When storage media is decommissioned, returned, repurposed, or removed from the operating environment, proper data sanitization (Media Sanitization) is essential. This is the only reliable way to prevent unauthorized access to or disclosure of your data, private data or third-party data like customer data. Industry-wide best practices for data sanitization are defined in the National Institute of Standards and Technology's Special Publication NIST SP 800-88 ("Guidelines for Media Sanitization"). Make sure you are aware of the appropriate sanitization method based on your operational, regulatory, and compliance requirements.

Many storage appliances, such as NAS systems, and devices with permanently installed storage media support system decommissioning functions specifically aligned with official data sanitization requirements or recommended by the vendor as a best practice. These processes ensure that all data stored on system media is completely erased or rendered inaccessible before the media or device is reused or disposed of.

Brief Operational Guidance

Micropolis recommends carefully reviewing your internal data protection policies as well as the applicable legal requirements to determine the appropriate sanitization method. For highly sensitive data or environments subject to strict compliance requirements, it is strongly recommended to perform at minimum a software-defined overwrite procedure before decommissioning a system. For elevated privacy requirements, a physical destruction of storage media may be indicated.

Data sanitization should be firmly integrated into the standard operating procedures (SOPs) for system shutdown and decommissioning to ensure consistent and fully auditable handling of sensitive information. Customers are advised to integrate tool-assisted procedures for tracking the end-to-end life-cycle of storage media and to provision an immutable ledger of wipe certificates and auditable proof of destruction or disposal. Where external ITAD providers are used, appropriate care should be taken to ensure that they comply with all applicable requirements and carry out the relevant procedures properly and in accordance with the defined processes. NIST SP 800-88 Rev. 2 that was finalized in September 2025 and superseded Rev. 1. Rev. 2 decidedly shifts the emphasis toward establishing an organizational media-sanitization program, validation, modern sanitization practices, and cryptographic erase.

Micropolis Chroma™ provides end-to-end, fine-grained storage media management, with flexible processes based on an immutable, externally verifiable ledger for secure and auditable handling of storage hardware.

Links and reference

• NIST SP 800-88 Rev. 2 - Guidelines for Media Sanitization Computer Security Resource Center of the United States of America
• Permanently erasing data on hard disks and smartphonesFederal Office for Information Security of Germany (BSI)

---

Choose the Required Sanitization Outcome

A sanitization method should be selected according to the media technology, sensitivity of the data, intended disposition, and applicable policy. NIST describes three broad sanitization outcomes:

• Clear: Applies logical techniques through normal device interfaces to protect against straightforward, non-invasive recovery. Clearing is commonly used when functional media will remain under organizational control.
• Purge: Uses logical or physical techniques intended to make recovery infeasible even with advanced laboratory methods. Depending on the technology, this may include device-native sanitization, cryptographic erase, or degaussing.
• Destroy: Makes the media unusable and the stored information infeasible to recover. This is appropriate when media cannot be reliably sanitized, contains exceptionally sensitive information, or is leaving organizational control under a policy requiring destruction.

These are outcomes rather than interchangeable commands. A zero overwrite may clear an HDD but be inadequate for an SSD. Similarly, merely issuing a command does not establish that a purge was successful: the operation must be supported by the device, complete without errors, and be validated according to organizational policy.

Common Media Sanitization Mistakes

• Assuming file deletion is sufficient.Deletion normally removes a filesystem reference; it does not necessarily overwrite the underlying data.
• Treating formatting as sanitization. A quick format usually rebuilds filesystem metadata while leaving much of the previous content recoverable.
• Using the same procedure for HDDs and SSDs. Flash translation layers, wear leveling, and spare capacity make host-level overwriting unreliable for flash media.
• Using unnecessary multipass overwrites. One complete overwrite is generally sufficient to clear a functioning modern HDD. Legacy 7-, 35-, or higher-pass patterns consume time without providing meaningful additional protection.
• Treating TRIM or discard as proof of erasure. These operations inform a flash device that blocks are no longer required, but they do not necessarily prove that every physical copy was immediately erased.
• Ignoring encryption keys. Cryptographic erase is only reliable when all relevant keys, wrapped key copies, escrow records, and recovery material are controlled.
• Forgetting secondary copies. Backups, snapshots, replicas, caches, removable cards, RAID cache devices, cloud versions, and exported datasets require separate treatment.
• Trusting a completion message without validation. Firmware defects, unsupported commands, failing media, USB bridges, and storage controllers can prevent an operation from reaching the intended device.
• Sending unsanitized media to a recycler. Recycling and sanitization are separate activities unless the provider is explicitly contracted and audited to perform both.
• Failing to retain evidence. Without asset identifiers, method records, results, and chain-of-custody information, an organization may be unable to demonstrate compliance.

A Secure Media Sanitization Process

1. Identify the media.
   Record the asset ID, manufacturer, model, serial number, media type, capacity, encryption status, and current custodian. For an appliance, include boot devices, cache SSDs, NVRAM, removable media, and every RAID member.
2. Determine what data it contains.
   Identify the owners, classification, regulatory obligations, retention requirements, and any legal or investigative hold.
3. Establish the final disposition.
   Decide whether the media will be reused internally, transferred, returned under warranty, sold, recycled, or destroyed.
4. Select an approved outcome and technique.
   Use the current organizational standard, device documentation, and applicable regulatory requirements - not a generic wiping recipe.
5. Authorize and perform the operation.
   Require appropriate privileges and, for sensitive systems, peer verification of both the device serial number and selected method.
6. Verify completion.
   Confirm that the tool or device completed the requested operation without errors. Capture status logs, completion codes, tool versions, and firmware information.
7. Validate the result.
   Determine whether the evidence is sufficient for the required outcome. This may include readback testing, reviewing device sanitization logs, confirming key destruction, inspecting destroyed material, or applying an approved sampling plan.
8. Document and approve disposition.
   Record the operator, date, asset, method, result, exceptions, validator, and destination. A certificate should describe what was actually demonstrated rather than simply state “securely erased.”

Failed or inaccessible media should enter an exception workflow. It must remain protected and tracked until an alternative purge or destruction method has been completed.

Wiping Hard Disk Drives

For a functioning modern magnetic HDD, one complete overwrite through a reliable interface is generally sufficient for a Clear outcome. Zeros are normally adequate; random data and repeated overwrite patterns do not provide a practical advantage for ordinary HDD sanitization.

Host-level overwriting nevertheless has limitations. It may not reach sectors already remapped by the drive, host-protected areas, device configuration overlays, or storage hidden behind an appliance controller. A RAID controller or USB adapter may also block device-native commands or expose only a logical volume.

Where a Purge outcome is required, use a supported ATA or SCSI sanitization function, an appropriately implemented cryptographic erase, or another approved technique. Check the device documentation, operation status, and error logs. Do not assume every firmware implementation behaves correctly merely because the command exists.

Degaussing is applicable only to magnetic media and requires equipment rated for the media's coercivity. It does not sanitize SSDs, USB flash drives, or optical discs, and it normally renders an HDD unusable. Drives that are damaged, cannot complete sanitization, or contain data requiring a Destroy outcome should be passed to controlled physical destruction.

SSDs, NVMe, and Other Flash Storage

or Why Conventional Overwriting Is Problematic with solid-state-memory.

An operating system sees logical block addresses, while an SSD controller maps those addresses to physical flash cells. Wear leveling continually changes that mapping, garbage collection relocates data, and over-provisioned capacity is not normally visible to the host. Defective blocks and retired cells can also retain data that ordinary write commands cannot address.

Consequently, overwriting every visible logical block does not prove that every historical physical copy was overwritten. It also causes unnecessary write wear. The same concern applies to NVMe SSDs, SATA SSDs, USB flash drives, memory cards, and embedded flash storage.

Prefer a device-native mechanism supported by the applicable specification and the device firmware:

• NVMe Sanitize, using an appropriate block-erase or cryptographic-erase action and checking the sanitize status log.
• NVMe Format secure-erase settings, where supported and approved for the device and required outcome.
• ATA Secure Erase or ATA Sanitize for compatible SATA devices.
• SCSI SANITIZE for supported SCSI and SAS storage.
• Cryptographic erase for properly implemented self-encrypting or encrypted storage.

TRIM, discard, or a quick format should not be treated as sanitization unless the device specification and organizational policy explicitly establish the required behavior. Device commands may also be blocked by RAID controllers and USB enclosures; direct attachment or an appliance-supported decommissioning procedure may be necessary.

If a flash device does not support an appropriate sanitization mechanism, fails during the procedure, or cannot provide sufficient evidence for highly sensitive data, destroy the flash packages using an approved process.

Cryptographic Erase: When and Why to Use It

Cryptographic erasure (aka Crypto-shredding or crypto erase) renders encrypted data inaccessible by irreversibly sanitizing (deleting or overwriting) the encryption keys needed to decrypt it. Because only a relatively small amount of key material must be removed, the operation can be much faster than overwriting a large drive.

It is appropriate only when:

• All relevant data was encrypted from the beginning of its storage lifecycle.
• The encryption implementation and algorithms meet organizational requirements.
• Keys are sufficiently strong, unique, and not derivable from retained credentials.
• All copies of the relevant keys can be sanitized, including key-encryption keys, escrow copies, recovery keys, backups, TPM-protected material, and KMS records.
• Plaintext was not written to unencrypted caches, swap devices, crash dumps, replicas, or previous media.
• The device or service supplies enough evidence to validate successful key sanitization.

Deleting a password is not necessarily cryptographic erase. A password may merely unlock a key retained elsewhere. The security of cryptographic erase depends more on encryption architecture and key management than on the apparent speed of the erase operation.

Optical Media

Write-once CD, DVD, and Blu-ray media cannot be reliably sanitized for reuse. Sensitive write-once discs should be destroyed with equipment approved for optical media. Scratching the label surface, breaking a disc by hand, or placing it in an ordinary paper shredder is neither safe nor necessarily sufficient.

Rewritable optical media may support a complete erase, but a quick erase normally removes only filesystem structures. For sensitive information or external disposal, physical destruction is usually more defensible than attempting to validate an aging rewritable format.

Mobile Devices

Modern phones and tablets commonly use storage encryption, making a vendor-supported factory reset an effective cryptographic sanitization operation when correctly implemented. However, this should be confirmed for the specific hardware, operating-system version, and management configuration.

Before releasing a mobile device:

• Use the vendor or enterprise MDM wipe procedure and confirm successful completion.
• Remove physical SIM cards, microSD cards, and other removable storage.
• Delete or transfer eSIM profiles as required.
• Remove activation locks and organizational enrollment only after sanitization has been confirmed.
• Account for synchronized cloud data, local backups, and management-system exports.

Remote wipe is useful for lost devices but depends on the device receiving and completing the command. A queued command is not evidence of sanitization. Broken devices that cannot be reset should remain controlled and be destroyed or handled through an approved repair-and-sanitize process.

Cloud Storage

Cloud deletion is governed by the provider's architecture and contractual controls. Deleting an object may leave versions, snapshots, soft-deleted records, replicas, cached copies, backups, logs, or exported datasets subject to separate retention schedules.

A cloud sanitization procedure should address:

• Object versioning, recycle bins, soft-delete windows, snapshots, and immutable backups.
• Cross-region replicas, content-delivery caches, search indexes, and analytics copies.
• Retention policies, legal holds, account closure, and eventual backup expiration.
• Customer-managed and provider-managed encryption keys.
• The provider's physical-media sanitization and destruction commitments.
• Deletion logs, attestations, and contractual evidence.

Deleting a customer-managed key can provide cryptographic erasure where the design supports it, but it does not automatically satisfy every deletion requirement. The organization must understand which data the key protects, whether other key copies exist, and whether retained metadata or plaintext replicas remain.

When Physical Destruction Is Required

Physical destruction is appropriate when media cannot be accessed or reliably sanitized, policy mandates destruction, the data sensitivity outweighs reuse value, or an untrusted destination would create unacceptable residual risk.

The destruction method must match the technology. Crushing a drive enclosure may leave intact platters or flash packages. Approved shredding, disintegration, pulverization, degaussing of eligible magnetic media, or another controlled process should reduce the data-bearing components to the required condition or particle size.

Maintain chain of custody until destruction is complete. Evidence should identify each asset, the destruction method, date, operator or provider, inspection result, and final recycling destination. IT asset disposition providers should be contractually controlled and periodically audited rather than trusted solely on the basis of a generic destruction certificate.

Suggested Erasure and Sanitization Tools

Warning: These tools can irreversibly destroy the wrong device. Tool selection does not establish compliance by itself. Confirm the physical serial number, disconnect unrelated media where practical, and use peer approval for high-risk operations.

• Linux: nvme-cli for supported NVMe sanitize and secure-format operations; hdparm for supported ATA Secure Erase operations; sg3_utils for SCSI/SAS sanitization; and blkdiscard only when secure discard is explicitly supported and approved.
• HDD overwrite environments: nwipe and its bootable ShredOS environment provide an open-source option for clearing HDDs. They should not be used as evidence that inaccessible SSD cells were purged.
• Windows: DiskPart's clean all can clear an HDD by writing zeros across its visible address space. For SSD purge operations, prefer a supported device or system-vendor utility, or use a controlled boot environment capable of issuing the appropriate native command.
• macOS: Erase Assistant on eligible Apple silicon and T2-equipped Macs uses the platform's encryption architecture to make user data inaccessible. Disk Utility secure-erase options are principally relevant to magnetic media and are intentionally unavailable for many SSDs.
• Appliances: Prefer a documented vendor decommissioning function when it covers every data-bearing component and produces usable status evidence. Confirm whether it includes cache devices, boot media, logs, and all RAID members.

Utilities intended to erase individual files or free space - such as shred, SDelete, or filesystem cleaners—should not be confused with whole-device sanitization. Copy-on-write filesystems, snapshots, journals, SSD remapping, and backups can preserve additional copies.

Frequently Asked Questions

Is formatting a hard drive enough?
Usually not. A quick format primarily recreates filesystem metadata. A full format may overwrite visible storage on some systems, but its precise behavior must be verified before it is treated as sanitization.

Is deleting a file enough to remove it permanently?
No. The data may remain in unallocated blocks, snapshots, journals, caches, backups, or SSD cells. Whole-device sanitization is more reliable when the device is being retired.

How should an SSD be sanitized?
Use an approved NVMe, ATA, or SCSI device-native sanitize operation, or a validated cryptographic erase. Avoid relying on conventional overwriting or TRIM alone.

Is cryptographic erase secure?
It can be, provided the data was always strongly encrypted and every relevant key copy can be irreversibly sanitized. Weak key management can invalidate the entire procedure.

Can a factory reset sanitize a device?
Sometimes. On a modern encrypted mobile device or eligible computer, a vendor-supported reset may perform cryptographic erasure. The result depends on the model, implementation, operating-system version, and successful completion.

How is cloud storage sanitized?
Use provider deletion controls while accounting for versions, snapshots, replicas, backups, retention periods, and encryption keys. Contractual assurance is required for the provider's underlying physical media.

When should storage media be physically destroyed?
Destroy it when required by policy, when sanitization cannot be completed or validated, when the device is damaged, or when residual risk exceeds the value of reuse.

Conclusion

Media sanitization is not simply “wiping a drive.” It is a controlled, risk-based process that selects an appropriate Clear, Purge, or Destroy outcome according to the data, storage technology, final disposition, and applicable obligations.

The process is complete only when the operation has been verified, the result has been validated, exceptions have been resolved, and defensible evidence has been retained. By combining technology-appropriate methods with sound key management, chain-of-custody controls, and auditable records, organizations can retire or repurpose storage without carrying sensitive data into its next lifecycle.

Micropolis Chroma™ provides end-to-end storage media management, enabling organizations to capture tamper-proof, defensible evidence in an immutable, verifiable ledger powered by blockchain technology.