How to wipe an old laptop before you give it away

Deleting files or emptying the recycle bin doesn't wipe a laptop. Before you give it away or sell it, copy what you want to keep, sign out of your accounts, and use the operating system's own reset that removes everything; for an SSD, the drive's built-in sanitize or secure erase is the more thorough route. If the disk was encrypted from the start, erasing its keys makes the rest unreadable.

This post explains why ordinary deletion isn't enough, what the standard reference says, the practical steps for Windows, Mac and Linux, and how Havenfold's erase mode approaches the problem. Havenfold is pre-alpha, and parts of its erase mode have so far been tested only in a virtual machine.

Why "delete" isn't wiping

When you delete a file, the operating system usually marks its space as free; the data can stay on the disk until something overwrites it. Reformatting often does the same at a larger scale.

SSDs add a twist. They spread writes across their memory and keep spare areas you can't address directly, so overwriting a file from the operating system may not reach every copy of its data. That's why guidance on sanitising flash storage leans on commands built into the drive itself.

The usual reference here is the US National Institute of Standards and Technology's Guidelines for Media Sanitization, NIST SP 800-88. Revision 2, published in September 2025, superseded the 2014 revision; its keywords include "crypto erase" and "secure erase". For a laptop used at home you usually won't need to read it, but if the laptop held business, health or client data, it's worth a look.

Step 1: back up and check the copy

• Copy photos, documents and anything else you want to keep to another device or drive.
• Open a few files from the copy on another device before you go further.
• Export saved passwords from your browser or password manager if you need them.

Step 2: sign out

• Sign out of cloud accounts, app stores and messaging apps.
• On a Mac, sign out of your Apple account; on Windows, remove your Microsoft account if you used one.
• Remove the device from "find my device" style services so the next owner can activate it.

Step 3: reset with the operating system's own tool

• Windows: Microsoft documents how to reset your PC and choose to remove everything.
• Mac: Apple documents how to erase your Mac and reset it to factory settings.
• Linux: reinstall from scratch; if the disk was encrypted, erasing the LUKS key slots before reinstalling makes the old data unreadable.

Some laptops encrypt the disk by default, or you may have turned encryption on yourself. In that case, a reset that destroys the encryption keys ("crypto erase") is fast and effective, because the remaining data can no longer be decrypted.

Step 4: for an SSD with sensitive data, use the drive's own sanitize

If the laptop held sensitive data, use the drive's built-in commands: NVMe drives have sanitize and format commands, and SATA drives have ATA Sanitize or Secure Erase. Some laptop makers offer these in the firmware (BIOS) setup. Support varies by drive, and some drives refuse the command until the machine is power-cycled.

If you can't wipe the disk (a broken screen, a machine that won't boot), take the drive out before passing the laptop on.

How Havenfold's erase mode approaches it

Havenfold's installer USB includes an erase mode, described in RFC-0007 §13 and the installer's notes. It is designed for retiring a family's home machine, but the RFC notes it can also wipe a computer that isn't part of a family, for example before giving it away. The design choices:

• Runs from RAM with the network off. The erase environment is copied entirely into memory, network interfaces aren't brought up, and the report leaves the machine only as a QR code.
• Internal disks selected, external ones not. External and removable disks are listed but must each be selected separately.
• Encryption keys first. For every partition with a LUKS header, all key slots are erased and the header area is overwritten, then the disk's own method runs.
• Picks a method per disk type. NVMe sanitize where supported, ATA Sanitize on SATA SSDs, and so on. Where the drive offers no verifiable method, the result is reported honestly as "could not be verified" rather than "ok".
• A quick check, not a proof. On SSDs, random blocks are read before and after; if any still holds the same non-zero data, the result is an error. The RFC says plainly that this is not verification, only a check that catches obvious failure.
• A signed report. Each disk gets a signed wipe report that a parent's phone can read from the screen.

Where it stands: in a virtual machine on CI, erase mode ran with the network off, erased the LUKS header, ran an NVMe format, read the QR codes from the screen and checked that sample blocks changed. Real NVMe sanitize, ATA Sanitize and Secure Erase were not tested, because the virtual machine doesn't offer them. Havenfold is pre-alpha; for a laptop you're giving away this week, use the operating system's reset and, if needed, the drive maker's tools.

Summary

• Deleting files or reformatting doesn't wipe a laptop; SSDs make overwriting from the operating system unreliable.
• Back up and check the copy, sign out of accounts, then reset with the operating system's own "remove everything" option.
• If the disk was encrypted, destroying the keys makes old data unreadable; for sensitive data on an SSD, use the drive's built-in sanitize.
• The reference is NIST SP 800-88, now in Revision 2.
• Havenfold's erase mode erases encryption keys first, picks a method per disk and reports honestly when it can't verify; it has been tested only in a virtual machine so far.