More devices store data than most offices count. Copiers, multifunction printers, routers, smart speakers, badge readers, phones, USB sticks and even some disguised drives all keep information in memory chips or disks that a factory reset may never reach. If your business retires any of them without a documented sanitization step, you are handing over data you did not know you held.
This guide is for IT managers, facility managers and business owners. It covers which devices hide storage, why a reset or delete is not enough, and what a defensible disposal process looks like in the United States.
TL;DR
- Any device that remembers settings, jobs, logs or credentials has storage. Copiers, printers, routers, smart speakers, phones and USB drives are the usual suspects.
- Deleting files, formatting or running a factory reset often leaves data behind, especially on flash storage and embedded devices.
- The FTC says businesses must make sensitive information unreadable before disposal. Build an inventory first, then choose Clear, Purge or Destroy per device.
- For small or embedded devices that cannot be wiped with confidence, physical destruction with a certificate is the practical answer.
Table of Contents
- What counts as a device with hidden storage
- Why a reset or delete does not solve it
- Match the method to the device
- A five-step process for finding and retiring hidden storage
- Where the legal exposure sits
- Our perspective: treat storage as the asset, not the box
- How we help
- Quick checklist before the next cleanout
- FAQ
- Sources
What counts as a device with hidden storage
Hidden does not always mean concealed on purpose. In most offices it means storage nobody thinks of as storage. The device has no obvious drive letter, no file browser, and nobody on staff has ever opened it up. The data is still there.
The FTC’s guide for business tells companies to inventory computers, laptops, mobile devices, flash drives, disks, digital copiers and other equipment to find out where sensitive information lives. That list is a good starting point, and the sections below add the items that tend to be missed.
Copiers and multifunction printers
This is the classic case. According to the FTC’s digital copier guidance, the hard drive in a digital copier stores data about the documents it copies, prints, scans, faxes or emails. The same guidance notes that these machines are often leased, returned and leased again or sold, which means your scanned HR files and invoices can travel with the machine.
If you lease, the drive is the first thing to ask about in the contract. Who removes it, who wipes it, and what proof do you get when the machine leaves your building?
Routers, switches and network appliances
Network gear stores configuration files, VPN settings, Wi-Fi keys and logs. A forensic firm describes extracting hidden data from routers and other devices as a routine investigative task, which tells you the data is recoverable by people who know where to look. An old firewall that goes to a recycler with its configuration intact is a map of your network.
Smart speakers, cameras and other IoT devices
Connected devices are the least understood category. A 2023 study of IoT device reuse found that 13.2% of the firmware it investigated performed only shallow deletion, and it identified more than 121,984 instances of sensitive data collection across 4,749 firmware images. The researchers also point out that more than 300,000 used IoT devices were being sold on Craigslist at the time of writing.
One reason is wear-leveling. Flash chips spread writes across cells to extend their life, so an overwrite may not touch the cell that held the original data. Researchers who examined the Amazon Echo Dot found that sensitive data could be recovered from used units, which makes second-hand connected devices an overlooked attack vector.
Phones, tablets and handheld scanners
Warehouse scanners, point-of-sale tablets and company phones are easy to forget because they feel like tools, not computers. They hold email, cached credentials, customer records and location history. The FTC’s guidance says employees should treat all storage-capable media, phones and USB sticks included, with the same rigor as sensitive paper records.
USB sticks and disguised drives
Small media is the easiest to lose and the hardest to inspect. Some drives are built to deceive: an open-source project reported by Tom’s Hardware presents an ordinary 8GB stick while keeping an encrypted partition behind it. You are unlikely to meet one in a typical office, but the point carries over: a drive can show you a clean surface while storing more than the operating system reports.
That is why any unknown or unreturned drive found in a desk, a conference room or a returned-equipment bin should be treated as holding sensitive data until proven otherwise. Do not plug it into a production machine to find out.
Why a reset or delete does not solve it
Most people believe three things that are not safe to rely on.
- “We deleted the files.” Deleting removes the pointer, not the data. The FTC states that deleting files or formatting drives is not enough for compliance with the Disposal Rule, because data thieves can reconstruct the files.
- “We did a factory reset.” On embedded devices, a reset may only restore settings. The IoT research above shows credentials and biometrics can survive it.
- “The device is dead, so the data is gone.” A broken controller does not erase a memory chip. Data can be read directly from the chip by specialists.
Hidden storage can also sit outside what the operating system lists. As the Tom’s Hardware report on the decoy drive illustrates, concealment at the hardware level can slip past ordinary scanning tools, and standard wiping does not reach areas it cannot see.
Match the method to the device
NIST SP 800-88 Revision 1 is the reference most U.S. auditors use. It sorts sanitization into three levels:
- Clear: logical techniques such as a factory reset or standard overwrite.
- Purge: physical or logical techniques, such as degaussing for magnetic media, that resist laboratory-level recovery.
- Destroy: rendering the media unusable.
NIST also says the method should follow the confidentiality of the data, not only the type of media. A conference-room speaker that only ever held a guest Wi-Fi password and a payroll server’s drive do not need the same treatment.
| Device | Typical hidden data | Reasonable approach |
|---|---|---|
| Copier or MFP | Scanned and printed job images, address books | Remove the drive and destroy it, or have it sanitized and certified before the machine leaves |
| Router, firewall | Configs, keys, logs | Purge where the vendor supports it, otherwise destroy the storage chip or board |
| Smart speaker, camera | Credentials, voice or video history, Wi-Fi tokens | Destroy if it ever touched sensitive areas |
| Phone, tablet, scanner | Email, cached logins, customer records | Encrypt and reset for low-risk units, destroy for high-risk ones |
| USB stick, SD card | Anything | Destroy |
| Laptop, server SSD | Everything | Purge or destroy with a certificate |
The FTC recommends physical destruction, such as shredding, burning or pulverizing, for small media that cannot be wiped reliably. For flash devices that is usually the cleanest answer, because you do not have to trust firmware that you cannot inspect. For a deeper look at why wiping standards matter, see our explainer on what NIST data destruction actually requires and our note on why chasing DoD 5220.22-M is outdated.
A five-step process for finding and retiring hidden storage
1. Build the inventory
Walk the building. Check closets, reception, print rooms, loading docks and remote offices. Record device type, location, owner, and whether it has storage. Include leased equipment, since the lease does not move the risk to the lessor.
2. Classify by data, not by device
Ask what the device has touched. A printer in HR is not the same as a printer in the lobby. Assign each device Clear, Purge or Destroy according to the sensitivity of that data, as NIST describes.
3. Write the rule down
The FTC points to a policy-driven approach, with employees trained to handle storage-capable media properly. A one-page rule that names device types and the required action does more than a long policy nobody reads. Our guide to building a NIST 800-88 program that leaves proof shows how to structure it.
4. Control the chain from desk to destruction
Lock up retired equipment, log serial numbers, and hand it only to a vendor that will document the process. Gaps are most common between the moment a device is unplugged and the moment it is processed. Consider a witnessed destruction requirement for your highest-risk assets.
5. Keep the certificate
A regulator or customer will not accept “we think it was wiped.” Keep a certificate listing each asset, the method and the date. The FTC has taken enforcement actions against companies that sold surplus hard drives containing customers’ personal information, so the record is your evidence of reasonable care.
Where the legal exposure sits
In the U.S., there is no single law for device disposal. Several apply depending on your data. The FTC’s Disposal Rule, issued under the FACT Act, covers information derived from consumer reports and requires reasonable measures so it cannot be read or reconstructed. The rule’s text says its purpose is to reduce the risk of fraud and identity theft by making sure records are redacted or destroyed before being discarded. Healthcare organizations face HIPAA on top of that, and agencies handling criminal justice information have their own media rules, which we map in our CJIS media sanitization guide.
Healthcare teams in particular should look at how protected health information leaks through channels they did not plan for. A HIPAA-focused walkthrough from a healthcare marketing firm shows how easily patient details spread when an organization is careless with what it publishes, and the same discipline applies to a discarded printer. For a broader view of how improper erasure becomes a security incident, this overview of website and data security basics gives useful examples.
This article is general information, not legal advice. If you handle patient, financial or criminal justice data, confirm the specific retention and destruction requirements with your compliance officer or counsel before you set your policy.
Our perspective: treat storage as the asset, not the box
We see the same pattern with businesses that call us after a cleanout. They have a plan for the laptops and the servers. Then the copiers go back to the leasing company, the old access points go in a cage, and a box of unlabeled USB sticks sits in a drawer for years. Nobody decided to be careless. The devices simply were not on anyone’s list.
Our advice is to stop sorting retirement by what the object is and start sorting it by what it can remember. If it can remember, it needs a documented end. For flash-based and embedded devices, where you cannot verify what a software reset did, we lean toward destruction with a certificate over trusting a wipe you cannot prove. It costs less than explaining a leak to a client or a regulator.
The second thing we push is paperwork. Auditors rarely ask whether you destroyed something. They ask you to show it. A serial-numbered certificate answers that in one page.
— Keith
How we help
We handle this end to end for business and organizational customers. Our onsite data destruction service is built for jobs of 50 or more hard drives, so your media is destroyed before it leaves your premises, and our equipment destruction service covers the devices that are not standard drives. You receive receipts and certificates for compliance files. Our facility is EPA-certified and registered with the California Department of Toxic Substances Control.
If your retired equipment still has resale value, our IT asset recovery service assesses it and pays upfront. See the IT asset recovery payout guide for how that works, or request a free quote from Recycle for Life. Pickup and flexible scheduling are available.
Quick checklist before the next cleanout
- Pull every leased copier and printer contract and find the drive clause.
- List network gear and confirm who holds its configuration backups.
- Collect loose USB sticks, SD cards and old phones into a locked bin.
- Tag every item with an asset number before it leaves its room.
- Decide the method for each class: Clear, Purge or Destroy.
- Ask your vendor for a certificate that lists each serial number.
- File the certificates where your auditor can find them.
For planning the logistics, our electronics disposal planning steps lay out the sequence.
FAQ
Which everyday office devices store data without us noticing?
Copiers and multifunction printers, routers and firewalls, smart speakers, badge and door systems, handheld scanners, phones, tablets and USB sticks all do. If a device remembers jobs, logs, settings or logins, it has storage. Add them to your asset inventory so they get the same treatment as laptops.
Does a factory reset remove the data?
Not reliably. Research on reused IoT devices found that many keep credentials and other sensitive data after a reset, partly because of how flash storage handles writes. For low-risk devices a reset may meet the NIST Clear level. For anything that touched sensitive data, plan on Purge or Destroy.
How do I find hidden devices or drives in my own building?
Start with a physical walkthrough and a network scan that lists every connected device, then reconcile both against your asset register. Anything unaccounted for gets investigated. Treat unknown drives as sensitive and do not connect them to a working machine.
Can we just throw small devices out with e-waste?
No, not if they held business or customer information. The FTC expects businesses to make sensitive information unreadable before disposal. Send small storage-capable devices through a documented destruction process and keep the certificate.
Sources
- FTC: Protecting Personal Information, A Guide for Business
- FTC: Digital Copier Data Security, A Guide for Businesses
- FTC Disposal Rule, Federal Register notice (16 CFR Part 682)
- NIST ITL Bulletin on SP 800-88 Revision 1, Guidelines for Media Sanitization
- How IoT Re-using Threatens Your Sensitive Data
- Amazon Echo Dot or the reverberating secrets of IoT devices (ACM)
- Tom’s Hardware: open-source stealth USB with a decoy drive
- Active Intel: Extracting Hidden Data From Routers and Devices