Guides → Data & destruction

Why deleting files, formatting and factory resets don't erase your data

25 September 2026 · 5 min read

Almost everyone who has retired a computer has done at least one of these: dragged files to the bin, formatted the drive, or pressed "reset this PC". Each feels final, and none of them removes the data in a way anyone could prove.

What "delete" actually does

A drive is like a book with an index at the front. When you delete a file, the operating system crosses out the index entry and marks the pages it pointed to as available for reuse. The pages themselves aren't touched. Until something new happens to be written over them, the original content is still there.

Emptying the recycle bin doesn't change that. It just removes the last easy way back. Free recovery tools such as PhotoRec and Recuva exist precisely to read those "available" pages and rebuild files from them, and they need no special skill to use.

Formatting: quick and full are very different

A quick format rebuilds the index and leaves everything else alone. It's the delete button applied to the whole drive, and recovery tools handle it easily.

A full format in Windows (since Windows Vista) goes further on a conventional hard drive: it writes zeros across the addressable space. That's a genuine overwrite, and it's much better than a quick format. But it falls short in three ways that matter for business disposal:

• It produces no report. You can't show an auditor which drive was done, when, or whether it completed.
• It only reaches addressable sectors. Sectors the drive has retired as faulty, which may still hold old data, are never touched.
• On an SSD it doesn't do what it appears to, for reasons covered below.

Factory resets

Resetting a PC reinstalls the operating system. Windows offers a "clean the drive" option that also overwrites data, but, as with a full format, there's no verification and no record, and how well it works depends on the type of drive.

Phones are the notable exception, and they explain the rule. Modern iPhones and Android phones encrypt their storage by default. A factory reset throws away the encryption key, which leaves the remaining data unreadable. That's a real sanitisation technique called cryptographic erase, and it's why a reset phone is in a far better state than a reset PC. Even so, it's only as good as the device's implementation, and it leaves no evidence behind. We cover it properly in is drive encryption enough?

Why SSDs break the usual intuition

On a hard drive, data lives at a fixed physical location, so overwriting that location replaces it. SSDs don't work like that. The controller inside the drive constantly moves data around to spread wear evenly across the flash cells, which is called wear levelling. When you "overwrite" a file, the controller usually writes the new data somewhere else and marks the old copy as stale. The stale copy stays in the flash until the drive gets round to erasing it.

Two other SSD features make this worse:

• Over-provisioning. A slice of the flash, often several per cent, is reserved and invisible to the computer. Software overwrites can't reach it, but old data can end up there.
• TRIM and garbage collection. TRIM tells the drive which blocks are no longer in use, and the drive erases them in the background when it chooses. That often makes casual recovery harder, but you have no control over when it happens and no way to confirm it did.

The result is that "I overwrote it" means something quite different on an SSD. If an attacker removes the flash chips and reads them directly, known as chip-off recovery, they can find data the operating system thought was long gone.

What does work

Firmware sanitise commands (ATA Sanitize and Secure Erase, NVMe Sanitize and Format) tell the SSD's own controller to erase every cell, including the hidden areas. Done with proper tooling that verifies the result and logs the serial number, this is how an SSD can be reused safely. When a drive is at end of life, faulty, or simply not worth the effort, physical destruction is the answer. For the full comparison, see degaussing, shredding or wiping.

What to do with drives you've already "wiped"

If you have a cupboard of machines that were formatted or reset in-house, treat them as though they still hold everything. That isn't a criticism of whoever did it. It's simply the safe assumption when there's no record. Sanitise or destroy them properly, and put the serial numbers on a certificate so the question is closed for good.