Handling and wiping drives in refurbished machines

Assume every drive holds data

Every drive that arrives in a used machine should be treated as if it still holds the previous owner's files, whatever the paperwork says. Most lots of business laptops are wiped before resale, but a single missed unit carrying a company's email cache or a payroll export is a serious problem for whoever passes it on, and refurbishers are part of that chain.

Good practice comes down to knowing where every drive is, erasing it with a method that suits the type of drive, checking the result and keeping a record.

Intake and handling on the bench

Log drives as they come in. Note the machine each one arrived in and the drive's own serial number, which is printed on its label and readable in most diagnostic tools. If drives are taken out of their machines, tag them so the link is not lost.

Keep drives that have not been erased physically apart from finished stock. A clearly marked shelf, tray or locked box for drives waiting to be wiped stops one ending up in a finished machine by mistake. Only move a drive across once it has been erased and checked.

Handle SSDs as electronic components. Hold M.2 boards by the edges, avoid touching the gold contacts, store them in antistatic bags or trays, and ground yourself on an ESD mat or strap. Hard drives need care of a different kind: they do not like being dropped or knocked, least of all while running.

Why SSDs need a different method

The familiar advice to overwrite a drive several times comes from hard drives, where data sits at a fixed place on the platter. SSDs work differently. Their controller spreads writes across the flash to even out wear, keeps spare blocks the operating system never sees, and moves data around on its own. Writing zeros over the visible capacity of an SSD does not guarantee every cell has been cleared, and repeated passes add wear without adding certainty.

The better route for an SSD is to have the drive erase itself. SATA drives support a Secure Erase command, and NVMe drives support Format and Sanitize commands. These act on the whole of the flash, including areas the operating system cannot reach. On self-encrypting drives, a cryptographic erase replaces the internal encryption key, which leaves the old data unreadable in seconds.

Practical ways to run an erase

Many business laptops from the major makers include a drive erase option in the firmware setup screen, often under a maintenance or security menu. The name varies by maker and generation, but where it exists it is usually the simplest choice, because it runs before any operating system loads and uses the drive's own commands.

For drives outside their original machine, or batches on a test bench, bootable erase tools and the drive makers' own utilities can issue the same commands. A common snag with SATA drives is the frozen state: many machines lock a drive's security features at boot, and the erase command is refused until the drive is unfrozen, often by a sleep and wake cycle or by connecting the drive after the machine has started. NVMe drives do not use the same lock.

BitLocker or another full-disk encryption on an incoming drive helps, but it does not replace erasing. The drive should still go back to a clean state before it goes into a resale machine.

Check drive health before resale

While the drive is on the bench, read its SMART data. On SSDs, look at the percentage of rated life used, the available spare blocks, any media or integrity errors, and the power-on hours. On hard drives, reallocated and pending sectors are the figures that matter. A drive with logged errors is likely to come back as a return, so pull it rather than sell it.

Record the health figures alongside the serial number. If you sell machines with detailed descriptions, drive health is a fair thing to state, and it leaves you with an answer ready when a buyer asks.

Verify, record and deal with failures

After an erase, confirm the result. The drive should show no partitions, and a quick look at a few sectors with a disk viewer should show blank data. Spot checking a sample from every batch catches a misconfigured tool before it affects hundreds of units.

Keep a simple record for each drive: serial number, machine, date, method, result and who did the work. If your own customers ask for erasure certificates, choose a tool that produces them, but the record is worth keeping either way.

Drives that will not erase, will not identify or fail part way through should never be sold. Set them aside for physical destruction. For SSDs that means destroying the flash chips themselves, not just the connector or the controller, because the data lives in the memory packages spread across the board.