I have a hard drive from work that definitely contains ransomware. I want to completely erase it and reuse it, but I'm unsure whether connecting it to a computer—even in Safe Mode with the internet disconnected—is safe. What procedure should I follow to wipe it without exposing another system?
4 Answers
For a reusable mechanical hard drive, connect it only to an isolated spare machine with no other internal drives and no network connection. Boot from a trusted, write-protected or freshly created USB wiping environment such as ShredOS, then select the correct disk and perform a full wipe. Double-check the drive identity before starting, because the process is irreversible.
If you’re not completely confident identifying the drive and booting the wiping tool, don’t experiment with a valuable computer. Have your workplace IT department handle it or replace and physically destroy the drive. Also treat any computer that previously had the drive attached as potentially compromised and have it checked separately.
Don’t connect it to your everyday computer or rely on Windows Safe Mode. First, check with your employer’s IT or security team, since they may need to preserve evidence or use dedicated drive-erasing hardware. If the drive can be discarded, physical destruction is the safest option for sensitive data.
A Linux live USB with a disk utility can be used to remove partitions, but that alone may leave recoverable data behind. It also requires careful isolation: unplug other storage devices, keep the system offline, and avoid opening files from the suspect drive. If it’s an SSD, use the manufacturer’s secure-erase or sanitize function instead of repeatedly overwriting it.
Simply deleting partitions or doing a quick format is not the same as securely wiping the disk. A full overwrite is needed for a traditional spinning hard drive if you intend to reuse it.