Every developer eventually retires hardware: the old work laptop after a refresh cycle, a personal MacBook before upgrading, a box of test phones, or a whole office of machines when a company moves. Most of those devices end up resold, donated or handed to a used-electronics buyer.

The uncomfortable part is that a developer's machine is not a normal consumer device. It holds SSH keys, cloud credentials, .env files, kubeconfigs, browser sessions with admin access, and local database dumps that were "only for testing". A factory reset that looks complete from the UI is not proof that any of that is gone.

This post is a practical checklist, split into four layers:

Revoke what lives outside the device
Release the device from ownership locks (Activation Lock, FRP, MDM, Autopilot)
Sanitize the storage with a method that actually fits the media
Verify and document what you did

The standard changed in 2025: what NIST SP 800-88 Rev. 2 means in practice

For over a decade, the reference document for media sanitization was NIST SP 800-88 Rev. 1 (2014). In September 2025 NIST published SP 800-88 Rev. 2, which supersedes it.

The three sanitization outcomes are still the same vocabulary you will see in every vendor document:

What changed is the shape of the guidance. Rev. 2 is written around running a sanitization program rather than looking up a technique in a table, it moves technology-specific techniques out of scope (cryptographic erase being the notable exception) and points to the IEEE 2883 standard for media-specific methods. It also emphasizes recording evidence per device. In practice, for a reusable device you want to sell, the target is Purge, not Clear.

If you only remember one line from this post: on modern SSDs and phones, the realistic Purge path is cryptographic erase or a firmware-level sanitize command — not overwriting files.

Layer 1: Revoke secrets before you touch the disk

Wiping the device does not invalidate credentials that were copied from it, synced from it, or are still trusted by remote services. Do this while the machine still works, because you may need it to sign in.

Rotate or revoke, don't just delete:

SSH keys — remove the machine's public key from GitHub/GitLab/Bitbucket, from ~/.ssh/authorized_keys on every server you reach, and from bastion hosts.
Git credentials and tokens — revoke personal access tokens created for this machine; check git config --global credential.helper to see where they were stored.
Cloud CLIs — ~/.aws/credentials, ~/.config/gcloud, ~/.azure. Deactivate the access keys in the console, not just locally.
Kubernetes — ~/.kube/config often contains long-lived tokens or client certs. Revoke the user or rotate the cert.
Container registries — ~/.docker/config.json may contain base64-encoded registry auth.
Package publishing tokens — npm, PyPI, crates.io, Docker Hub.
GPG / signing keys — if the private key lived only on this device and you're done with it, publish a revocation certificate.
Browser sessions — sign out of every account and remove the device from "your devices" lists (Google, Microsoft, Apple ID, GitHub sessions).

Migrate before you erase:

TOTP / authenticator apps. If your 2FA seeds live only on the phone you're selling, erasing it can lock you out of production accounts. Move them first and confirm each one works.
Hardware-bound keys (passkeys tied to the platform authenticator, Secure Enclave keys). Register a new authenticator before removing the old one.

A quick local sweep helps you see what's actually there:

Common credential locations on Linux/macOS

ls -la ~/.ssh ~/.aws ~/.kube ~/.docker ~/.config/gcloud ~/.gnupg 2>/dev/null

.env files you forgot about

find ~ -name ".env*" -not -path "/node_modules/" 2>/dev/null

Layer 2: Release ownership locks (the step buyers care about most)

A device that is still bound to your account is, for the next owner, a brick. This is also the most common reason a resale gets stuck at inspection.

Apple (iPhone, iPad, Mac)

Sign out of Apple ID and turn off Find My — this removes Activation Lock.
Remove the device from your Apple ID device list at appleid.apple.com.
Unpair Apple Watch from the iPhone's Watch app before erasing the phone.

Android

Remove every Google account under Settings → Accounts before the reset. Otherwise Factory Reset Protection (FRP) asks the next owner for your credentials.
Samsung devices: also remove the Samsung account.

Corporate fleets — the part that's usually forgotten

Apple Business Manager / Apple School Manager: release the device from your organization. If you don't, it will re-enroll into your MDM on the next owner's setup screen.
MDM (Jamf, Intune, Kandji, etc.): issue a wipe command, then remove the device record. In Intune, Retire only removes corporate data; Wipe resets the device.
Windows Autopilot: deregister the hardware hash. A device left in Autopilot will show your company's branded setup to whoever buys it.
Android Enterprise zero-touch: remove the device from your zero-touch portal configuration.
Firmware passwords / BIOS supervisor passwords: remove them, or the buyer can't boot from external media or change settings.

Layer 3: Sanitize the storage with the right method

This is where most "I wiped it" claims fail. The correct technique depends on the media, not on the operating system.

Why overwriting doesn't work on SSDs

Tools like shred or dd if=/dev/zero were designed for magnetic disks, where a logical block maps to a fixed physical location. SSDs use wear leveling and over-provisioning: the controller remaps writes, keeps spare blocks the OS can't address, and may leave old copies of data in cells your overwrite never touches. Overwriting an SSD can look complete and still leave recoverable data. blkdiscard/TRIM is also not a sanitization guarantee — it's a hint to the controller.

Use the drive's own sanitize capability, or cryptographic erase.

Phones and modern Macs: cryptographic erase is built in
iPhone / iPad: storage is encrypted by default. Settings → General → Transfer or Reset → Erase All Content and Settings destroys the encryption keys, which makes the remaining ciphertext unreadable.
Mac with Apple silicon or a T2 chip: on macOS Monterey and later, Erase All Content and Settings (System Settings → General → Transfer or Reset on recent macOS) does the same thing: the data is already encrypted, the keys are destroyed. It also signs out of Apple ID and turns off Find My.
Android: devices that launched with Android 10 or later use file-based encryption by default; a factory reset discards the keys. Remove accounts first (Layer 2).

Linux / bare drives: NVMe

Check what the controller supports first:

sudo nvme id-ctrl /dev/nvme0 -H | grep -Ei "sanitize|crypto|format"

If Crypto Erase Sanitize is supported, it's usually the fastest Purge option:

Sanitize action 4 = cryptographic erase (2 = block erase, 3 = overwrite)

sudo nvme sanitize /dev/nvme0 --sanact=4

Sanitize runs in the background on the controller — poll until it completes

sudo nvme sanitize-log /dev/nvme0

If sanitize isn't supported, the NVMe Format command with Secure Erase Settings is the fallback:

--ses=2 cryptographic erase, --ses=1 user data erase

sudo nvme format /dev/nvme0n1 --ses=2

These commands are destructive and irreversible. Double-check the device path with lsblk and nvme list first.

Linux / bare drives: SATA SSD and HDD

sudo hdparm -I /dev/sdX | grep -A8 -i security

If it reports frozen, suspend and resume the machine (or hot-plug the drive) to unfreeze it. Then:

sudo hdparm --user-master u --security-set-pass tmp /dev/sdX
sudo hdparm --user-master u --security-erase-enhanced tmp /dev/sdX

Drives that support ATA Sanitize expose --sanitize-crypto-scramble and --sanitize-block-erase as well. For a plain magnetic HDD without these features, a full overwrite is still a reasonable Clear.

Windows laptops
Check encryption state: manage-bde -status. If BitLocker was on from day one, the data at rest is already encrypted.
Settings → System → Recovery → Reset this PC → Remove everything, and enable Clean data (the option that cleans the drive, not just removes files).
For a stronger result, most business-class vendors ship a firmware-level secure erase in BIOS/UEFI (Dell Data Wipe, Lenovo ThinkShield Secure Wipe, HP Secure Erase). These issue the drive's native sanitize/erase commands.
When to Destroy instead

If the drive failed and can't execute a sanitize command, or the data classification forbids reuse, the media should be destroyed rather than resold. A device can still be sold for parts with the storage removed.

The 10-minute version

For a personal device you're about to sell:

Back up, and migrate your authenticator app.
Revoke SSH keys, tokens and cloud keys tied to the machine.
Sign out of Apple ID / Google, turn off Find My, remove the device from your account lists.
Run the built-in Erase All Content and Settings (iPhone, iPad, Apple silicon/T2 Mac) or a factory reset (Android, after removing accounts).
For Windows/Linux machines, use the firmware secure erase or nvme sanitize.
Remove SIM, microSD and any external drives.
Write down what you did.

For a company fleet, add: release from ABM, wipe and delete from MDM, deregister from Autopilot / zero-touch, remove firmware passwords, and keep one record per serial number.

Disclosure

This post is published by the team at Zırhlı Bilişim (ikincielaliriz.com), an Istanbul-based company that buys used computers, phones and other electronics from individuals and businesses. Nothing in this checklist depends on our service — the steps apply whoever you sell, donate or recycle your hardware to.

This article was created with the help of AI and reviewed for technical accuracy before publishing. Command syntax follows the nvme-cli and hdparm manuals; always confirm device paths before running destructive operations.

İkinci El Bilgisayar Alan Yerler - Zırhlı Bilişim PC Alınır

Tüm ikinci el bilgisayar türlerini hızlı ve güvenli şekilde alıyoruz. İkinci El Bilgisayar alan yerler. PC, Dizüstü ve masaüstü bilgisayar için teklif alın.

ikincielaliriz.com