They Sound Similar, but They’re Very Different
When it’s time to get rid of an old device, most people know they should “wipe” it first. But there’s a crucial difference between a factory reset and a secure wipe, and confusing the two can leave your personal or business data vulnerable to recovery. Understanding what each process actually does to your data helps you choose the right method for your situation.
What a Factory Reset Does
A factory reset restores a device to its original out-of-the-box state. It removes your user accounts, installed applications, settings, and files, making the device look and feel like it did when it was brand new. On the surface, it appears that all your data is gone.
But here’s the important part: a basic factory reset doesn’t necessarily erase your actual data from the storage drive. What it typically does is remove the file system index, the “table of contents” that tells the device where files are stored. The files themselves, your photos, documents, emails, and everything else, often remain physically present on the storage medium. They’re just no longer visible to the operating system.
Think of it like removing a book’s table of contents and index. The chapters are still there, just harder to find. With the right data recovery software, which is freely available online, someone with moderate technical knowledge can reconstruct deleted files from a factory-reset device.
What a Secure Wipe Does
A secure wipe (also called data sanitisation or secure erase) goes further. Rather than just removing the file index, it ensures the underlying data is either overwritten with random patterns or cryptographically erased so that the original content cannot be recovered, even with specialised forensic tools.
There are several approaches to secure wiping:
Overwriting replaces every bit of data on the storage medium with zeros, ones, or random patterns. For traditional hard drives (HDDs) with spinning platters, one or more overwrite passes across the entire drive surface effectively destroys the original data. The NIST 800-88 “Clear” method specifies a single-pass overwrite as sufficient for most purposes.
Cryptographic erasure is the preferred method for SSDs and modern encrypted devices. Rather than overwriting every storage cell (which is complicated on SSDs due to wear levelling and over-provisioning), the process destroys the encryption keys that protect the data. Without the keys, the encrypted data on the drive is essentially random noise. This is fast and effective.
ATA Secure Erase is a built-in command in most SSDs and hard drives that triggers the drive’s internal sanitisation routine. For SSDs, this typically performs a cryptographic erase. For HDDs, it performs a full overwrite. This is generally the most reliable method because it’s handled by the drive’s own firmware, which has full access to all storage areas including those not visible to the operating system.
When Each Method Is Appropriate
Factory reset is sufficient when:
The device has hardware encryption enabled (which is the default on most modern smartphones and many laptops with SSDs). In this case, the factory reset destroys encryption keys, providing effective data protection. You’re passing the device to someone you trust, like a family member. The device never contained genuinely sensitive information.
Secure wipe is necessary when:
The device stored business data, customer information, financial records, or other sensitive content. You’re selling or donating the device to someone unknown. The device used an unencrypted hard drive (common in older computers). Your organisation has compliance obligations requiring certified data destruction. You’re in a regulated industry (healthcare, finance, legal, government) where data handling standards apply.
The Encryption Factor
Device encryption changes the equation significantly. On an encrypted device, a factory reset that properly destroys the encryption keys provides security comparable to a dedicated secure wipe for most threat scenarios. This is why modern iPhones can be “erased” in minutes rather than hours, the erase function destroys the keys rather than overwriting all storage.
However, for organisations with high security requirements or regulatory obligations, relying on encryption-based erasure alone may not be sufficient. Some compliance frameworks require documented evidence of data sanitisation using specific standards, regardless of whether encryption was enabled. In these cases, a formal secure wipe using certified tools provides both the data destruction and the documentation trail needed for compliance.
How to Perform a Secure Wipe
For personal devices: If your device has encryption enabled (check your settings), a factory reset provides reasonable security for most personal use cases. If you want additional assurance, particularly for computers with traditional hard drives, free tools like DBAN (Darik’s Boot and Nuke) can perform overwrite-based secure erasure.
For business devices: Use professional data sanitisation software that provides certificates of destruction for each device. These tools follow recognised standards like NIST 800-88 and generate audit-ready documentation including device serial numbers, sanitisation method, date and time, and verification results.
For devices that won’t power on: If a device is damaged and can’t be turned on, software-based wiping isn’t possible. In this case, physical destruction of the storage drive is the only option for ensuring data security. For hard drives, this means shredding or degaussing. For SSDs, physical shredding is the standard approach.
The Bottom Line
For everyday personal devices with modern encryption, a factory reset provides good data protection. For business devices, regulated industries, or situations where you need documented proof of data destruction, a proper secure wipe using professional tools is the appropriate choice. When in doubt, err on the side of more thorough erasure. The extra time invested in a secure wipe is negligible compared to the potential consequences of data exposure from an inadequately erased device.
EWV helps Victorian businesses manage e-waste and IT asset disposal compliantly and sustainably — including collection, certified data destruction, and recycling. Contact us for a free quote.