The Client Who Wants Their Old Drive Back
A returning client brings in a four-year-old laptop with a failing 1 TB hard drive. You have cloned the drive to a new SSD and the laptop now boots correctly. The old drive still contains the client's tax records, medical correspondence and about 40 GB of family photos. The client says, 'Just keep the old drive, I don't want it, do whatever you do with them.' Your workshop's standard procedure is to wipe drives with a three-pass overwrite before disposal, but the workshop is busy and the technician on duty suggests putting it in the general e-waste bin because 'it's going to be shredded anyway'. The client has not signed anything yet.
1. What should happen to the old drive, and what documentation is required? Justify your answer against privacy and environmental obligations.
Read the worked answer
What should happen: the drive should be sanitised (three-pass overwrite as per procedure, or physical destruction if overwrite fails) and then sent to a certified e-waste recycler, not the general bin. The client's verbal 'do whatever' is not sufficient authority to skip the procedure.
Documentation required:
- A written authorisation signed by the client stating what will happen to the old drive (returned, wiped, or destroyed) and when.
- A data-handling record: drive serial number, method of sanitisation, date, technician initials.
- An e-waste transfer record from the recycler.
Reasoning:
- Privacy: the drive holds sensitive personal information (tax, medical). Australian Privacy Principles require an organisation to destroy or de-identify personal information it no longer needs, and to take reasonable steps to protect it. 'It'll be shredded' is an assumption, not a verified control.
- Environmental: e-waste contains heavy metals and must not go to landfill; recyclers must be accredited so the chain of custody is traceable.
- Professional: an unsigned instruction leaves the workshop exposed if the data later surfaces. Get it in writing before anything leaves the premises.
2. The client later phones and says they have changed their mind and want the old drive back. It has already been wiped. Outline how you would handle the conversation and what the workshop should learn from this.
Read the worked answer
Handling the call:
- Acknowledge and listen - let the client explain why they want it (often they realise photos were only on that drive).
- Be honest - state clearly that the drive was wiped on [date] under the signed authorisation, and explain what wiping means (data unrecoverable by normal means).
- Check the new drive - confirm the clone is complete and the photos and records are present on the SSD, and offer to verify with them.
- Offer remedies - if any data is missing, discuss professional data-recovery options and their cost, and escalate to the supervisor.
- Document - record the call, the client's response and any agreed remedy.
Lessons for the workshop:
- Do not act on verbal instructions for data-bearing media; use a signed form that lists the options and the consequences.
- Build a hold period (e.g. seven days) before sanitising any drive, so a change of mind is possible.
- Confirm backups with the client before wiping - ask 'is everything you need on the new drive?'
- Train staff that 'it will be shredded anyway' is not a data-security argument; the chain of custody is what matters.