A company is retiring database servers whose disks held regulated customer data. The disks will not be reused. What is the most appropriate way to dispose of the data?
Select an answer to reveal the explanation.
Short Explanation
Deleting a file is like tearing the table of contents out of a book; the pages are all still there. For regulated data you sanitize or physically destroy the media and keep a record proving you did it. A quick format feels final, but the data's still sitting on the platters.
Full Explanation
Destroying data properly means rendering it unrecoverable on media that is leaving service. Approved methods include cryptographic erase, where the encryption keys protecting already-encrypted media are destroyed, overwriting or purge commands appropriate to the media type, and physical destruction such as shredding or degaussing for disks that will not be reused. Because the data is regulated, the organization should also record what was destroyed, how, when and by whom, often as a certificate of destruction from an approved vendor, to demonstrate compliance. Dropping the database removes it from the engine's catalog, but the underlying blocks remain on disk and can be recovered with forensic tools, so sending the disks to a recycler exposes the data. A quick format rewrites file system structures without erasing the data blocks, leaving the contents recoverable. Keeping disks locked away indefinitely is not disposal; it extends the retention period beyond policy and keeps the risk alive. Exam caveat: solid-state drives handle overwrites differently from magnetic disks, so media-appropriate sanitization or physical destruction is preferred. Operational check: reconcile the asset inventory against destruction certificates, and confirm every decommissioned disk's serial number appears on a record.