Wiping a Drive Isn't Enough (and Sometimes It's a Lie)

“We wiped it.” Three words, and most companies just accept them.

No serial number attached to the claim. No record of which standard was used, or whether the wipe was verified afterward. No way to check, six months later, whether the drive that supposedly got wiped was actually wiped — or just deleted, or reformatted, or never touched at all before it was resold to whoever bought the pallet.

That trust gap is the quiet failure point of a lot of IT asset disposition. Not malice, necessarily — but an industry where “wiped” is treated as a status update instead of a claim that needs proof.

What “wiped” is actually supposed to mean

A real data wipe overwrites every addressable sector of a drive according to a documented standard — aligned to NAID AAA / i-SIGMA specifications — and then verifies the result: a read-back pass confirming the overwrite actually took, not just that a tool reported success. That verification gets logged per drive, by serial number, with a timestamp and an operator of record.

Miss any one of those pieces — the standard, the verification, the per-serial log — and what you have isn’t a wipe. It’s a claim.

Where the claim quietly falls apart

A few ways “wiped” ends up meaning less than it sounds like:

• The job started but didn’t finish. Wipe software can be interrupted — power loss, a dropped connection, a rushed batch job — and still report the drive as processed if nobody checks the actual output.
• The tool ran, but nobody verified it. Running a wipe utility isn’t the same as confirming it worked. Without a read-back pass, “the software says it’s done” is the only evidence anyone has.
• There’s no record tied to the serial number. If a vendor can’t hand you a document showing which drive, wiped when, verified how, then “wiped” is a batch-level assumption applied to every drive in the shipment — not a per-asset fact.
• The standard was never named. “We wipe every drive” is not the same sentence as “we wipe every drive to NAID AAA / i-SIGMA specifications, verified and logged.” One is a policy. The other is marketing.

None of this requires a dishonest vendor. A disposal company under price pressure, running high volume with low margins, has every incentive to skip the verification step that costs time and adds nothing to a quote — especially when the customer isn’t asking for proof.

Why this becomes your problem, not theirs

If a drive leaves your custody with a vendor’s spoken assurance that it was wiped, and that drive later turns up with recoverable data, the paper trail — or lack of one — points back to you. An auditor doesn’t accept “the vendor told us it was handled.” Frameworks like HIPAA, SOX, and GLBA ask for documentation you can produce on demand, tied to the specific asset in question. “They said they wiped it” isn’t documentation. It’s hearsay with an invoice number.

This is the same trap as a factory reset, just one layer removed: a plausible-sounding claim of destruction standing in for actual proof. We wrote about the device-level version of this in Your Old Laptop Knows Where You Live — the vendor-level version is worse, because you often can’t even inspect the drive yourself once it’s in someone else’s facility.

What to ask for instead of taking the claim on faith

Before you trust a “wiped” claim from any ITAD vendor, ask for:

1. The standard. Which sanitization standard governs the wipe, by name.
2. Verification, not just execution. Proof the overwrite was confirmed, not just attempted.
3. A serial-level record. A document that ties the wipe to the specific drive’s serial number, not a batch-level attestation.
4. Retention. How long the vendor keeps that record, and whether you can request it later.

If a vendor can’t answer all four without hesitation, “we wiped it” is a sentence, not a service.

How TRACE handles it

Every drive we process is wiped and verified — read-back confirmed, not just attempted — aligned to NAID AAA / i-SIGMA specifications, with a per-serial record retained for seven years. You can see exactly what that looks like in the live trace below: every asset moves through Received → Verified → Wiped with a timestamp and operator logged at each step, not a batch-level assurance. Schedule a free pickup and get proof instead of a claim.