I have a hard drive from work that I know contains ransomware. I want to completely erase it, but I'm unsure of the safest procedure. Is it okay to connect it to a computer in Safe Mode with the internet disconnected and format it, or should I use another method?
3 Answers
Since this is a work drive, contact your IT or security team before wiping it. They may need to preserve it as evidence or use dedicated drive-erasure hardware. If the data is not needed, the safest option may be to have them securely destroy or replace the drive.
Don’t connect it to your normal computer, even in Safe Mode. Use a spare machine with no other storage attached, disconnect it from every network, and boot from a trusted USB erasure tool such as ShredOS. Select the correct disk and perform a full wipe; simply formatting or deleting partitions is not the same as securely erasing a traditional hard drive.
If it’s an SSD, use the manufacturer’s secure-erase or sanitize function instead of repeatedly overwriting it, since conventional wiping tools are less appropriate for flash storage. In either case, keep the system air-gapped and verify the drive type first. If there’s any doubt about handling it safely, have your workplace IT department do the wipe or physically dispose of the drive.
A live Linux or partition-management USB can also prevent the installed operating system from loading, but make sure you choose a true erase operation rather than only removing the partitions.