Short answer: deleting files and emptying the trash leaves the data on the drive, recoverable with free software. Before a computer or phone leaves your possession, either run the built-in full wipe (Windows “Reset this PC” with “Remove everything” and “Clean data”; macOS “Erase All Content and Settings”; iPhone and Android factory reset, which on modern devices destroys the encryption key), or, for a business machine that held customer data, remove the drive and physically destroy it. Keep a record of what was wiped and when.
First published in 2016, rewritten October 2026 with the current wipe procedures and Maine-specific guidance.
| Key facts | |
|---|---|
| What “delete” does | Removes the file’s entry from the index; the data stays until overwritten |
| Standard for sanitizing media | NIST SP 800-88 Rev. 1: Clear, Purge, or Destroy |
| Windows | Settings, System, Recovery, Reset this PC, Remove everything, then choose “Clean data” |
| Mac | System Settings, General, Transfer or Reset, Erase All Content and Settings |
| iPhone / Android | Factory reset; encryption is on by default, so the reset discards the key |
| Business drives with customer data | Wipe, then physically destroy the drive or use a vendor that issues a certificate of destruction |
Why doesn’t deleting a file remove it?
A drive stores files like a library stores books: there is an index that says where each one is. Deleting removes the index card; the book stays on the shelf until something else is written over it. Free recovery tools read the shelves directly. That is also why “I formatted it” is not enough on older drives: a quick format only rebuilds the index.
What does the standard say?
The National Institute of Standards and Technology’s Special Publication 800-88, Guidelines for Media Sanitization, defines three levels:
- Clear: overwrite the data with the device’s own tools. Protects against ordinary recovery software. Fine for a personal laptop going to a family member.
- Purge: a cryptographic erase (destroying the encryption key on an encrypted drive) or a firmware secure-erase command. Protects against laboratory recovery. The right level for any business device.
- Destroy: shred, pulverize or degauss the drive. For drives that held regulated data (health, financial, legal) or drives that no longer work and cannot be purged.
How do I wipe each kind of device?
Windows 10 or 11 PC: back up anything you need, sign out of Microsoft, Office and any licensed software, then Settings, System, Recovery, Reset this PC, Remove everything. On the next screen choose “Clean data” (it says it takes longer; that is the overwrite). If BitLocker was on, the reset also discards the key.
Mac: sign out of iCloud and Find My, then System Settings, General, Transfer or Reset, Erase All Content and Settings. Macs with Apple silicon or a T2 chip are encrypted by default, so this is a cryptographic erase.
iPhone / iPad: Settings, General, Transfer or Reset, Erase All Content and Settings, and turn off Find My when prompted so the next owner can activate it.
Android: remove the Google account first (so Factory Reset Protection does not lock the next owner out), then Settings, System, Reset, Erase all data.
Servers, NAS boxes, copiers and printers: these are the ones businesses forget. A copier’s hard drive stores images of what it scanned. Ask the vendor for the data-wipe procedure before the lease return.
What does a Maine business have to do?
If the device held personal information about Maine residents (names with Social Security, licence, account or card numbers), Maine’s breach law (10 M.R.S. §1348) treats unauthorized acquisition of that data as a breach that can require notifying the people affected and the Attorney General within 30 days. A laptop sold on Facebook Marketplace with the accounting folder still recoverable is exactly that. So for business devices:
- Wipe to the Purge level (cryptographic or secure erase), not just a reset.
- For drives that held regulated data, destroy them and get a certificate of destruction from the recycler.
- Keep a one-line log: device, serial number, date, method, who did it. Insurers and auditors ask.
If you are not sure what was on a machine, treat it as if everything was.
Where can I recycle old electronics around Portland?
ecomaine’s Recycle Right guide (ecomaine runs recycling for Portland and 70-plus member communities) points electronics to retail drop-off at Best Buy and Staples, and lists Computer-Be-Gone for e-waste pickup in Portland, South Portland, Scarborough, Westbrook, Falmouth and Cape Elizabeth. Repair shops in Portland also accept computers and tablets for recycling. Call ahead about hard drives: wipe or remove them before drop-off regardless of what the recycler says, because once it leaves your hands you cannot check.
Frequently asked questions
Is a factory reset enough for a phone?
On any iPhone, and on Android phones from the last several years, yes: storage is encrypted and the reset destroys the key. Remove your Apple ID or Google account first.
Is a factory reset enough for a Windows laptop?
Only if you choose “Remove everything” and then “Clean data”, or if BitLocker was on. The quick option leaves data recoverable.
What about a drive that no longer boots?
You cannot wipe what you cannot access. Remove it and destroy it, or use a recycler that shreds drives and certifies it.
Can Information Systems of Maine do this for us?
Yes. We wipe or destroy retired devices for clients, log the serial numbers, and handle the recycling, usually as part of a hardware refresh. See computer and hardware services.
Sources
- NIST Special Publication 800-88 Rev. 1, Guidelines for Media Sanitization: csrc.nist.gov
- Maine Revised Statutes Title 10 §1348: legislature.maine.gov
- ecomaine, Recycling 101 / Recycle Right: ecomaine.org
Cite this page: “Deleted Doesn’t Mean Gone: How to Wipe a Computer or Phone Before You Sell or Recycle It”, Information Systems of Maine, Portland, ME, updated October 2026.
Retiring a batch of machines? Request IT help or call 207-653-4143.
