Disposal or recycling of old computers
1. University Policy for Computer Disposal
The University policy for disposal of equipment that is surplus to the requirements of the school/unit that originally purchased it is as follows:
- Equipment that has residual value may be used as part trade-in for new equipment or may be sold, either to other schools/units in the University, to members of the University or to outside bodies. All these processes are subject to the University's financial guidelines.
- Where equipment has limited resale value, consideration should be given to whether it can be donated to any charitable or community project. If the equipment cannot be reused, then it should be recycled or disposed of in an environmentally-friendly manner by using the service offered by Estates.
- All sensitive data held on such computers must be erased (see below) before disposal; consideration should be given to doing this even if disposal is within the University.
- These requirements apply to all computers (PCs, Macintoshes, Unix computers, etc), as well as to other items of computer equipment (eg printers, scanners).
- Note that all computer media (disks, tapes, CD-ROMs, etc) should also be disposed of properly, in accordance with the strictures on data contained within this Policy.
2. Importance of Data Removal
An overriding consideration in any move of equipment must be to ensure that any sensitive or confidential University data on the machine, and any software licensed to the University, is removed. It is, of course, essential to satisfy the requirements of the Data Protection Act (1998), but it must also be understood that any University data that is discovered by a later owner may be the cause of adverse publicity to the University.
Ensuring adequate destruction of data is the responsibility of the unit that owns the equipment, and must not be delegated to any person outside the University without adequate contractual obligations being in place.
Where a disk drive or similar device which is not in working order is to be disposed of, whether incorporated within a computer or not, then data on it, or the disk itself, must still be erased or destroyed. Advice may be sought from the IT Service Desk(email itservicedesk, tel. 3333) in this case.
3. Means of Disposal
The following mechanisms are required:
- If a school/unit is handling a transfer of ownership, eg by selling or giving a few machines to another school/unit or selling one to a member of staff, then the head of school/unit owning the equipment must give consent to the transfer of ownership and be satisfied that the proper steps are taken. Machines may be advertised for sale in the University Staff Newsletter or the Information Services Newsletter.
- Where machines are to be given to charities, schools, etc, then it is necessary that someone within the University who is interested in the particular good cause should volunteer to take charge of the process, and act as the University's agent in ensuring that the proper steps are taken. Again, the head of school/unit owning the equipment is required to give consent.
- Where equipment is to be scrapped, schools/units should use the service offered by Estates, and must ensure that the destruction of data is completed before the equipment is uplifted by Estates.
- In all respects, observe the University's policies and guidelines for waste management and recycling.
4. Deleting Data: Technical Aspects
Before disposing of any computer system, it is vital to remove all traces of sensitive data files (since identification may be difficult, it is normally far better to remove all data).
Merely deleting the visible files is not wholly sufficient to achieve this, since data recovery software could be used by a new owner to undelete such files. The disk-space previously used by deleted files needs to be overwritten with new, meaningless data. Similarly, even repartitioning and reformatting the whole hard disk may not in itself prevent the recovery of old data as it is sometimes possible for disks to be unformatted. However, if you are satisified that the data on the disk is not particularly sensitive then repartitioning the disk and reformating is acceptable. On PCs, this is done using the MSDOS commands, FDISK and FORMAT.
Perhaps the most well-known tool for fully wiping old data files is the Wipe Info module of the Norton Utilities suite for PC and Macintosh systems. This will completely wipe the contents of any specified files, or the whole of the free space on the disk. However, this approach still assumes that you have located every file that needs to be taken care of, which may not always be easy.
A better approach is to repartition and reformat the hard disk, installing a clean copy of the original operating system, and then run Wipe Info on the free space. This should leave a machine in a suitable state for disposal. Other utilities of this type are available such as:
- Eraser for Windows
- BCWIPE for Windows and Linux/Solaris
- SDELETE for Windows
Some of these packages (eg Wipe Infomodule of the Norton Utilities suite and SDELETE) implement the US Department of Defense standard for clearing and sanitizing disks (DOD 5220.22-M). Some of them (eg Eraser and SDELETE) are available for use at home or work without charge provided they are downloaded from the site referenced. In some cases donations are welcomed.
Every Mac and virtually every PC is bought with a licence for the operating system supplied with it. A machine can therefore normally be legitimately disposed of with a freshly installed copy of the same system. However, you should not install a later copy of the system software. It is recommended that you do not sell machines with applications software installed; many licences cannot be simply transferred with the computer.
It is difficult to recommend a recipe to cover all eventualities but as a guideline we give the following:
- If the computer is being transferred to another school/unit and does not hold particularly sensitive data, either (a) repartition and reformat the disk and reinstall the original operating system or (b) delete all user files (eg my documents, email and downloads folders) and uninstall all licensed applications software packages.
- If the computer is being transferred for use by anyone outwith a school/unit and/or is believed to hold sensitive data (a) repartition and reformat the disk, reinstall the original operating system and run Wipe Info or the equivalent.
Finally, if the computer is being scrapped and you are concerned about data held on the hard disk, the ultimate option of physically destroying the hard disk should be considered.
October 2004 rev Nov 2009
