Wiping laptops and servers in a wind-down without losing the records

What is the right order before wiping company laptops?#

The right order before wiping company laptops and servers is inventory, preserve, verify, sanitize, certify, and no step should start before the previous one is signed off. Wind-downs go wrong when the asset buyer or recycler arrives before anyone has checked what lives only on the hardware.

Treat the sequence as a control, not a suggestion. A wind-down officer or trustee usually signs each stage, and the signed log becomes part of the record of how the company handled its information on the way out.

• 1Inventory: list every laptop, desktop, server, storage appliance, backup device and phone by serial number, assigned user and location.
• 2Preserve: export or image the records that exist only on that device, using a format that will still open years from now.
• 3Verify: confirm the copy is complete and readable, and record hash values or record counts against the source.
• 4Sanitize: erase or destroy the media with a method suited to the drive type, following a recognized guideline.
• 5Certify: collect a certificate per device that names the serial number, the method, the date and the person responsible.

Which devices hold records that exist nowhere else?#

Devices hold unique records whenever people worked offline, synced only part of their files or ran systems on premises. Cloud tools such as Microsoft 365, Google Workspace, Salesforce or Jira keep their own copies, but the hardware around them rarely mirrors those tools completely. Those cloud copies are on a clock too: Microsoft says it keeps customer data for 90 days in a limited-function account after a cloud subscription ends, and HubSpot's terms say it will not provide access to customer data after most subscriptions end, so schedule cloud exports alongside the device work rather than after it.

Ask departing staff and IT what they kept locally before collecting machines. A short question at exit catches more than a scan after the fact, because people know where they parked the files they actually used.

Export or image: how to choose a preservation method#

A full disk image preserves everything on a device, including deleted space and system files, while a logical export preserves only the folders, mailboxes or databases you select. Images suit devices tied to disputes, investigations or senior roles; logical exports suit most other machines and are far easier to search later.

Servers deserve special care. A copy of database files without the application, version and schema can become unreadable once the software license lapses, so export to an open format such as CSV or SQL where you can, and keep the vendor's own export alongside it.

If litigation, claims or a regulator inquiry is possible, ask counsel before choosing. Counsel may require forensic images taken by a specialist with a documented chain of custody, and a quick copy made by an IT contractor may not serve that purpose.

How do you verify a copy before anything is erased?#

Verification means proving the preserved copy is complete and readable, and recording that proof before any device leaves your control. A copy that has never been opened is an assumption, not a backup.

Keep two verified copies in separate locations, with at least one encrypted and offline. A common way wind-downs lose records is a single external drive that later turns out to be faulty, or whose password left with a contractor.

• 1Compare hash values of images and exported files against the source and record both in the log.
• 2Open a sample of documents, mailboxes and attachments from different years and departments.
• 3Restore at least one database export into a test environment and run a few known queries.
• 4Compare record counts, such as tickets, invoices or jobs, between the live system and the export.
• 5Have someone other than the person who made the copy sign the verification line.

What to ask an ITAD vendor about sanitization and certificates#

An IT asset disposition (ITAD) vendor should sanitize each device with a method suited to its media and issue a certificate that ties the method to the serial number. Many ITAD vendors reference NIST SP 800-88, the federal guideline on media sanitization, so ask which method they apply to hard drives, solid-state drives and phones, because those media behave differently.

Encrypted laptops add a step. If drives use BitLocker or FileVault, collect recovery keys into a secure register before the preservation stage; once the keys are gone, nobody can recover what was not already copied.

Illustrative: a design firm closing its office#

Illustrative: a fictional architecture and engineering firm is winding down after its partners retire. It ran Deltek on an on-premises server, kept Revit models and Bluebeam markups on a NAS, and several principals stored years of client correspondence in local Outlook archive files on their laptops.

The wind-down officer had an ITAD pickup booked before anyone checked the laptops, so the pickup was moved. IT exported the Deltek database with its schema, copied the NAS with permissions and hashes, and imaged the principals' laptops because one project was still under a warranty claim. Every other laptop received a targeted export of its documents and desktop folders.

Two encrypted copies were verified and signed off before the vendor arrived. The firm received a certificate per serial number, and its project records, RFIs and submittals stayed available for the claim, for retention obligations and for a later review of whether some records could be licensed.

Who keeps the preserved copy after the hardware is gone?#

The preserved copy needs a named custodian, usually the wind-down officer, the trustee or a designated former executive, who controls the encryption keys and the access list. Without a named owner, archives drift onto personal drives or into a former employee's cloud account.

Retention periods differ by record type and jurisdiction, and tax, employment and contract records often carry their own clocks. Build a retention and deletion schedule with your accountant and counsel, and note any litigation hold that pauses deletion.

Keep the preservation log with the archive: device list, methods, verification results, certificates and custodian sign-offs. Anyone reviewing the archive later, whether an auditor, an acquirer or a licensee's diligence team, will ask how the records were handled.

How SourceX approaches records in a wind-down#

SourceX starts with a fit check that collects metadata only: which systems existed, roughly how much history was preserved and which record families it covers. Nothing is shared during the initial assessment, so the preservation work above comes first and stands on its own.

If a package proceeds through the SourceX five-step transaction (Supply, Rights, Preparation, Approval, Delivery), large datasets stay in the seller's own storage or ship on encrypted drives, and SourceX never hosts multi-TB datasets. The preservation log feeds the provenance section of the SourceX Evidence Packet.