Electronic Media Disposal FAQ

What is electronic media?

Electronic Media is defined as any storage that is used to record information, including, but not limited to hard disks, magnetic tapes, compact disks, video tapes, audio tapes, and removable storage such as USB flash drives.

How should I prepare media for disposal?

In order to protect all University information, and to comply with software license agreements, all UNC-Chapel Hill electronic media should undergo a complete overwrite before the media, or the system containing the media, is surplussed or transferred to another department or state agency. If a complete overwrite of the media is not an option, then the media should be destroyed so that the information it is not recoverable without unreasonable time or cost.

What is sensitive information?

Sensitive Information is important and confidential material. This information is private or otherwise confidential in nature and must be restricted to those with a legitimate business need for access. Some examples of sensitive information are system passwords or encryption keys, financial records, proprietary information, human resource or personnel records, student records, and patient records. All media that contains sensitive information should be overwritten a minimum of three times with software designed to “zero out” media tracks or destroyed. Other sensitive information may be defined by federal or state laws such as FERPA and HIPAA. Examples of solutions for overwriting media are included below. For more information on sensitive information, please see help document http://help.unc.edu/6475 (“What is Sensitive Information?”).

What are my options for disposal?

The Surplus Property Warehouse provides shredding services for hard drives and tape drives. If visual verification of shredding is required, contact the Surplus Property Warehouse at 962-2134 for an appointment. The shredding fee is $3.00 per hard drive, charged to your department account. Also, other disposal companies can be utilized to remove any media that you wish to have destroyed. Some of these companies are listed below.

What should I avoid?

Removing the partition information from the media, such as using FDisk, should be avoided, as well as reinstalling the operating system, without first completing a full media overwrite, and removing the media and disposing of it in any way that does not render it difficult to recover. Using a magnetic degaussing tool is not reliable for every form of media, e.g. modern hard disks may not be completely erased with most degaussing tools.

Disposal companies:

Iron Mountain

Shred It

Software programs that can be used to overwrite media include:

Pretty Good Privacy

Eraser

KillDisk

Hardware solutions that can be used to overwrite media include:

ICS Image Masster

Similar policies presented for reference:

State of Arkansas

UNC-CH School of Medicine

University of Oxford

If you have any questions concerning this standard or if you would like to suggest a tool that can be added to the list please write to security@unc.edu.