The other side of our business: intentionally destroying the data, and providing proof. When you delete or format, all data remains (this entire website is an example); therefore, once drives leave your care, "we wiped them" has to mean a verified process with a certificate per serial number, and not just a recycle bin and hope.
Every item we celebrate on our recovery pages is a potential risk for you when disposing of them: fast format solutions that do not wipe out data; files you have deleted but which still remain available to be recovered; hard drives (and other storage devices) from "recycled" office clear-outs that arrive at benches like ours with all accounts and data intact. GDPR and the ICO also share this viewpoint: the personal information contained within disposed of media will always be considered your breach. Process-based proper destruction will close that gap and create an environment that does not rely on optimism.
The best approach will be determined by your media and whether you wish to reuse it, and therefore require verified destruction of your data, or whether you are disposing of your media at the end of life, in which case you simply need your media to cease being able to be read.
For hard drives going to reuse/resale: full verified overwrite to recognised standards, every sector written & read back, failed devices sent to physical destruction. For SSDs (overwrites are not reliable), wear-levelling hides sectors from software; therefore the route can only be firmware secure-erase / crypto-wipe. Each is verified. Any resistant SSDs go to destruction. For end-of-life media: physical destruction of all platters & chips, with serial numbers recorded prior to destruction.
Mixed batches (i.e. you've got a mix) are normal: an entire decommission's worth of disks sorted by unit into the correct method; one manifest covers all.
Each project is documented by a destruction certificate listing serial numbers of items, the methods used on them, whether they were verified, the date, and who was responsible for performing the destruction (the documentation that your auditor, DPO or clients' due diligence will request). Chain of custody documents the handoff and completion of destruction of data. A drive may be physically destroyed and then the drive itself may be returned if this is in compliance with your company's policies regarding destruction of media (i.e., the body of a hard-drive). Whether you send drives on an ad hoc basis (one drive at a time) or as one office-wide decommission, we apply the same standards to create similar paperwork.
A quote based on the batch as a whole (from a single drive to a decommission's worth) will include the method we will use for each type of media we have to deal with, and that price includes a certificate. We start every project with a free diagnostic, we send you a written quote prior to starting work on the project, and on most projects, if we can't recover your data, you owe us nothing. There are no hourly meters, evaluation fees or percentages of the value of your files.
Formatting alone is not enough: it allows recovery with all the same tools described on the rest of this site in addition to creating an additional regulatory issue as disposal of media is still a part of your responsibility under GDPR. Remove the drives (or send the machines and we can pull the drives), then we perform verified erasure on anything that will be used again in addition to destroying physically those items no longer needed. The certificate is what makes it defensible.
All SSDs mislead software in their basic operation: They implement both wear levelling and over provisioning of space on an SSD which means that there are always areas on each SSD which cannot be reached with any "wipe" pass. Therefore, you may still find residual data after a full wipe. Your best bet is to use the drive's firmware for a secure erase or crypto-erase and then verify its successful execution. Where verification fails or this method does not provide you with the certainty you need, you will have to physically destroy the SSD.
Yes, "destruction & return" is a normal request. The serial number of each item will be recorded. Each item will have its data made inaccessible. The returned items will be provided to you with documentation (certificate) that proves the product has been destroyed and can be used by your company for an asset register. Some compliance regimes want the remains; some want proof they are gone. We accommodate either.
We will accept individual drives: the old laptop to be sold off, the failed drive replaced by an insurance company, the "just make sure" disk from a house move. The same process as our multi-drive verified process, same certificate, but at a lower price due to reduced quantity. After you receive a quote from us on this service (destruction), simply bring it to Tay House, or post it to us like any other job. Clearly mark it for destruction.
Before you drop your device off or post it, please get a quote from us by phone or using the form first. Then there are two honest routes for dropping off and delivery. No vans. Hand in the device at Tay House, 300 Bath Street (right at Charing Cross, two minutes off the M8) Monday to Friday, 9am–5:30pm, without need of an appointment. Or wrap the device well and send by insured, tracked post from anywhere in the UK. All work is done in-house by our own engineers. We have documentation of the complete chain of custody and your data never leaves the UK.
The truth varies between a hard drive and a solid state drive, which is why there is a need for certified erasure. Read it →
Verified wiped (i.e. completely removed) to use again, or destroyed physically (for disposal); we give you the appropriate certificate either way. Certified data destruction for Glasgow: from individual drives to complete system decommissioning with the documentation to prove it.