How to choose data erasure software
Most erasure tools wipe drives. Fewer give you something you can defend in an audit. Here's the checklist to tell the difference.
Choosing data erasure software comes down to one question: when it's over, what can you prove? The wipe itself is commodity functionality. The difference is the evidence, the hardware coverage, and what you're locked into.
In this series:
- tScrub vs Blancco (the full comparison)
- DBAN alternatives
- Open source vs commercial
- ITAD & refurbishment
- Data centre decommissioning
What to look for
- Verifiable reports — signed reports (SHA-256 + Ed25519) and a certificate of destruction you can generate and independently verify.
- Hardware coverage — NVMe, SATA, SAS, and self-encrypting drives, with firmware erasure preferred over software overwrite.
- Honest outcomes — a tool that flags frozen or failed drives for destruction (and blocked drives as recoverable), rather than silently marking them "done."
- Transparent licensing — you know what you're paying, and the software runs on hardware you own.
- Auditability — the code is inspectable, so your security team can confirm what actually runs.
tScrub vs Blancco
Blancco is the established name in certified erasure, and it's a solid product. tScrub is the open alternative: the same compliance outcome — without the vendor lock-in. You can read every line of the code, boot it on your own hardware, and generate signed reports and certificates. The full breakdown is on the comparison page.
Open source vs commercial
Commercial tools bundle certification, support, and an interface — at a cost and with a dependency on the vendor. Open source gives you transparency and control but historically meant you assembled the audit trail yourself. tScrub sits in the middle: an open, inspectable core with the signing, certificates, and dashboard already built in.
For ITAD & refurbishers
ITAD and refurbishment shops need a repeatable process they can show to their clients. Look for: a branded, per-batch certificate; SMART capture to prove drives were healthy before resale; and a price model that scales with volume rather than per-seat licences.
For data centre decommissioning
Decommissioning fleets means erasing at scale, often over PXE. Look for: network boot, unattended runs (a pre-set Chain of Custody ID with no prompts), and automatic report upload to a central dashboard.
Evaluation checklist
| Criterion | What to ask |
|---|---|
| Verification | Are reports signed? Can a third party verify a certificate? |
| Coverage | NVMe, SATA, SAS, SED/OPAL? Firmware erase preferred? |
| Honesty | Are failed drives flagged, and blocked drives marked recoverable, rather than silently marked clean? |
| Licensing | Per device? Per seat? Any lock-in or mandatory appliance? |
| Transparency | Can your team inspect what actually runs? |
| Scale | Does it support PXE and unattended fleet runs? |
FAQ
Do I need a certified erasure tool?
You need erasure you can demonstrate. Third-party certification is one route; a verifiable, signed, open report is another. What matters is that the evidence holds up.
Is free erasure software good enough?
For internal reuse tracking, yes — self-signed reports are tamper-evident. For drives leaving your control under a compliance regime, vendor-signed certificates are the safer standard.