2026-08-24

Selling or trading in an old laptop? Deleting your files is not the same as erasing them

Every laptop, phone, and external drive you own eventually leaves your hands — sold on a marketplace, handed to a trade-in kiosk, returned to a store, donated, or dropped in a recycling bin. Before that moment, most people do the same thing: delete their files, maybe run a factory reset, and hand the device over feeling reasonably careful. The research on what happens next is remarkably consistent, and remarkably bad. When Blancco bought 159 used drives on eBay in the US and Europe, 42% still held data readable by anyone with basic IT skills, and 15% contained personally identifiable information — scanned passports and birth certificates, CVs, financial records, five gigabytes of one travel company's internal email. The detail that should stop you: every seller in that study said they had wiped the drive first. This post is about why deletion fails, why even the professionals keep failing at it, and why a file that spent its life encrypted is the one thing on the disk that doesn't depend on the wiping going right.

"Deleted" files are mostly still there

Deleting a file removes the reference to it, not the bytes; until something happens to overwrite them, ordinary recovery tools can bring the file back. Factory resets are better but not the guarantee they sound like: in an overview of the research written for The Conversation in April 2025, Ritesh Chugh of CQUniversity Australia cites findings that around 90% of second-hand laptops, hard drives, and memory cards still contain recoverable data — and that in one analysis of resold phones, 35% still held recoverable data after a factory reset. Solid-state drives add a twist of their own: wear-leveling spreads writes across memory cells the operating system can't directly address, so the overwrite-everything tools that worked on spinning disks can leave untouched copies behind on an SSD. None of this requires an attacker with a forensics lab. It requires a buyer, a free recovery utility, and curiosity.

Even the return counter gets it wrong

You might assume this is only a problem for individual sellers who skip a step, and that a big retailer's refurbishing pipeline handles it properly. In January 2026, the Office of the Privacy Commissioner of Canada published the results of its investigation into Staples Canada, which had been reselling customer-returned devices through its Openbox program: returned laptops were going back on the shelf without being fully wiped. Of the returned devices the investigators tested from four Ontario stores, 23% still contained the previous owner's personal information — names, email addresses, account details, fragments of email. The finding that makes it structural rather than a one-off lapse: a 2011 audit of the same company had found the same problem, and fifteen years of promised improvements later, it was still there. The lesson for anyone returning or trading in a device is uncomfortable but simple: once the machine leaves your hands, the wiping is somebody else's job, performed to somebody else's standard, and audits keep finding it undone.

Encryption changes what leftover bytes mean

This is why the security world treats encryption not just as protection against theft but as a disposal strategy. NIST's media-sanitization guidance — Special Publication 800-88, revised in September 2025 — recognizes a sanitization method called cryptographic erase: when data was stored encrypted, you can render it unrecoverable by destroying the key, because ciphertext without a key is noise no recovery tool can do anything with. The same logic works at the level of a single file, and it works in your favor precisely when everything else fails. A tax archive, an ID scan, or a password backup that only ever touched the disk as an encrypted file can be deleted sloppily, missed by a factory reset, left in a forgotten corner of an old external drive — and what the Blancco researchers or the curious buyer recovers is still just ciphertext. The practical consequence is about timing: encryption pays off at disposal only if it happened at storage. The night before you sell the laptop is the wrong time to start; the day a sensitive file first lands on the disk is the right one.

What file encryption doesn't fix here

Being precise about the limits matters more in this scenario than most. Encrypting a file today does not reach backward: if the document spent two years on the disk as plaintext before you encrypted it, remnants of that plaintext period may still be recoverable, and no file-level tool fixes that. NearSeal is not a wiping utility, and nothing in this post is a substitute for doing the disposal properly — turn on full-disk encryption (FileVault, BitLocker, or your phone's default encryption) well before the device's last day, and perform the reset the manufacturer prescribes, which on an encrypted device is precisely what makes the crypto-erase logic kick in. File-level encryption is the complementary layer for everything full-disk encryption doesn't follow: the files you copy off the machine before selling it, the external drives and USB sticks and memory cards that have no operating system to encrypt them — the exact category the studies above keep buying on eBay — and the archives that outlive any one device.

Where NearSeal fits

NearSeal encrypts files entirely in your browser: the file and the passphrase never leave your device, there is no account and no upload, which you can verify from the network tab — nothing is transmitted anywhere. It encrypts with AES-256-GCM, deriving the key from your passphrase with PBKDF2-SHA256 at 2²⁰ iterations, and decryption recognizes an encrypted file by its actual bytes, not its name or extension. For archives meant to outlive your current hardware, the opt-in age-encryption.org format is worth a look: an age file opens in the official age CLI, rage, or any other age-compatible tool, so the file's future doesn't depend on this website's. One caveat is the whole point of this post turned around: there is no recovery. Nobody, including NearSeal, holds your passphrase, so to a future you without it, the file is exactly as unreadable as it is to the stranger who bought your old drive. Keep the passphrase in a password manager or written down somewhere that isn't the device — and then the next time a laptop leaves your life, the question "did the wipe actually work?" stops being the only thing standing between your files and their next owner.