Lesson 4: Data Destruction and Security Triage Lab

Core path: 42 minutes

Retiring storage is a security task.

Deleting a file, formatting a drive, physically destroying media, and receiving a vendor certificate of destruction are different assurance levels for different requirements.

Data-destruction methods

Erasing / wiping

Uses software or device-supported procedures to overwrite or securely erase storage according to the media and policy.

Standard formatting

Recreates filesystem structures for normal reuse. It is not automatically secure sanitization and may leave recoverable data.

Low-level formatting recognition

Modern drives generally do not use end-user "low-level formatting" in the historical sense. A+ expects recognition of the term, but technicians should use current manufacturer/organization sanitization procedures instead of assuming a generic format command securely destroys data.

Degaussing

Uses a strong magnetic field to destroy data on supported magnetic media. It is not an appropriate sanitization method for flash/SSD media.

Drilling / shredding / incineration

Physical destruction methods used under approved procedures. Different media require different destruction methods and safety/environmental controls.

Students do not physically destroy devices in this lab.

Third-party destruction

Organizations may use approved vendors for secure destruction/recycling.

Evidence can include:

• asset tracking;
• chain of custody;
• certificate of destruction;
• recycling documentation.

Regulatory and environmental requirements

Data retention/destruction may be governed by organizational policy, privacy requirements, contracts, regulations, and environmental/e-waste rules.

Do not destroy data simply because a ticket says "old drive."

Triage stations

Station A: SSD retirement

Evidence:

• SSD contains organizational data;
• device is being retired;
• proposed action is quick format and resale.

Reject standard formatting as sufficient proof of sanitization. Select an approved secure-erase or destruction path appropriate to SSD media and policy.

Station B: failed magnetic HDD

Evidence:

• drive no longer functions reliably enough for software wiping;
• sensitive data was stored on it;
• organization requires high-assurance destruction.

Compare physical destruction and approved vendor handling. Degaussing may be relevant for compatible magnetic media, but chain-of-custody evidence still matters.

Station C: paper records

Evidence:

• printed confidential documents are no longer required;
• normal recycling bin is proposed.

Use approved secure shredding/destruction rather than treating paper as harmless because it is offline.

Station D: suspicious browser behavior

Evidence:

• unexpected pop-ups and redirects;
• unknown extension installed;
• endpoint protection is current;
• other applications are normal.

Triage at browser/profile scope first while following the malware-removal workflow if broader evidence appears.

Station E: possible ransomware

Evidence:

• user files suddenly inaccessible;
• ransom note appears;
• other endpoints may share network storage.

First priorities are containment/isolation and escalation according to policy. Do not pay, delete evidence, or reconnect shared resources from curiosity.

Station F: suspicious email

Evidence:

• unexpected QR code requests account verification;
• user has not scanned it;
• sender display name resembles a known vendor.

Classify it as possible QR phishing and verify through a known channel. Do not scan the code to investigate.

Station G: SOHO router

Evidence:

• default admin password remains;
• UPnP enabled without a documented need;
• old firmware;
• guest Wi-Fi reaches trusted internal devices.

Prioritize the hardening changes and verification tests.

Lab record

For each station document:

asset/data:
observed risk:
what is NOT proven:
selected control/removal/destruction step:
authorization or chain-of-custody requirement:
verification evidence:

Success criteria

A passing technician record protects data and evidence before taking a destructive action.