Erase or Destroy U-M Devices

Sanitize Devices and Media Before Disposal

University-owned devices must be sanitized before disposal or transfer. That means they must be erased, overwritten, or destroyed so that data cannot be recovered using normal system functions or software data recovery utilities.

U-M Property Disposition is responsible for the disposal or resale of all university property, including all computers and storage media devices, designated as surplus by U-M schools, colleges, and units. All UM-owned devices sent to Property Disposition must be either accompanied by a certificate of sanitization/destruction, use the KillDisk fingerprint option, or request sanitization or physical destruction by Property Disposition. Charges will apply for devices that do not use one of those methods to certify that a device was properly sanitized. Property Disposition accepts devices and does the sanitization or destruction for you for a fee.

How you sanitize or request sanitization of a device or storage media depends on the type of device/storage and who manages it. Types of devices or media that must be sanitized includes, but are not limited to:

  • Computer hard drives. Computer hard drives might be installed in a computer, or in an external enclosure, and may include solid state drives (SSDs).
  • Tapes (magnetic media). Reel-to-reel backup tapes, cassette tapes.
  • Optical media. Compact disks (CDs), DVDs, and blu ray disks.
  • USB drives. Thumb drives and other USB or similar drives.
  • Mobile devices. Phones, tablets, and other portable devices that may hold or be used to work with data.
  • Printed materials.

The following options are available for disposing of UM-owned devices:

  • MiWorkspace-managed devices. Return these to Neighborhood IT for proper sanitization and disposal. Contact your local support person or the ITS Service Center.
  • Michigan Medicine devices are managed by Health Information Technology & Services (HITS). For questions about sanitization and disposal of devices, stop by any one of the Help Me Now locations or contact the HITS Service Desk at 734-936-8000.
  • U-M departmentally-managed devices. Check with your department for your department's preferred disposal method. You or your department can avoid fees by following these do-it-yourself directions:
  • U-M fee based services.
  • Device Transfers Between U-M Units
    • Internal transfer within a department:
      • If the U-M employee to whom the university-owned device will be transferred is authorized to view any data the previous employee may have saved on the device, it is up to the unit to determine what, if any, data sanitization or secure device wiping is necessary prior to the transfer.
      • If the new recipient is not authorized to view data saved on the device, unit IT must sanitize the device according to the process described in Erase or Destroy U-M Devices ranging from secure deletion of specific files to complete sanitization before transferring to new employee.
    • Transfer between departments:
      • If a U-M employee transfers from one U-M department to another and the new unit wants to purchase the device for the transferring staff member to continue using:
        • Unit IT for the department being left must determine whether there are any unit-specific data or files classified at Restricted, High, or Moderate or unit-licensed management systems or software that the departing employee should no longer have access to and consequently what data sanitization or secure device wiping is necessary prior to the transfer; once device is properly sanitized, Unit IT requests price from Property Disposition to be paid by staff member's new department or the unit can choose to transfer the device at no charge.
      • Before a U-M unit transfers unneeded computers or storage media to another U-M unit (unit does not know who the new user will be), the devices must be sanitized according to the process described in Erase or Destroy U-M Devices.
    • Transfer to original user for personal use:
      • Employees purchasing mobile devices originally purchased for them by U-M (handled by Property Disposition since it involves disposition of U-M owned property):
        • With the support of Unit IT, remove or delete U-M data, documents, databases, and licensed software specific to the unit or U-M by selective deletion in accordance with SPG 601.33; it is not required to be reset to factory default. Unit IT requests price from Property Disposition to be paid by staff member.
  • Personal devices used for U-M work. See Erase Personal Devices Before Disposal.
Devices containing regulated data. Federal or state regulations or contractual agreements applying to specific data or devices may stipulate that additional actions are required.

Physical Destruction for Secure Disposal

When devices, drives, or media are inoperable, it may be necessary to destroy them to ensure secure disposal. Destruction may also be required by some laws or regulations governing certain types of data.

  • Ask Property Disposition to destroy a device. Property Disposition shreds drives or other media in its on-site shredder for $1 per device.
  • Destroy a device yourself (strongly discouraged). See Destroy Devices and Media for instructions.

Certificates of Destruction Required for U-M Devices Declared as Surplus

You are required to provide a Certificate of Destruction when taking U-M owned devices to Property Disposition if you have completed one of the secure disposal methods identified above or destroyed a device . The Certificate of Destruction must accompany the U-M Property Disposition Declaration of Surplus Form which is also required for all U-M property that a department or unit no longer needs.

  • If you execute KillDisk to securely erase a device, the program will automatically generate a Certificate of Destruction at its conclusion.
  • If you use another method to securely erase or physically destroy media or devices, you must attach a completed copy of this Certificate of Destruction (PDF) to the equipment when you bring it to Property Disposition. If you are bringing multiple of the same media or device make and model, you can provide one certificate that lists individual serial numbers of each device. Your unit is required to maintain a scanned or hard copy of the Certificate of Destruction for three years after disposing of the device or media. You can download the certificate to Google Drive or your computer to fill out as an interactive PDF, or you can print it and fill it out by hand.

If you do not attach a certificate matching the equipment you are dropping off, or use the KillDisk fingerprint option when erasing a device, Property Disposition will process the equipment as if it was not erased or destroyed, and your department will be charged the standard fees for secure erasure or device destruction. If you would prefer, you can also take advantage of Property Disposition's secure erasure and disposal service.

You are also responsible for destroying any printed or paper copies of sensitive U-M data or records that no longer need to be retained. See Shred Sensitive Paper Documents for best practices.