Skip to content 
Datenträger
When people hear "data carrier", most think of hard drives and USB sticks. When decommissioning IT, however, data carriers are also found in printers, smartphones, routers and servers, often where nobody expects them. This glossary entry explains what a data carrier is, which types exist and how to erase or destroy them securely when decommissioning.
In brief
A data carrier is a medium on which information is stored permanently, for example a hard drive, an SSD, a USB stick, a DVD or a magnetic tape. Depending on the technology, it stores data magnetically, electronically or optically. In IT decommissioning, every data carrier must be recorded and then verifiably erased or destroyed, because otherwise deleted files can often be recovered.
What is a data carrier?
A data carrier stores information in such a way that it is retained even without power. That distinguishes it from main memory (RAM), which loses its content when switched off. Experts also speak of a storage medium. In the broader sense, paper is also a data carrier, because information is stored permanently there too.
For data protection, what matters is not what a data carrier looks like but what is on it. If it contains personal data, the protection obligations of the GDPR apply until the data has been verifiably removed. This also applies to data carriers that are permanently installed in a device.
Types of data carriers
The DIN 66399 standard divides data carriers for destruction into six material classes . The classification also helps with erasure, because every technology needs its own methods.
| Storage technology | Examples | DIN 66399 material class |
|---|---|---|
| Magnetic hard drives | HDD in PCs, servers, printers and NAS systems | H |
| Electronic storage (flash) | SSD, USB stick, memory card, eMMC in smartphones and tablets, chip cards | E |
| Other magnetic data carriers | Magnetic tape (LTO), floppy disks, magnetic stripe cards | T |
| Optical data carriers | CD, DVD, Blu-ray | O |
| Films | Microfilm, transparencies | F |
| Paper | Printouts, files | P |
Important for IT: an HDD belongs to class H, an SSD to class E. On a flash chip, large amounts of data fit on the smallest area. That is why the standard requires considerably smaller particles for electronic data carriers than for hard drives.
Hidden data carriers in devices
Many devices contain data carriers that nobody notices in everyday use. When decommissioning, they are easily overlooked:
- Multifunction printers and copiers: often store scanned and printed documents on an internal hard drive or SSD.
- Smartphones and tablets: have permanently soldered flash memory with emails, contacts and chat histories.
- Network devices: Routers, switches and firewalls store configurations, access credentials and keys in flash memory.
- Servers and storage systems: often contain many drives, plus boot media and memory cards on the mainboard.
- Accessories: USB sticks in drawers, external backup hard drives and memory cards in cameras.
Hidden areas also exist within a drive. Hard drives can hide storage space from the operating system, for example via a Host Protected Area. SSDs keep spare blocks in reserve that normal software cannot reach. Data that remains despite attempts to delete it is called Data remanence.
Rule of thumb: a data carrier that is not recorded will not be erased either. Security begins with the complete list.
What to note when retiring devices
For every data carrier there are two secure paths: erase with certification or destroy physically. Which one fits depends on the condition and on the protection requirement of the data.
- Erasing: Working data carriers can be overwritten or sanitized with verified software so that the data can no longer be reconstructed. The device remains usable and can be resold.
- Destroying: Defective or non-erasable data carriers are shredded in accordance with DIN 66399. The appropriate level results from protection class and material class, for hard drives with sensitive data often Security level H-5.
Formatting, factory reset or deleting files are not enough. These steps usually remove only references, not the data itself. For both paths you need proof for each serial number. Only in this way can the Chain of custody be documented without gaps.
Example: dissolving a server room
A simplified example shows how many data carriers are hidden in a small inventory. A company dissolves a server room: three servers, a storage system, two switches, a firewall and a cabinet with backup tapes.
- IT lists all devices with serial numbers and counts the drives per server and storage system.
- During the inventory, boot memory cards in the servers and a box of USB sticks are also found.
- Working drives are erased with certification. Two defective hard drives and all tapes are destroyed.
- The configurations of the network devices are reset and the devices are tested.
- In the end, an erasure or destruction certificate is available for every data carrier.
Without the second check, memory cards and USB sticks would have gone unnoticed.
Data carriers at Second IT
At goods receipt, Second IT checks every delivered device for all storage media, including forgotten USB sticks or hidden data carriers, and registers them by serial number. Working HDDs and SSDs are erased with Blancco, including hidden areas such as HPA and DCO. For every device there is a digitally signed erasure certificate. Data carriers that cannot be erased in an audit-proof manner for technical reasons are destroyed in-house in accordance with DIN 66399, certified for security level H-5, under video surveillance and with a certificate of destruction. Before destruction, they are stored in security zones with controlled access. More on in-house data carrier destruction.
Distinction from related terms
"Data carrier" is the umbrella term. "Storage medium" is usually used synonymously. A drive is, strictly speaking, the device that reads and writes a data carrier; with hard drives and SSDs, the two form one unit. An end device such as a notebook is not a data carrier but contains one or more. For small flash data carriers there is a separate entry on the topic Destroying a USB stick. Which GDPR obligations apply to the disposal of data carriers is explained in our guide Disposing of data carriers under the GDPR. Which destruction level your data carriers need can be read in the guide on DIN 66399.
Frequently asked questions about data carriers
What is a data carrier, simply explained?
A data carrier is anything on which information is stored permanently, for example a hard drive, an SSD, a USB stick, a DVD or a sheet of paper. The data remains even without power.
Is an SSD a data carrier like a hard drive?
Yes, but with different technology. A hard drive stores magnetically on rotating platters, an SSD electronically in flash chips. That is why different methods apply for erasure and a different material class for destruction.
Which devices contain hidden data carriers?
Often overlooked are multifunction printers, copiers, smartphones, tablets, routers, firewalls and memory cards in servers. For every decommissioning, check whether a device can store data.
Is it enough to format a data carrier?
No. Formatting usually only recreates the directory structures. The data itself often remains readable and can be recovered with simple tools. Only verified erasure methods or destruction are secure.
Erase or destroy: which is better?
Both can be secure. Erasing working data carriers with certification allows the device to continue to be used. Defective or non-erasable data carriers are destroyed in accordance with DIN 66399. What matters is the proof for each serial number.
Every data carrier recorded, erased or destroyed, with a certificate for each serial number.
Send us your device list. You will receive your offer in 48 hours on average.