What degree of physical destruction is sufficient to ensure an SSD is not readable?

Question

My organization has upgraded a few printers and decommissioned the internal SSD hard drives by passing the memory chips through a band saw, cutting each chip into halves, and in some cases tearing whole sections loose from the greenboard.

These printers were used in such a way that they likely have PHI / HIPAA information on them.

I am looking for advice on whether or not this method of destruction was sufficient or not.

I do not believe it is, but would like additional resources.

I have posted what I have found so far as an answer, as it may be the answer to my question, but I am hoping for other input.

Answer 1

No. It is not sufficient physical destruction to ensure that any data is unrecoverable by anyone.

According to https://www.backblaze.com/blog/how-to-securely-recycle-or-dispose-of-your-ssd/, the memory chips themselves must be cut into 1/2 inch (1.27 cm) or smaller pieces.

It’s important to check the specs of any potential shredder to make sure the shred size is small enough to actually destroy the memory chips on your SSD, however. The shred width should be 1/2 inch or less if you want to make sure the chips get properly mashed up.

No, a woodchipper like the one from the movie Fargo does not have a suitable shred width for secure SSD disposal.

If your SSD looks like a hard disk drive, you should be able to take it apart with the right tools (usually the small screwdrivers included with a computer repair kit are all you need). Inside you’ll find the SATA memory chips where data is actually stored; you can remove them and destroy them however you see fit, whether it’s by a shredder or some other destructive means.