On a hard drive: No. And, it is a huge difference. On an SSD: Usually. But typically through accident as opposed to design. If you plan to sell a laptop, this is the one difference that makes a huge difference.
This is the single largest misconception affecting consumer computing, and consumers regularly act upon it.
Performing a factory reset, a Windows “Reset this PC” or a quick format simply removes the file system's index and indicates to the OS that the disk is empty. The files, pictures, passwords etc. remain exactly as they were previously stored on the hard drive in their original physical locations and can be read directly from the HD.
Anybody capable of downloading and running recovery tools for nothing can download those same files right back. Not a specialist. Just anybody. It will take them an afternoon and no particular skill.
If you have wiped your laptop’s mechanical hard drive (using the above method) and then sold or given away the laptop, the new owner of your laptop now possesses your files regardless of whether they know it.
SSDs operate in a different way; the reason they do is because of TRIM.
When either a reset or format is performed on an SSD to inform the drive that previously used blocks are now available for reuse, the drive’s own garbage collection process performs a physical deletion of those cell locations in the background, often within a matter of minutes. The actual removal of the data occurs regardless of what other operations may be taking place on the computer at the same time. Therefore the data is gone and recovery is very likely impossible.
Note, however, this is not a security function. This is merely a side effect of how flash storage handles wear. As such, there is no validation that it occurred. There is no certification that it occurred. Do not use it as a basis upon which to gamble with your GDPR compliance. You are unable to confirm if it was even done.
Sufficient for the sale of an older laptop on eBay. Inadequate for a computer containing a client’s files.
Modern smartphones (iPhone and Android) are an exception to this general rule. When a factory reset is done on these phones, the default encryption key used for storage is deleted rather than attempting to delete or wipe data. Since the encryption key has been deleted, the data is mathematically inaccessible regardless of its physical presence.
That is an adequate (proper) design. Also, that is why we will not perform phone-based recoveries; we consider those two disciplines separate from each other, and we would gladly decline to provide service rather than do so poorly.
A simple reset does not suffice. The disk must be properly over-written, or physically destroyed.
With regard to the disposal of personal data under the United Kingdom General Data Protection Regulation (UK GDPR), you are required to demonstrate that all appropriate measures were taken in order to properly dispose of such data; therefore “a factory reset” alone is not considered sufficient. In addition, each drive used should also have an accompanying certificate showing the serial numbers of the respective drives.
A drive which will not boot can still be read, and in fact failed drives are precisely the type of drive that we regularly recover at our company, and so does anyone who purchases them from skips.
The simple answer. If either BitLocker or FileVault has been active on the computer since its original installation, then a subsequent reset will destroy the encryption key, effectively destroying the encrypted data (the same method used by manufacturers to make mobile phones safe).
Get a quote from us, then drop off your drive at our Quayside reception or send it in and see if we have found anything (at no cost). The written quote will be based on the fixed bands before we start working.