
In Windows, “Remove everything” removes files, apps, and settings. Turning on the additional “Clean data” option also cleans the drive to make deleted files harder to recover.
Microsoft says this data-erasure feature is aimed at consumers and doesn’t meet government and industry data-erasure standards. IT should choose an erasure process that meets your business’s requirements.
“Keep my files” preserves the user’s documents, so it leaves work records you may need to remove before handover.
“Erase All Content and Settings” requires Apple silicon or the Apple T2 Security Chip, with macOS Monterey 12 or later. Other Macs have a different preparation process, so the model and operating system determine which instructions to follow.
Accounts and device management
Your provider can use software such as Microsoft Intune to manage work computers remotely.
In Intune, “Retire” removes managed company data and settings while leaving personal data in place. Retire is not a full-device wipe.
A “Completed” status for Delete confirms that the action finished in Microsoft’s management service. IT still needs to check what the computer itself has done and whether separate drive erasure is required. Plan those steps before disconnecting the computer from its management service.
On a Mac with Activation Lock enabled, the lock needs to be removed before a new owner can activate and use it. Apple’s Erase Assistant signs out of Apple services and turns off Activation Lock on supported Macs.
Protect the email account used for recovery
Your recovery email can be just as important as the social media password.
If an attacker gets into that mailbox, they may be able to reset the social media password, approve security changes, and intercept platform warnings. They may then change the recovery details, making it harder for you to regain access.
Cyber.gov.au specifically recommends protecting the email address linked to a social media account with MFA.
The mailbox should have a unique password, MFA, and a current recovery method. If you suspect either the email or social media account has been compromised, your IT provider should also check for unexpected forwarding rules, unfamiliar sign-ins, and changes to recovery details.
Failed computers and drive destruction
A failed power supply can stop a computer from starting while leaving its drive intact. IT may still be able to erase the drive, even though the computer no longer works. If the storage itself has failed and erasure can’t be completed or verified, IT may need to destroy it instead.
Where the design allows it, IT can remove the storage and keep it secure for later erasure or destruction. Before passing on the rest of the computer, they’ll need to check that no other storage holding business information remains inside.
A hole drilled through a drive can leave other data-storing parts intact, which is why NIST warns that drilling, bending, and other partial damage can leave information recoverable. Your provider can arrange a destruction method suited to the storage and the information it held. Until that happens, the equipment still needs secure storage.
Recycling and disposal records
When you book a collection, find out where the computers will go and who will erase or destroy their drives. If the recycler passes them to another company for that work, ask how that company will handle and protect the equipment, too.
IMAGE SOURCE: https://www.pexels.com/photo/electronic-trash-9953442/
Computers being collected before erasure still hold business data, so they need secure storage before collection. The recycler should explain how it will protect them during transport and while they wait to be processed. Your provider can help check those arrangements, the recycler’s credentials, and any local requirements for business electronics.
If a drive fails during erasure, you’ll want to know which drive it was and what happened to it next. The disposal record should identify it by serial number and show whether you erased it using another suitable method, kept it secure for further work, or destroyed it.
For the full batch, the records should include each computer and drive, the erasure or destruction method, who performed the work, the date, and the verification result. NIST provides a sanitization certificate format for recording this information.
Keep the records with your equipment register and update it with the final destinations. You can then look up the erasure details using the computer or drive’s serial number.
Frequently Asked Questions
Do computers used only for cloud software still need to be erased?
Yes. Browsers can store cookies, saved passwords, and cached page content locally. Documents downloaded from cloud services can also remain on the computer.
Does every old drive have to be destroyed?
No. Suitable, verified erasure can allow storage to be reused. Destruction can be necessary when erasure can’t be completed or verified, or when your business’s requirements call for it.
How long should we keep the business records from an old computer?
That depends on the records and the requirements that apply to your business. Confirm what you need to retain for legal or contractual reasons, and keep usable copies somewhere secure before you erase the old storage.
And if you don’t have an IT provider, you can always reach out to us, and we’ll help you out.
Sources and Further Reading
—
Comments