Wiping devices

Depending on the Absolute product licenses associated with your account, the Wipe feature may not be available.

You can use the Wipe feature to remotely remove all sensitive data from your Windows and Mac devices before you reuse, resell, or dispose of them. This process is known as data sanitization The process of permanently removing or destroying the data stored on a device. A sanitized device is left with no usable data, and advanced forensic tools can't recover the removed or destroyed data..

To remove individual files or folders from a device, submit a File Delete request.

The Wipe feature is very destructive, and a request can't be canceled or undone after it is deployed to a device. To limit the impact of a Wipe request submitted in error or with malicious intent, a request can include a maximum of 100 devices only. To wipe additional devices, submit another request.

To learn more about wiping devices, visit the Learning Hub. To access the Learning Hub, click (Help and Support) on the quick access toolbar and then click Resources > The Learning Hub.

Wipe types

The Wipe feature uses three types of data sanitization processes to wipe devices:

Depending on the Absolute product licenses associated with your account, the Firmware Wipe feature may not be available.

Firmware Wipe is a data sanitization process that is sent to a device over a cellular network and executed from a device's BIOS/UEFI firmware instead of the operating system. It securely erases all data on a device's drives at the firmware level, making it more reliable than the other Wipe types because it doesn't rely on the device being online or its operating system or Secure Endpoint Agent agent being functional. After the wipe completes, no operating system remains on the device.

How it works

Firmware Wipe actions are not processed by the Secure Endpoint Agent, so a Wi-Fi connection is not required. Instead, it uses WWAN connectivity and the Absolute Communications Platform to send Wipe requests to supported devices and to upload the results to the Secure Endpoint Console. After the Wipe request is submitted in the console, the Firmware Cellular Service constructs a signed UEFI secure message and sends a passthrough command to the Communications Platform. The platform delivers the command to the device via the cellular (WWAN) network and powers on the device if it's powered off. The wipe is then executed at the BIOS level, erasing all drives. The results of the Wipe request are sent back upstream to the Secure Endpoint Console for reporting and compliance. A Certificate of Sanitization is generated and made available in Action Requests after the Firmware Wipe action succeeds.

To send a Firmware Wipe action to devices that support it, select the Enable firmware wipe for supported devices option in your Wipe request.

Firmware Wipe conforms to the Purge standard defined in NIST Special Publication 800-88, Revision 1: Guidelines for Media Sanitization, and it is designed to support HIPAA compliance.

Firmware Wipe actions are supported on devices that meet the following requirements:

  • Lenovo ThinkPad X1, X, and T series devices that support:

    For example, the following Lenovo models are supported: ThinkPad X1 Carbon Gen 14, ThinkPad X1 2-in-1 Gen 11, ThinkPad T14s Gen 7 Intel and ThinkPad T16 Gen 5 Intel.

    A carrier contract is not required. Cellular connectivity is included with ThinkShield TraceLock.

  • Windows 11 operating system
  • Absolute Control or Absolute Resilience license that includes ThinkShield TraceLock, or a ThinkShield TraceLock add-on license.

Firmware Wipe actions are not supported on the following devices:

Checking system requirements

To check if devices can run Firmware Wipe requests, open a device report, such as the All Devices page, and add the following report columns:

  • ThinkShield TraceLock > Status

    • Not supported: the device does not meet the system requirements for ThinkShield TraceLock

    • Enabled: the device is registered in ThinkShield TraceLock and the device is ready to run Firmware Wipe requests

    • Pending: the device supports ThinkShield TraceLock and registration is in progress

      Wait for registration to complete (status updated to Enabled) before attempting to submit a Firmware Wipe request.

    • Not enabled: the device supports ThinkShield TraceLock but registration has not started, or it failed

  • ThinkShield TraceLock > Status details
    • If any of the following three values show, the device does not meet the system requirements for ThinkShield TraceLock:

      • Platform not supported

        The device's make and model are not supported. Supported models

      • No cellular module

      • Missing associated device license

    • If the following value shows, registration is in progress:

      • Pending registration with communications platform

      Wait for registration to complete (status updated to Enabled) before attempting to submit a Firmware Wipe request.

    • If the following value shows, reboot the device and wait (up to 24.5 hours) for the next Core agent connection to the Absolute Monitoring Center:

      • Invalid IMEI

      If the issue is not resolved, contact Absolute Technical Support.

    • If any of the following values show, registration was not successful. For assistance, contact Absolute Technical Support:

      • Cannot complete registration on communications platform

      • Cannot complete deregistration with communications platform

      • Cannot determine TraceLock readiness

When a Firmware Wipe action is processed on a device:

  • All drives are wiped. There is no ability to wipe an individual drive.

    If a device has one or more drives that are not manufactured by Lenovo, those drives may fail to be wiped.

  • If a drive on a multi-drive device fails to be wiped, the Wipe request fails and no Certificate of Sanitization is issued.

  • If the device is located in an area where cellular connectivity is unavailable, the Firmware Wipe will fail to be processed.

Also see Reusing a wiped device.

Cryptographic Wipe employs the cryptographic erase The process of permanently removing or destroying the data stored on a device. A sanitized device is left with no usable data, and advanced forensic tools can't recover the removed or destroyed data. data sanitization process, which removes all encryption keys, effectively making all data on a device irretrievable, including the operating system.

You can perform a Cryptographic Wipe on the following devices:

  • Windows devices encrypted by BitLocker Drive Encryption (BitLocker)

  • Mac devices encrypted by FileVault

To send a Cryptographic Wipe action to devices that support it, select the Enable cryptographic wipe for supported devices option in your Wipe request.

A Cryptographic Wipe action conforms to the Purge standard defined in NIST Special Publication 800-88, Revision 1, Guidelines for Media Sanitization, and it is designed to support HIPAA compliance. Although a Purge does not perform any data overwrites, it is recognized as a quick and effective method of data sanitization.

If your devices' encryption keys are backed up remotely, do not use Cryptographic Wipe as a data sanitization method unless you are certain that these keys have already been sanitized, or they are protected from future use. For more information about what to consider before using Crypto Erase, see section 2.6 Use of Cryptography and Cryptographic Erase in NIST Special Publication 800-88, Revision 1, Guidelines for Media Sanitization.

When a Cryptographic Wipe action is deployed to a device:

  • The device's encryption keys are removed. The ciphertext remains on the device, but without an encryption key the encrypted data is unreadable.
  • If the device's Encryption Status is set to Encrypted, the Wipe process takes less than a minute to complete, but if it's set to Used Space Encrypted, the Wipe process may take over two hours.
  • A Certificate of Sanitization is generated and made available in Action Requests after the Cryptographic Wipe is completed, unless the Don't wipe unencrypted free space option is enabled in the Wipe request.

  • Depending on the device, one of the following pages show when a user powers on a wiped device:

    • Windows: BitLocker recovery page

    • Mac: Login page showing one of the following:

      • "Device Wiped" as the username
      • The cached username of a deleted user profile

      In both cases, users cannot log in.

To learn more about how Cryptographic Wipe works, see the Absolute Device Wipe datasheet.

Also see Reusing a wiped device.

The Full-Disk Encryption Status policy is activated on your devices.

Cryptographic Wipe actions are supported on the following devices:

If a device does not meet these requirements, the Cryptographic Wipe option is not available. Use the Delete All Files option to wipe the device.

Also note that devices must be regularly connecting to the Absolute Monitoring Center.

Cryptographic Wipe actions are not supported on the following devices:

When encryption in BitLocker is set to Used Disk Space Only and a device's Encryption Status is Used Space Encrypted An encryption status that is set when all disk space containing data is encrypted by BitLocker Drive Encryption, but free space is not encrypted. This status indicates that the Used Disk Space Only encryption option is enabled in BitLocker. For more information about this option, see Microsoft BitLocker Drive Encryption documentation., only the areas of the disk that currently contain data are encrypted. Any free space on the disk remains unencrypted, which may include remnants of previously deleted data.

A Cryptographic Wipe encrypts this free space before removing the encryption key. This process ensures that all data, including anything that might exist in unencrypted free space, becomes inaccessible. However, if the Don't wipe unencrypted free space option is enabled in the Wipe request, the Wipe process will skip encrypting free space before key removal.

Skipping this step can significantly reduce the time required to complete the Wipe (potentially by more than two hours, especially on large drives). However, because unencrypted free space may still contain recoverable data, a Certificate of Sanitization is not generated for devices when this option is used.

Enable the Don't wipe unencrypted free space option only when minimizing Wipe time is a priority and the possibility of deleted data being recoverable is acceptable.

To use this option, devices must be running version 10.0.0.4 or higher of the Secure Endpoint Agent.

Delete All Files, which is supported on both encrypted and unencrypted devices, is a data sanitization process that overwrites all file content with a series of zeros and ones, essentially making the files unreadable and unrecoverable. It then renames and deletes the files, and deletes all non-OS and user profile data. For Windows devices, you can also disable the operating system.

A Delete All Files wipe action conforms to the Clear standard defined in NIST Special Publication 800-88, Revision 1, Guidelines for Media Sanitization, and it is designed to support HIPAA compliance. After the action is processed on a device, a log file is uploaded to the console. You can then download the log file from Action Requests to demonstrate compliance.

Also see Reusing a wiped device.

Delete All Files wipe actions are supported on devices that are running a supported version of the Windows or Mac operating system. These devices must also be regularly checking in to the Absolute Monitoring Center.

If Dell SupportAssist is installed on a Dell device, disable the System Repair feature or uninstall Dell SupportAssist before submitting a Delete All Files wipe request. Otherwise, your request will not be completed.

To disable the System Repair feature, see Dell SupportAssist documentation. To uninstall Dell SupportAssist, see Windows documentation.

Delete All Files wipe actions are not supported on the following devices:

The following system directories are not deleted by the Delete All Files wipe action:

  • C:\boot.ini
  • C:\bootmgr
  • C:\ntldr
  • C:\bootsect
  • C:\NTDETECT.COM
  • C:\pagefile.sys
  • C:\swapfile.sys
  • C:\boot\
  • C:\System Volume Information\
  • C:\Internet Explorer\
  • C:\Windows\
  • **\\WWANSVC\\**
  • **\\WLANSVC\\**
  • *.PAC

Note that if you select the Disable the Windows OS option in the Wipe request, the following files are deleted:

  • C:\boot.ini
  • C:\bootmgr
  • C:\ntldr
  • C:\NTDETECT.COM
  • C:\boot\

In addition to the files listed above, the Delete All Files wipe action can't delete files/folders that are:

  • encrypted or locked by a third party tool.
  • stored in a volume that is encrypted or locked by a third party tool.
  • stored in a hidden partition.
  • inaccessible because inherited permissions have been disabled.
  • created by a user after the area has already been scanned.
  • recreated automatically by the Windows operating system.

The following system directories are not deleted by the Delete All Files wipe action:

  • /Library
  • /Library/*
  • /System
  • /System/*
  • /sbin
  • /sbin/*
  • /usr
  • /usr/*
  • /bin
  • /bin/*
  • /private
  • /private/*
  • /dev
  • /dev/*
  • /etc
  • /etc/*
  • /var
  • /var/*
  • /tmp
  • /tmp/*
  • /mach_kernel
  • /Developer
  • /Developer/*
  • /home
  • /home/*
  • /net
  • /net/*
  • *.fseventsd
  • *AftIICopyfiles.sh
  • *AftIIInstall.sh
  • *ARAT.tar.gz
  • *ARAT.tar.gz.MD5
  • *stopAndRemoveAFRAT.sh
  • *.DocumentRevisions-V*
  • *.Spotlight-V*

In addition to the files listed above, the Delete All Files wipe action can't delete files/folders that are:

  • encrypted or locked by a third party tool.
  • stored in a volume that is encrypted or locked by a third party tool.
  • stored in a hidden partition.
  • inaccessible because inherited permissions have been disabled.
  • created by a user after the area has already been scanned.

Also note that if a file's file size is very large (> 1 GB) and it exceeds the device's free space, the file can't be deleted.

Note the following considerations about Delete All Files wipe actions:

Also see Reusing a wiped device.

To enable the Delete All Files wipe feature to be supported on your Mac devices, you first need to configure a custom profile and deploy it to the devices using your Mobile Device Management (MDM) application. Specifically, you need to complete the following key steps to be able to delete files in the Desktop, Documents, and Downloads folders on these devices:

Step 1: Download the custom profile. Ensure that you save the file (FileDelete_MDMProfile_v1_0.mobileconfig) with the .mobileconfig file extension.

Step 2: Upload the custom profile and configure it on your MDM server. For more information, refer to MDM documentation.

Step 3: On the MDM server, assign the profile to the applicable Mac devices for deployment. For more information, refer to MDM documentation.

When all wipe types are selected in a Wipe request, they are applied in the following order:

  1. Firmware Wipe

    Firmware Wipe takes precedence over all other Wipe types selected in the request. If a device supports Firmware Wipe, that Wipe type is always applied. If a Firmware Wipe fails on a device that supports it, no other Wipe type is attempted.

  2. Cryptographic Wipe

    Cryptographic Wipe takes precedence over Delete All Files. If a device supports Cryptographic Wipe, that Wipe type is applied (assuming Firmware Wipe is not supported). If a Cryptographic Wipe fails on a device that supports it, a Delete All Files wipe action is not attempted.

  3. Delete All Files

    If a device does not support Firmware Wipe or Cryptographic Wipe, a Delete All Files wipe action is requested.

Creating Wipe requests

Before you submit a Wipe on a Windows device, you can run a Reach script to get a list of the device's files. You can then upload files that you want to retrieve.

Depending on the Absolute product licenses associated with your account, Reach scripts may not be available.

To get a list of the files stored on a Windows device, run the following Reach script:

Retrieve a list of files from a device

This script generates a report file containing details about each file, including its full file path, creation time, last write time, and file size. You can use this information to run a file upload script.

For more information about this script, go to Settings > Script library and search for the script name. Detailed information is provided in the script.

To retrieve files from a Windows device, you can run one of the following scripts:

Script name Description
Upload files to Dropbox Uploads files from a Windows device to Dropbox using the permissions of a custom Dropbox app.
Upload files to FTP server Uploads files from a Windows device to a FTP server.
Upload files to network shared folder Uploads files from a Windows device to a network shared folder using a UNC path.

These scripts generate a report file that is uploaded to the same location as the uploaded files. It contains the number of successful file uploads, along with details about any errors that occurred, such as duplicated file, file not found, and file failed to upload.

For more information about each script, go to Settings > Script library and search for the script name. Detailed information is provided in each script.

To submit Wipe requests, your user role must be granted the Perform permission for Wipe Device. The System Administrator, Security Administrator, and Security Power User default user roles are granted this permission.

To track the status of a Wipe request and view and download its Certificate of Sanitization or log file, your user role must be granted the View permission for Wipe Device. All default Administrator roles and the Security Power User role are granted this permission.

To submit a request:

  1. Log in to the Secure Endpoint Console as a user with the Perform permission for Wipe Device.

  2. Do one of the following:

    On the device's Device Details page, click Wipe.

    If the action is grayed out, one of the following conditions applies:

    1. From the navigation bar, open a page that supports the Wipe action. For example, click Devices to open the Devices > All Devices page.
    2. In the work area, use the search field or filters to find the devices you want to wipe.

    3. In the results grid, select each device you want to include in the request. To select all devices, select the Select All checkbox in the result grid header. To select consecutive devices, select the first device and then hold down the Shift key and select the last device. You can select up to 100 devices per request. To remove all selections, click Clear all.

      By default, this action type is limited to 500 total actions per day per account, but your Administrator can change this amount, or disable the setting. Learn more

    4. Click Wipe. The Wipe devices dialog opens.
  3. [Optional] At the top of the dialog, click Wipe device - <date> and enter a request name that will help you identify and track this request in Action Requests.
  4. [Optional] Click Add description (optional) and enter a description for the request.
  5. If any selected devices support Firmware Wipe, the Enable firmware wipe for supported devices option is shown and selected by default. Do one of the following:
    • To request a Firmware Wipe on all selected devices that support this capability, leave the Enable firmware wipe for supported devices checkbox selected.
    • To not request a Firmware Wipe, clear the Enable firmware wipe for supported devices checkbox.

  6. If any selected devices support Cryptographic Wipe, the Enable cryptographic wipe for supported devices option is shown and selected by default. Do one of the following:

    • To request a Cryptographic Wipe on all selected devices that support this capability:
      1. Leave the Enable cryptographic wipe for supported devices checkbox selected.

      2. If the Don't wipe unencrypted free space checkbox shows, one or more selected Windows devices contains unencrypted free space. Select the checkbox if you want the Wipe process to skip encrypting free space before encryption key removal.

        Enabling this option can significantly reduce the time required to complete the Wipe; however, previously deleted data on a device may remain recoverable. Learn more

        A Certificate of Sanitization is not generated when this option is enabled.

      3. If the Administrator authorization section shows, you selected one or more Mac devices. Enter the Admin user and Admin password of a user with administrative rights on the selected devices. Administrator credentials are required to wipe a Mac device.
    • To not request a Cryptographic Wipe, clear the Enable cryptographic wipe for supported devices checkbox.

  7. Under Delete all files, specify how to wipe the selected devices if Firmware Wipe or Cryptographic Wipe are not supported, or when these Wipe types were not selected in steps 5 and 6:

    1. Click the field in Overwrite the data <#> time(s) and select how many times you want the file content to be overwritten with non-sensitive data (series of zeros and ones). You can select 1, 3, or 7 data overwrites.

      To comply with the Clear standard defined in NIST Special Publication 800-88, Revision 1, Guidelines for Media Sanitization only one data overwrite is required. Other data erasure standards may require more overwrites.

    2. If you selected one or more Windows devices, configure the Disable the Windows OS setting:

      • To delete all non-OS and user profile data on each device, leave this checkbox unselected.

      • To delete all non-OS and user profile data, and disable each device's operating system, select this checkbox. In this case, system files are deleted and Windows cannot be rebooted.

      Also see Reusing a wiped device.

  8. If you selected one or more Windows devices and you want to unenroll the devices from your Absolute account after each device is wiped, select the Unenroll devices after the Wipe is complete checkbox.

    This option is available only if your user role is granted the Perform permission for Unenroll Device. Note that Mac devices are always unenrolled after the Wipe request is processed, regardless of the configuration of this option and your user permissions.

    Also note that the license is not released from the device until after the Wipe is complete and the Unenroll device action has been sent to the device.

  9. Under Review the devices, review the list of devices to confirm that you want to wipe them. If any devices are encrypted, the list is divided into Encrypted Devices and Other Devices. Note that any devices that do not meet the eligibility requirements of the selected action will show an action status of Failed in Action Requests.
  10. Under Confirmation, select the checkbox to acknowledge that the Wipe action can't be stopped or canceled after it's in progress on a device.

  11. Click Wipe x devices.

    • If the Daily action threshold reached dialog shows, the number of devices included in the request exceeds the daily threshold configured and enabled for this action. Learn more

    • If the request can't be processed on some devices due to ineligibility, a notification shows in the top right of the window soon after submitting the request. Click View progress in the notification to view the status of each device on the Action Requests page. If all devices are ineligible, click View devices to review each device's failure reason.

A Wipe request is created and its status is set to Pending. The request is deployed to each device on its next successful connection to the Absolute Monitoring Center, which is typically within a few minutes for Absolute Resilience accounts, or within 15 minutes for Absolute Control accounts, assuming the devices are online. The status of the request is then updated to Processing. If the request requires dual approval, the request remains in the Pending Approval section in Action Requests. The action isn't sent to the device until the request is approved.

After you submit your request, you can go to the History area to do the following:

  • Track the status of the requests
  • View the Certificate of Sanitization after the request is processed and succeeds
  • View the log file after the request is processed (applies to Delete All Files wipe actions only)

  • Cancel a request for devices with a status of Pending

    Requests with a status of Pending have not been deployed to the device yet, so they can be canceled.

  • View the events associated with the submitted request

In Action Requests, your newly submitted Wipe request is shown with a status of Pending.

The Wipe type column shows which data sanitization method (Firmware wipe, Cryptographic wipe or Delete All Files) was applied to each device.

In Event History, a Wipe requested event is logged. In addition, one of the following events is logged for each device, depending on which Wipe type was applied:

  • Firmware wipe requested
  • Cryptographic wipe requested
  • Delete all files requested

After a device is wiped, you may want to prepare the device for reuse. The steps required depend on the Wipe type, the device platform, and the options selected in the Wipe request.

Wipe type Platform Details

Firmware Wipe

 Windows Reimage the device.
Cryptographic Wipe Windows or Mac Reimage the device.
Delete All Files Windows

Do one of the following, depending on whether the operating system was disabled:

  • If you selected the Disable the Windows OS option:

    The following data was deleted:

    • All non-OS and user profile data
    • System files used to boot the operating system

    The Windows operating system is unbootable. Reimage the device.

  • If you did not select the Disable the Windows OS option:

    All non-OS and user profile data was deleted. Note that in some cases, a cached user profile may still exist, but the user cannot log in.

    To reuse the device, you may be able to use Windows System File Checker to restore any missing system files, and then create a new user profile. If the system is not functioning as expected after these steps are completed, reimage the device.

    If you try to reinstall some applications after the device is wiped, you may be presented with an error stating that the application wasn't uninstalled correctly.
Mac Create a new user profile. You do not need to reimage the device.