Draft NIST Special Publication 800-88 Guidelines for Media Sanitization Revision 1 

Recommendations of the National 

Institute of Standards and Technology 

Richard Kissel 

Matthew Scholl 

Steven Skolochenko 

Xing Li 

C O M P U T E R S E C U R I T Y
 

Computer Security Division 

Information Technology Laboratory 

National Institute of Standards and Technology 

Gaithersburg, MD 20899-8930 

September, 2012 

U.S. Department of Commerce 

Rebecca Blank, Acting

 National Institute of Standards and Technology 

Patrick Gallagher, Director 
 

 

 

Reports on Computer Systems Technology 

The Information Technology Laboratory (ITL) at the National Institute of Standards and 

Technology (NIST) promotes the U.S. economy and public welfare by providing technical 

leadership for the Nation’s measurement and standards infrastructure. ITL develops tests, 

test methods, reference data, proof of concept implementations and technical analysis to 

advance the development and productive use of information technology. ITL’s 

responsibilities include developing technical, physical, administrative, and management 

standards and guidelines for cost effective security and privacy of sensitive unclassified 

information in Federal computer systems. This Special Publication 800-series reports on 

ITL’s research, guidance, and outreach efforts in computer security and its collaborative 

activities with industry, government, and academic organizations. 

National Institute of Standards and Technology Special Publication 800-88 Revision 1
 

Natl. Inst. Stand. Technol. Spec. Publ. Draft 800-88 r1, (August, 2012)
 

Certain commercial entities, equipment, or materials may be identified in this document in 

order to describe an experimental procedure or concept adequately. Such identification is 

not intended to imply recommendation or endorsement by the National Institute of 

Standards and Technology, nor is it intended to imply that the entities, materials, or 

equipment are necessarily the best available for the purpose. 

U.S. GOVERNMENT PRINTING OFFICE
 

WASHINGTON: 2004 
Acknowledgements 
Guidelines for Media Sanitization 

Table of Contents 

Table of Contents ...................................................................................................................... v
 

List of Figures.......................................................................................................................... vii
 

List of Tables............................................................................................................................ vii
 

Executive Summary............................................................................................................... viii
 

1 Introduction......................................................................................................................... 1
 

1.1 AUTHORITY .........................................................................................................1
 

1.2 PURPOSE AND SCOPE .........................................................................................1
 

1.3 AUDIENCE ...........................................................................................................2
 

1.4 ASSUMPTIONS.....................................................................................................2
 

1.5 RELATIONSHIP TO OTHER NIST DOCUMENTS.......................................................3
 

1.6 DOCUMENT STRUCTURE......................................................................................3
 

2 Background......................................................................................................................... 5
 

2.1 NEED FOR PROPER MEDIA SANITIZATION AND INFORMATION DISPOSITION ............5
 

2.2 TYPES OF MEDIA .................................................................................................6
 

2.3 TRENDS IN DATA STORAGE MEDIA.......................................................................6
 

2.4 TRENDS IN SANITIZATION.....................................................................................7
 

2.5 TYPES OF SANITIZATION ......................................................................................7
 

2.6 USE OF CRYPTOGRAPHY AND CRYPTOGRAPHIC ERASE........................................9
 

2.7 FACTORS INFLUENCING SANITIZATION AND DISPOSAL DECISIONS.......................11
 

2.8 SANITIZATION SCOPE ........................................................................................12
 

3 Roles and Responsibilities:............................................................................................ 13
 

3.1 PROGRAM MANAGERS/AGENCY HEADS.............................................................13
 

3.2 CHIEF INFORMATION OFFICER (CIO)..................................................................13
 

3.3 INFORMATION SYSTEM OWNER ..........................................................................13
 

3.4 INFORMATION OWNER .......................................................................................13
 

3.5 SENIOR AGENCY INFORMATION SECURITY OFFICER (SAISO).............................14
 

3.6 SYSTEM SECURITY MANAGER/OFFICER .............................................................14
 

3.7 PROPERTY MANAGEMENT OFFICER ...................................................................14
 

3.8 RECORDS MANAGEMENT OFFICER.....................................................................14
 

3.9 PRIVACY OFFICER .............................................................................................14
 

3.10 USERS ..............................................................................................................14
 

4 Information Sanitization and Disposition Decision Making....................................... 15
 

4.1 INFORMATION DECISIONS IN THE SYSTEM LIFE CYCLE ........................................17
 

4.2 DETERMINATION OF SECURITY CATEGORIZATION ...............................................17
 

4.3 REUSE OF MEDIA ..............................................................................................18
 

4.4 CONTROL OF MEDIA ..........................................................................................18
 

4.5 DATA PROTECTION LEVEL .................................................................................18
 

4.6 SANITIZATION AND DISPOSAL DECISION .............................................................19
 

4.7 VERIFY METHODS..............................................................................................19
 

v 
Guidelines for Media Sanitization 

4.8 DOCUMENTATION ..............................................................................................21
 

5 Summary of Sanitization Techniques ........................................................................... 23
 

Appendix A. Minimum Sanitization Recommendations.................................................... 25
 

Appendix B. Glossary............................................................................................................. 37
 

Appendix C. Tools and Resources....................................................................................... 41
 

Appendix D. Cryptographic Erase Device Guidelines....................................................... 43
 

Appendix E: Device-Specific Characteristics of Interest................................................... 47
 

Appendix F: Sources .............................................................................................................. 48
 

Appendix G: Sample Sanitization Validation Form............................................................ 50
 

vi 
Guidelines for Media Sanitization 

List of Figures 

Figure 4-1. Sanitization and Disposition Decision Flow 16 

List of Tables 

Table 5-1. Sanitization Methods...................................... 23 

Table A-1. Hard Copy Storage Sanitization.................... 26 

Table A-2. Networking Device Sanitization ................... 26 

Table A-3. Mobile Device Sanitization........................... 26 

Table A-4. Equipment Sanitization ................................. 28 

Table A-5. Legacy Magnetic Media Sanitization ........... 28 

Table A-6. Peripherally Attached Storage Sanitization.. 32 

Table A-7. Optical Media Sanitization............................ 32 

Table A-8. Flash-Based Storage Device Sanitization..... 32 

Table A-9. RAM and ROM-Based Storage Device Sanitization 36 

Table D-1. Cryptographic Erase Considerations ............ 43 

vii 
Guidelines for Media Sanitization 

Executive Summary 

The modern storage environment is rapidly evolving. Data generated by one organization 

may pass through systems and storage media of multiple other organizations before arriving at 

rest in the final destination. The pervasive nature of data propagation is only increasing as the 

Internet and data storage systems move towards a distributed cloud-based architecture. As a 

result, more parties than ever are responsible for effectively sanitizing media and the potential 

is substantial for sensitive data to have been collected and retained on the media. This 

responsibility is not limited to those organizations that are the originators or final resting 

places of sensitive data, but also intermediaries who transiently store or process the 

information along the way. The efficient and effective management of information from 

inception through disposition is the responsibility of all those who have handled the data. 

The application of sophisticated access controls and encryption help reduce the likelihood that 

an attacker can gain direct access to sensitive information. As a result, parties attempting to 

obtain sensitive information may seek to focus their efforts on alternative access means such 

as retrieving residual data on media that has left an organization without sufficient Sanitization 

effort having been applied. As a result, the application of effective Sanitization techniques 

and tracking of storage media are critical aspects of ensuring that sensitive data is effectively 

protected by an organization against unauthorized disclosure. 

An organization may choose to dispose of media by charitable donation, internal or external 

transfer, or by recycling it in accordance with applicable laws and regulations if the media is 

obsolete or no longer usable. Even internal transfers require increased scrutiny, as legal and 

ethical obligations make it more important than ever to protect data such as Personally 

Identifiable Information (PII). No matter what the final intended destination of the media is, it 

is important that the organization ensure that no easily re-constructible residual representation 

of the data is stored on the media after it has left the control of the organization or is no longer 

going to be protected at the confidentiality categorization of the data stored on the media. 

Sanitization refers to a process that renders access to target data on the media infeasible for a 

given level of effort. This guide will assist organizations and system owners in making 

practical sanitization decisions based on the categorization of confidentiality of their 

information. It does not, and cannot, specifically address all known types of media; however, 

the described sanitization decision process can be applied universally. It should also be noted 

that Title 40 USC advises system owners and custodians that excess equipment is 

“Educationally useful” and “Federal equipment is a vital national resource.” Wherever 

possible, excess equipment and media should be made available to schools and non-profit 

organizations to the extent permitted by law. 

viii 
Guidelines for Media Sanitization 

1 Introduction 

1.1 Authority 

The National Institute of Standards and Technology (NIST) developed this guide in 

furtherance of its statutory responsibilities under the Federal Information Security 

Management Act (FISMA) of 2002, Public Law 107-347. 

NIST is responsible for developing standards and guidelines, including minimum 

requirements, for providing adequate information security for all federal agency operations 

and assets, but such standards and guidelines shall not apply to national security systems. This 

guideline is consistent with the requirements of Office of Management and Budget (OMB) 

Circular A-130, Section 8b (3), (Securing Agency Information Systems) as analyzed in A-130, 

Appendix IV: Analysis of Key Sections. Supplemental information is provided in A-130, 

Appendix III. 

Nothing in this guide should be taken to contradict standards and guidelines made mandatory 

and binding on federal agencies by the Secretary of Commerce under statutory authority, nor 

should these guidelines be interpreted as altering or superseding the existing authorities of the 

Secretary of Commerce, Director of the OMB, or any other federal official. 

1.2 Purpose and Scope 

The information security concern regarding information disposal and media sanitization 

resides not in the media but in the recorded information. The issue of media disposal and 

sanitization is driven by the information placed intentionally or unintentionally on the media. 

With the advanced features of today’s operating systems, electronic media used on a system 

should be assumed to contain information commensurate with the security categorization of 

the system’s confidentiality. If not handled properly, release of these media could lead to an 

occurrence of unauthorized disclosure of information. Categorization of an information 

technology (IT) system in accordance with Federal Information Processing Standard (FIPS) 

199, Standards for Security Categorization of Federal Information and Information Systems, 

is the critical first step in understanding and managing system information and media. 

Based on the results of categorization, the system owner should refer to NIST Special 

Publication (SP) 800-53, Recommended Security Controls for Federal Information Systems 

and Organizations, which specifies that, “the organization sanitizes information system digital 

media using approved equipment, techniques, and procedures. The organization tracks, 

documents, and verifies media sanitization and Destruction actions and periodically tests 

sanitization equipment/procedures to ensure correct performance. The organization sanitizes 

or destroys information system digital media before its disposal or release for reuse outside the 

organization, to prevent unauthorized individuals from gaining access to and using the 

information contained on the media.” 

1
 
 

Guidelines for Media Sanitization 

This document will assist organizations in implementing a media sanitization program with 

proper and applicable techniques and controls for sanitization and disposal decisions, 

considering the security categorization of the associated system’s confidentiality. 

The objective of this special publication is to assist with decision making when media require 

disposal, reuse, or will be leaving the effective control of an organization. Organizations 

should develop and use local policies and procedures in conjunction with this guide to make 

effective, risk-based decisions on the ultimate sanitization and/or disposition of media and 

information. 

The information in this guide is best applied in the context of current technology and 

applications. It also provides guidance for information disposition, sanitization, and control 

decisions to be made throughout the system life cycle. Forms of media exist that are not 

addressed by this guide, and media are yet to be developed and deployed that are not covered 

by this guide. In those cases, the intent of this guide outlined in the procedures section applies 

to all forms of media based on the evaluated security categorization of the system’s 

confidentiality according to FIPS 199, Standards for Security Categorization of Federal 

Information and Information Systems. 

Before any media are sanitized, system owners are strongly advised to consult with designated 

officials with privacy responsibilities (e.g., Privacy Officers), Freedom of Information Act 

(FOIA) officers, and the local records retention office. This consultation is to ensure 

compliance with record retention regulations and requirements in the Federal Records Act. In 

addition, organizational management should also be consulted to ensure that historical 

information is captured and maintained where required by business needs. This should be 

ongoing, as controls may have to be adjusted as the system and its environment changes. 

1.3 Audience 

Protecting the confidentiality of information should be a concern for everyone, from federal 

agencies and businesses to home users. Recognizing that interconnections and information 

exchange are critical in the delivery of government services, this guide can be used to assist in 

deciding what processes to use for sanitization or disposal. 

1.4 Assumptions 

The premise of this guide is that organizations are able to correctly identify the appropriate 

information categories, confidentiality impact levels, and location of the information. Ideally, 

this activity is accomplished in the earliest phase of the system life cycle. This critical initial 

step is outside the scope of this document, but without this identification, the organization will, 

in all likelihood, lose control of some media containing sensitive information. 

This guide does not claim to cover all possible media that an organization could use to store 

information, nor does it attempt to forecast the future media that may be developed during the 

effective life of this guide. Users are expected to make sanitization and disposal decisions 

based on the security categorization of the information contained on the media. 

2
 
 

Guidelines for Media Sanitization 

1.5 Relationship to Other NIST Documents 

FIPS 199, (Standards for Security Categorization of Federal Information and Information 

Systems); NIST SP 800-60, (Guide for Mapping Types of Information and Information 

Systems to Security Categories) provides guidance for establishing the security categorization 

for a system’s confidentiality. This categorization will impact the level of assurance an 

organization should require in making sanitization decisions. 

FIPS 200, (Minimum Security Requirements for Federal Information and Information 

Systems) sets a base of security requirements that requires organizations to have a media 

sanitization program. 

FIPS 140-2, (Security Requirements for Cryptographic Modules) establishes a standard for 

cryptographic modules used by the USG. 

NIST SP 800-53, (Recommended Security Controls for Federal Information Systems) 

provides minimum recommended security controls, including sanitization, for Federal systems 

based on their overall system security categorization. 

NIST SP 800-53A, (Guide for Assessing the Security Controls in Federal Information 

Systems) provides guidance for assessing security controls, including sanitization, for federal 

systems based on their overall system security categorization. 

NIST SP 800-111, (Guide to Storage Encryption Technologies for End User 

Devices) provides guidance for selecting and using storage encryption technologies. 

NIST SP 800-122, (Guide to Protecting the Confidentiality of Personally Identifiable 

Information (PII)) provides guidance for protecting the confidentiality of personally 

identifiable information (PII) in information systems. 

1.6 Document Structure 

The guide is divided into the following five sections and six appendices: 

 Section 1 (this section) explains the authority, purpose and scope, audience, 

assumptions of the document, relationships to other documents, and outlines 

its structure. 

 Section 2 presents an overview of the need for sanitization and the basic types 

of information, sanitization, and media. 

 Section 3 provides an overview of relevant roles and responsibilities for the 

management of data throughout its lifecycle. 

 Section 4 provides the user with a process flow to assist with sanitization 

decision making. 

 Section 5 provides a summary of several general sanitization techniques. 

3
 
Guidelines for Media Sanitization 

 Appendix A contains the minimum recommended sanitization techniques to 

Clear, Purge, Damage, or Destruct various media. This appendix is to be 

used with the decision flow chart provided in Section 4. 

 Appendix B contains a glossary defining terms used in this guide. 

 Appendix C contains a listing of tools and external resources that can be 

referenced for assistance with media sanitization. 

 Appendix D contains considerations for selecting a storage device 

implementing Cryptographic Erase. 

 Appendix E contains a set of device-specific characteristics of interest that 

users should request from storage device vendors. 

 Appendix F contains a listing of sources and correspondence that was 

essential in developing this guide. 

 Appendix G contains a sample certificate of sanitization form for 

documenting sanitization activities in an organization. 

4
 
Guidelines for Media Sanitization 

2 Background 

Information disposition and sanitization decisions occur throughout the system life cycle. 

Critical factors affecting information disposition and media sanitization are decided at the start 

of a system’s development. The initial system requirements should include hardware and 

software specifications as well as interconnections and data flow documents that will assist the 

system owner in identifying the types of media used in the system. Some storage devices 

support enhanced commands for sanitization, which may make sanitization easier, faster, 

and/or more effective. The decision may be even more fundamental, because effective 

sanitization procedures may not yet have been determined for emerging media types. Without 

an effective command or interface-based sanitization technique, the only option left may be to 

Destruct the media. In that event, the media cannot be reused by other organizations that 

might otherwise have been able to benefit from receiving the repurposed storage device. 

A determination should be made during the requirements phase about what other types of 

media will be used to create, capture, or transfer information used by the system. This 

analysis, balancing business needs and risk to confidentiality, will formalize the media that 

will be considered for the system to conform to FIPS 200, Minimum Security Requirements 

for Federal Information and Information Systems. 

Media sanitization and information disposition activity is usually most intense during the 

disposal phase of the system life cycle. However, throughout the life of an information system, 

many types of media, containing data, will be transferred outside the positive control of the 

organization. This activity may be for maintenance reasons, system upgrades, or during a 

configuration update. 

2.1 Need for Proper Media Sanitization and Information Disposition 

Media sanitization is one key element in assuring confidentiality. Confidentiality is 

“Preserving authorized restrictions on information access and disclosure, including means for 

protecting personal privacy and proprietary information...” [44 U.S.C., Sec. 3542] 

“A loss of confidentiality is the unauthorized disclosure of information.” [FIPS-199, Standards 

for Security Categorization of Federal Information and Information Systems] 

In order for organizations to have appropriate controls on the information they are responsible 

for safeguarding, they must properly safeguard used media. An often rich source of illicit 

information collection is either through dumpster diving for improperly disposed hard copy 

media, acquisition of improperly sanitized electronic media, or through keyboard and 

laboratory reconstruction of media sanitized in a manner not commensurate with the 

confidentiality of its information. Media flows in and out of organizational control through 

recycle bins in paper form, out to vendors for equipment repairs, and hot swapped into other 

systems in response to hardware or software failures. This potential vulnerability can be 

mitigated through proper understanding of where information is located, what that information 

is, and how to protect it. 

5
 
Guidelines for Media Sanitization 

2.2 Types of Media 

There are two primary types of media in common use: 

 Hard Copy. Hard copy media is physical representations of information, most 

often associated with paper printouts. However, printer and facsimile 

ribbons, drums, and platens are all examples of hard copy media. The 

supplies associated with producing paper printouts are often the most 

uncontrolled. Hard copy materials containing sensitive data that leave an 

organization without effective sanitization expose a significant vulnerability 

to “dumpster divers” and overcurious employees, risking accidental 

disclosures. 

 Electronic (or soft copy). Electronic media are the bits and bytes contained in 

hard drives, random access memory (RAM), read-only memory (ROM), 

disks, memory devices, phones, mobile computing devices, networking 

devices, office equipment, and many other types listed in Appendix A. 

In the future, organizations will be using media types not specifically addressed by this guide. 

The processes described in this document should guide media sanitization decision making 

regardless of the type of media in use. To effectively use this guide for all media types, 

organizations and individuals should focus on the information recorded on the media. 

2.3 Trends in Data Storage Media 

Historical efforts to sanitize magnetic media have benefitted from the wide use of a single 

common type of storage medium implemented relatively similarly across vendors and models. 

The storage capacity of magnetic media has increased at a relatively constant rate and vendors 

have modified the technology as necessary to achieve higher capacities. As the technology 

approaches the superparamagnetic limit, or the limit at which magnetic state can be changed 

with existing media and recording approaches, additional new approaches and technologies 

will be necessary in order for storage vendors to produce higher capacity devices. 

Alternative technologies such as flash-based hard drives, or Solid State Drives (SSDs), have 

also become prevalent due to falling costs, higher performance, and shock resistance. SSDs 

have already begun changing the norm in storage technology, and at least from a sanitization 

perspective, and the change is revolutionary (as opposed to evolutionary). Degaussing, a 

fundamental way to sanitize magnetic media, no longer applies in most cases for flash-based 

devices. Evolutionary changes in magnetic media will also have potential impacts on 

sanitization. New storage technologies, and even variations of magnetic storage, that are 

dramatically different from legacy magnetic media will clearly require sanitization research 

and require a reinvestigation of sanitization procedures to ensure efficacy. 

Both revolutionary and evolutionary changes make sanitization decisions more difficult, as the 

storage device may not clearly indicate what type of media is used for data storage. The 

burden falls on the user to accurately determine the media type and apply the associated 

sanitization procedure. 

6
 
 

Guidelines for Media Sanitization 

2.4 Trends in Sanitization 

For storage devices containing Legacy Magnetic media, a single overwrite pass with a fixed 

pattern such as 0s typically prevents recovery of data even if state of the art laboratory 

techniques are applied to attempt to retrieve the data. One major drawback of relying solely 

upon the native Read and Write interface for performing the overwrite procedure is that areas 

not currently mapped to active Logical Block Addressing (LBA) addresses (such as defect 

areas and currently unallocated space) are not addressed. Dedicated sanitize commands 

support addressing these areas more effectively. The use of such commands results in a 

tradeoff because although they should more thoroughly address all areas of the media, using 

these commands also requires trust and assurance from the vendor that the commands have 

been implemented as expected. 

Users who have become accustomed to relying upon overwrite techniques on magnetic media 

and who have continued to apply these techniques as media types evolved (such as to flashbased devices) may be exposing their data to increased risk of unintentional disclosure. 

Although the host interface (e.g. ATA or SCSI) may be the same (or very similar) across 

devices with varying underlying media types, it is critical that the sanitization techniques are 

carefully matched to the media. 

Destructive techniques for some media types may become more difficult or impossible to 

apply in the future. Traditional techniques such as degaussing (for magnetic media) become 

more complicated as magnetic media evolves, because some emerging variations of magnetic 

recording technologies incorporate media with higher coercivity (magnetic force). As a result, 

existing degaussers may not have sufficient force to effectively degauss such media. 

Applying destructive techniques to non-magnetic storage media such as flash is also becoming 

more challenging, as the necessary particle size for commonly applied grinding techniques 

goes down proportionally to any increases in flash storage density. Flash chips already 

present challenges with occasional damage to grinders due to the hardness of the component 

materials, and this problem will get worse as grinders attempt to grind the chips into even 

smaller pieces. 

A list of device-specific characteristics of interest for the application of sanitization techniques 

is included in Appendix E. These can be used to drive the types of questions that media users 

should ask vendors, but ideally this information would be made readily available by vendors 

so that it can be easily retrieved by users to facilitate informed risk based sanitization 

decisions. For example, knowing the coercivity of the media can help a user decide whether 

or not the available degausser(s) can effectively degauss the media 

2.5 Types of Sanitization 

The principal concern of sanitization is ensuring that data is not unintentionally released. Data 

is stored on media, which is connected to a system. This guidance focuses on the media 

sanitization component, which is simply data sanitization applied to a representation of the 

data as stored on a specific media type. Other potential concern areas exist as part of the 

system, such as for monitors, which may have sensitive data burned into the screen. Sensitive 

7
 
 

Guidelines for Media Sanitization 

data stored in areas of the system other than storage media (such as on monitor screens) are 

not addressed by this document. 

When media is repurposed or reaches end of life, the organization makes a decision whether 

and how to sanitize media, based in part on the level of confidentiality of the data. For 

example, a mass-produced commercial PC program contained on a DVD in an unopened 

package is unlikely to contain confidential data. Therefore, the decision may be made to 

simply dispose of the media without applying any sanitization technique. Alternatively, an 

organization is substantially more likely to decide that a hard drive from a system that 

processed PII needs sanitization prior to Disposal. 

Disposal without sanitization should be considered only if information disclosure would have 

no impact on organizational mission; would not result in damage to organizational assets; and 

would not result in financial loss or harm to any individuals 

The security categorization of the information, along with internal environmental factors, 

should drive the decisions on how to deal with the media. The key is to first think in terms of 

information confidentiality, then apply considerations based on media type. 

In organizations, information exists that is not associated with any categorized system. This 

information is often hard copy internal communications such as memoranda, white papers, 

and presentations. Sometimes this information may be considered sensitive. Examples may 

include internal disciplinary letters, financial or salary negotiations, or strategy meeting 

minutes. Organizations should label these media with their internal operating confidentiality 

levels and associate a type of sanitization described in this publication. 

Sanitization is a process to render access to Target Data (the data subject to the sanitization 

technique) on the media infeasible for a given level of recovery effort. The level of effort 

applied when attempting to retrieve data may range widely. For example, a party may attempt 

simple keyboard attacks without the use of specialized tools, skills, or knowledge of the media 

characteristics. On the other end of the spectrum, a party may have extensive capabilities and 

be able to apply state of the art laboratory techniques. 

Clear, Purge , and Destroy are actions that can be taken to sanitize media. The categories of 

Sanitization are defined as follows: 

 Clear- A method of sanitization that applies logical techniques to sanitize data in 

all user-addressable storage locations for protection against simple non-invasive 

data recovery techniques; typically applied through the standard Read and Write 

commands to the storage device, such as by rewriting with a new value or using a 

menu option to reset the device to the factory state (where rewriting is not 

supported). 

 Purge- A method of sanitization that applies physical or logical techniques that 

render Target Data recovery infeasible using state of the art laboratory techniques. 

8
 
Guidelines for Media Sanitization 

 Destroy- A method of sanitization that renders Target Data recovery infeasible 

using state of the art laboratory techniques and results in the subsequent inability 

to use the media for storage of data. 

A more detailed summary of sanitization techniques is provided in Section 5. Sanitization 

requirements for specific media/device types are provided in Appendix A. 

It is suggested that the user of this guide categorize the information, assess the nature of the 

medium on which it is recorded, assess the risk to confidentiality, and determine the future 

plans for the media. Then, the organization can choose the appropriate type(s) of sanitization. 

The selected type(s) should be assessed as to cost, environmental impact, etc., and a decision 

should be made that best mitigates the risk to confidentiality and best satisfies other constraints 

imposed on the process. 

There may be cases where the sanitization decision is to Damage the media containing the 

data. This specific use cases for damage may be where a home user is involved and access to 

technologies or expertise is un-available or in cases where Damage is needed due to the 

immediacy of the threat coupled with the sensitivity of the data. For the intended audience of 

this document, the need for Damage as a sanitization method is not necessary but 

organizations should consider their threat models and Damage capabilities and specify in local 

policy if there is a need for this technique. 

2.6 Use of Cryptography and Cryptographic Erase 

Many storage manufacturers have released storage devices with integrated encryption and 

access control capabilities, also known as Self-Encrypting Drives (SEDs). SEDs feature 

always-on encryption that substantially reduces the likelihood that unencrypted data is 

inadvertently retained on the device. The end user cannot turn off the encryption capabilities 

so ensuring all data in the designated areas is encrypted. 

A significant additional benefit of SEDs is the opportunity to tightly couple the controller and 

storage media so that the device can directly address the location where any cryptographic 

keys are stored, whereas solutions that depend only on the abstracted user access interface 

through software may not be able to directly address those areas. 

SEDs typically encrypt all of the user-addressable area, with the potential exception of 

clearly identified areas dedicated to the storage of pre-boot applications and associated 

data. 

Cryptographic Erase (CE) leverages the encryption of target data by enabling sanitization 

of the target data’s encryption key. This leaves only the ciphertext remaining on the 

media, effectively sanitizing the data. 

Without the encryption key used to encrypt the target data, the data is unrecoverable. 

The level of effort needed to decrypt this information without the encryption key then is 

the lesser of: 

•	 The strength of the cryptographic algorithm used to encrypt the data (including 

mode of operation) 

9
 
Guidelines for Media Sanitization 

• The level of entropy of the target data's encryption 

As a result, sanitization of the target data is reduced to sanitization of the encryption 

key(s) used to encrypt the target data. Thus, with CE, sanitization may be performed 

with high assurance much faster than with other sanitization techniques. The encryption 

itself acts to sanitize the data, subject to constraints identified in this guidelines 

document. Federal agencies must use FIPS 140 validated encryption modules in order to 

have assurance that the conditions stated above have been validated for the SED. 

Typically, CE can be executed in seconds. This is especially important as storage devices 

get larger resulting in other sanitization methods take more time. CE can also be used as 

a supplement or addition to other sanitization approaches. 

Do No Use CE When: 

Devices other than SEDS may also support FIPS 140 validated encryption modules and 

could support CE. Reliance upon CE to purge the media on devices should not occur if: 

The encryption was enabled after sensitive data was stored on the device without 

having been sanitized first, or 

If it is unknown whether sensitive data was stored on the device without being 

sanitized prior to encryption, then CE should not be relied upon as a Purge mechanism. 

Consider Using CE If: 

For all devices supporting encryption where CE is intended for use to Purge the media 

(including SEDs, mobile devices, and other devices), the level of assurance depends on 

the following: 

Encryption of all Data intended for Cryptographic Erase prior to storage on the 

device (including the data, as well as virtualized copies). 

Locations on the media where the Data encryption key is stored (be it the target 

data's encryption key or an associated wrapping key) must be directly accessible 

for sanitization (ensuring the actual location on media where the key is stored is 

addressed) using the appropriate media-specific sanitization technique. 

All copies of the encryption keys used to encrypt the Target Data are sanitized 

If the Target Data's encryption keys are, themselves, encrypted with one or more 

wrapping keys, it is acceptable to perform Cryptographic Erase by Sanitizing a 

corresponding wrapping key. 

And, the ability of a user to clearly identify the commands provided by the device 

to perform the CE operation. 

Other CE Considerations: 

10
 
 

 

Guidelines for Media Sanitization 

If the encryption key (or any key at or below the level of key sanitized during CE) exists 

outside of the storage device (typically due to escrow or injection), there is a possibility 

that the key could be used in the future to recover data stored on the encrypted media. 

Sanitization using CE should not be trusted on devices that have escrowed or injected the 

key(s) unless the organization has a high level of confidence about how and where the 

keys were stored and managed outside the device. Such back-up or escrowed copies of 

data, credentials, or keys should be the subject of a separate device sanitization policy. 

That policy should address backups or escrowed copies within the scope of the devices 

on which they are actually stored. 

A list of applicable considerations, and a sample for how vendors could report the 

mechanisms implemented, is included in Appendix E. Users seeking to implement CE should 

seek reasonable assurance from the vendor (such as the vendor’s report as described in the 

appendix) that the considerations identified here have been addressed and only use FIPS 140 

validated cryptographic modules. 

2.7 Factors Influencing Sanitization and Disposal Decisions 

Several factors should be considered along with the security categorization of the system 

confidentiality when making sanitization decisions. The cost versus benefit of a sanitization 

process should be understood prior to a final decision. For instance, it may not be costeffective to degauss inexpensive media such as diskettes. Even though Clear or Purge may be 

the recommended solution, it may be more cost-effective (considering training, tracking, and 

validation, etc) to destroy media rather than use one of the other options. Organizations can 

always increase the level of sanitization applied if that is reasonable and indicated by an 

assessment of the existing risk. 

Organizations should consider environmental factors including (but not limited to): 

 What types (e.g., optical non-rewritable, magnetic) and size (e.g., megabyte, gigabyte, 

and terabyte) of media storage does the organization require to be sanitized? 

 What is the confidentiality of the data stored on the media? 

 Will the media be processed in a controlled area? 

 Should the sanitization process be conducted within the organization or outsourced? 

 What is the anticipated volume of media to be sanitized by type of media? 1 

 What is the availability of sanitization equipment and tools? 

 What is the level of training of personnel with sanitization equipment/tools? 

 How long will sanitization take? 

1

 SP 800-36 Guide to Selecting Information Technology Security Products 

11
 
Guidelines for Media Sanitization 

 What is the cost of sanitization when considering tools, training, validation, and reentering media into the supply stream? 

2.8 Sanitization Scope 

For most sanitization operations, the target of the operation is all data stored on the media by 

the user. However, in some cases, there may be a desire or need to sanitize a subset of the 

media. Partial sanitization comes with some risk, as it may be difficult to verify that sensitive 

data stored on a portion of the media did not spill over into other areas of the media. In 

addition, the dedicated interfaces provided by storage device vendors for sanitization typically 

operate at the device level, and are not able to be applied to a subset of the media. As a result, 

partial sanitization usually depends on the typical read and write commands available to the 

user, which may not be able to bypass any interface abstraction that may be present in order to 

directly address the media area of concern. 

Storage devices featuring integrated encryption may also support the ability to encrypt 

portions of the media with different encryption keys. When the interface supports changing 

only a subset of the encryption keys, partial sanitization via Cryptographic Erase is possible. 

As with any other sanitization technique applied to media, the level of assurance depends both 

upon vendor implementation and on the level of assurance that data was stored only in the 

areas that are able to be reliably sanitized. Data may be stored outside these regions either 

because the user or software on the system moved data outside of the designated area on the 

media, or because the storage device stored data to the media in a manner not fully understood 

by the user. 

Due to the difficulty in reliably ensuring that partial sanitization effectively addresses all 

sensitive data, sanitization of the whole device is preferred to partial sanitization whenever 

possible. Organizations should understand the potential risks to this approach and make 

appropriate decisions on this technique balancing the factors described earlier as well as their 

business missions and specific use cases. For example, a drive in a datacenter may contain 

customer data from multiple customers. When one customer discontinues service and another 

begins storing data on the same media, the organization may choose to apply partial 

sanitization in order to retain the data of other customers that is also stored on the same storage 

device on other areas of the media. The organization may choose to apply partial sanitization 

because the drive remains in the physical possession of the organization, access by the 

customer is limited to the interface commands, and the organization has trust in the partial 

sanitization mechanism available for that specific piece of media. In cases where the 

alternative to partial sanitization is not performing sanitization at all, partial sanitization 

provides benefits that should be considered. 

12
 
 

 

 

 

 

Guidelines for Media Sanitization 

3Roles and Responsibilities: 

3.1 Program Managers/Agency Heads 

“Ultimately, responsibility for the success of an organization lies with its senior managers.”2 

By establishing an effective information security governance structure, they establish the 

organization’s computer security program and its overall program goals, objectives, and 

priorities in order to support the mission of the organization. Ultimately, the head of the 

organization is responsible for ensuring that adequate resources are applied to the program and 

for ensuring program success. Senior management is responsible for ensuring that the 

resources are allocated to correctly identify types and locations of information and to ensure 

that resources are allocated to properly sanitize the information. 

The other responsibilities in the remainder of this section are for illustrative purposes and the 

intent is to ensure that organizations think through the different responsibilities for sanitizing 

media and assign those responsibilities appropriately. 

3.2 Chief Information Officer (CIO) 

The CIO3 is charged with promulgating information security policy. A component of this 

policy is information disposition and media sanitization. The CIO, as the information 

custodian, is responsible for ensuring that organizational or local sanitization requirements 

follow the guidelines of this document. 

3.3 Information System Owner 

The information system owner4 should ensure that maintenance or contractual agreements are 

in place and are sufficient in protecting the confidentiality of the system media and 

information commensurate with the impact of disclosure of such information on the 

organization. 

3.4 Information Owner 

The information owner should ensure that appropriate supervision of onsite media 

maintenance by service providers occurs, when necessary. The information owner is also 

2

NIST SP 800-18 Guide for Developing Security Plans for Information Technology Systems, pg 16. 

3

Information Technology Management Reform Act (Clinger/Cohen) When an agency has not designated a formal 

CIO position, FISMA requires the associated responsibilities to be handled by a comparable agency official. 

4

The role of the information system owner can be interpreted in a variety of ways depending on the particular agency 

and the system development life-cycle phase of the information system. Some agencies may refer to the information 

system owners as program managers or business/asset/mission owners. 

13
 
Guidelines for Media Sanitization 

responsible for ensuring that they fully understand the sensitivity of the information under 

their control and that the users of the information are aware of its confidentiality and the basic 

requirements for media sanitization. 

3.5 Senior Agency Information Security Officer (SAISO) 

The SAISO is responsible for ensuring that the requirements of the information security policy 

with regard to information disposition and media sanitization are implemented and exercised 

in a timely and appropriate manner throughout the organization. The SAISO also requires 

access to the technical basis/personnel to understand and properly implement the sanitization 

procedures. 

3.6 System Security Manager/Officer 

Often assisting system management officials in this effort is a system security manager/officer 

responsible for day-today security implementation/administration duties. Although not 

normally part of the computer security program management office, this person is responsible 

for coordinating the security efforts of a particular system(s). This role is sometimes referred 

to as the Computer System Security Officer or the Information System Security Officer. 

3.7 Property Management Officer 

The property management officer is responsible for ensuring that sanitized media and devices 

that are redistributed within the organization, donated to external entities or destroyed are 

properly accounted for. 

3.8 Records Management Officer 

The records management officer is responsible for advising the system and/or data owner or 

custodian of retention requirements that must be met so the sanitization of media will not 

destroy records that should be preserved. 

3.9 Privacy Officer 

The privacy officer is responsible for providing advice regarding the privacy issues 

surrounding the disposition of privacy information and the media upon which it is recorded. 

3.10 Users 

Users have the responsibility for knowing and understanding the confidentiality of the 

information they are using to accomplish their assigned work and ensure proper handling of 

information. 

14
 
Guidelines for Media Sanitization 

4 Information Sanitization and Disposition Decision Making 

An organization may maintain storage devices with differing levels of confidentiality, and it is 

important to understand what types of data may be stored on the device in order to apply the 

techniques that best balance efficiency and efficacy to maintain the confidentiality of the data. 

Data confidentiality level should be identified using procedures described in FIPS 199. 

Additional information is available on mapping information types to security categories in 

SP800-60. 

While most devices support some form of Clear, not all devices have a reliable Purge 

mechanism. For moderate confidentiality data, the media owner may choose to accept the risk 

of applying Clear techniques to the media, acknowledging that some data may be able to be 

retrieved by someone with the time, knowledge, and skills to do so. 

Purge (and Clear, where applicable) may be more appropriate than Destroy when factoring in 

environmental concerns, the desire to reuse the media (either within the organization or by 

selling or donating the media), the cost of a media or media device, or difficulties in physically 

Destroying some types of media. 

The risk decision should include the potential consequence of disclosure of information 

retrievable from the media, the cost of information retrieval and its efficacy, and the cost of 

sanitization and its efficacy. Additionally, the length of time the data will remain sensitive 

should also be considered. These values may vary between different environments. 

Organizations can use Figure 4-1 with the descriptions in this section to assist them in making 

sanitization decisions that are commensurate with the security categorization of the 

confidentiality of information contained on their media. The decision process is based on the 

confidentiality of the information, not the type of media. Once organizations decide what type 

of sanitization is best for their individual case, then the media type will influence the technique 

used to achieve this sanitization goal. 

15
 
 

Guidelines for Media Sanitization 

Figure 4-1. Sanitization and Disposition Decision Flow 

16
 
Guidelines for Media Sanitization 

4.1 Information Decisions in the System Life Cycle 

The need for, and methods to conduct, media sanitization should be identified and developed 

before arriving at the Disposal phase in the system life cycle. At the start of system 

development, when the initial system security plan is developed (see NIST SP 800-18, 

Revision 1, Guide for Developing Security Plans for Information Technology Systems), media 

sanitization controls are developed, documented, and deployed. One of the key decisions that 

will affect the ability to conduct sanitization is choosing what media are going to be used 

within the system. Although this is mostly a business decision, system owners must 

understand early on that this decision affects the types of resources needed for sanitization 

throughout the rest of the system life cycle. 

An organization may ask a product vendor for assistance in identifying storage media that may 

contain sensitive data. This information is typically documented in a ‘statement of volatility’. 

The statement may be used to support decisions about which equipment to purchase, based on 

the ease or difficulty of sanitization. While volatility statements are useful, caution should be 

applied in comparing statements across vendors because vendors may state volatility details 

differently. 

Organizations should take care in identifying media for sanitization. Many items used will 

contain multiple forms of media that may require different methods of sanitization. For 

example, a PC may contain a hard drive, motherboard, RAM, and ROM, and mobile devices 

contain on-board volatile memory as well as nonvolatile removable memory in the form of a 

Subscriber Identity Module (SIM). 

The increasing availability of rapidly applicable techniques, such as Cryptographic Erase, 

provides opportunities for organizations to reduce the risk of inadvertent disclosure by 

combining sanitization technologies and techniques. For example, an organization could 

choose to apply Cryptographic Erase at a user’s desktop before removing the media to 

send it to be ‘formally’ sanitized at the sanitization facility, in order to reduce risk and 

exposure. 

4.2 Determination of Security Categorization 

Early in the system life cycle, a system is categorized using the guidance found in FIPS 199 

and NIST SP 800-60, including the security categorization for the system’s confidentiality. 

This security categorization is often revisited and revalidated throughout the system’s life, and 

any necessary changes to the confidentiality category can be made. Once the security 

categorization is completed, the system owner can then design a sanitization process that will 

ensure adequate protection of the system’s information. 

Much information is not associated with a specific system but is associated with internal 

business communications, usually on paper. Organizations should label these media with their 

internal operating confidentiality levels and associate a type of sanitization described in this 

publication. 

17
 
Guidelines for Media Sanitization 

4.3 Reuse of Media 

A key decision on sanitization is whether the media are planned for reuse or recycle. Some 

forms of media are often reused to conserve an organization’s resources. 

If media are not intended for reuse either within or outside an organization due to damage or 

other reason, the simplest and most cost-effective method of control may be Destroy. 

4.4 Control of Media 

A factor influencing an organizational sanitization decision is who has control and access to 

the media. This aspect must be considered when media leaves organizational control. Media 

control may be transferred when media are returned from a leasing agreement or are being 

donated or resold to be reused outside the organization. The following are examples of media 

control: 

Under Organization Control: 

 Media being turned over for maintenance are still considered under organization 

control if contractual agreements are in place with the organization and the 

maintenance provider specifically provides for the confidentiality of the 

information. 

 Maintenance being performed on an organization’s site, under the organization’s 

supervision, by a maintenance provider is also considered under the control of the 

organization. 

Not Under Organization Control: 

 Media that are being exchanged for warranty, cost rebate, or other purposes and 

where the specific media will not be returned to the organization are considered to 

be out of organizational control. 

4.5 Data Protection Level 

Even within an organization, varying data protection policies may be established. For 

instance, a company may have an engineering department and a sales department. The sales 

personnel may not have a need for access to the detailed proprietary technical data such as 

source code and schematics, and the engineers may not have a need to access the PII of the 

company’s customers. Both might be within the same confidentiality categorization, but 

contextually different and with different internal and external rules regarding necessary 

controls. As such, data protection level is a complementary consideration to organizational 

control. When identifying whether sanitization is necessary, both the organizational control 

and data protection level should be considered. 

18
 
Guidelines for Media Sanitization 

4.6 Sanitization and Disposal Decision 

Once an organization completes an assessment of its system confidentiality, has determined 

the need for information sanitization, has determined appropriate time frames for sanitization, 

and has determined the types of media used and the media disposition, an effective, risk-based 

decision can be made on the appropriate and needed level of sanitization. Again, 

environmental factors and media type might cause the level of sanitization to change. For 

example, purging paper copies generally does not make sense, so destroying them would be 

an acceptable alternative. 

Upon completion of sanitization decision making, the organization should record the decision 

and ensure that a process and proper resources are in place to support these decisions. This 

process is often the most difficult piece of the media sanitization process because it includes 

not only the act of sanitization but also the validation: capturing decisions and actions, 

identifying resources, and having critical interfaces with key officials. 

4.7 Verify Methods 

Verifying the selected information sanitization and Disposal process is an essential step in 

maintaining confidentiality. Two types of verification should be considered. The first is 

verification every time sanitization is applied (where applicable, as most Destruct techniques 

do not support practical verification for each sanitized piece of media). The second is a 

representative sampling verification, applied to a selected subset of the media. If possible, the 

sampling should be executed by personnel who were not part of the original sanitization 

action. If sampling is done after full verification in cases of low risk tolerance then a separate 

validation tool than the one used in the original verification should be used. 

4.7.1 Verification of Equipment 

Verification of the sanitization process is not the only assurance required by the 

organization. If the organization is using sanitization tools (e.g., a degausser or a 

dedicated workstation), then equipment calibration, as well as equipment testing, 

and scheduled maintenance, is also needed. 

4.7.2 Verification of Personnel Competencies 

Another key element is the potential training needs and current expertise of 

personnel conducting the sanitization. Organizations should ensure that equipment 

operators are competent to perform sanitization functions. 

4.7.3 Verification of Sanitization Results 

The goal of sanitization verification is to ensure that the Target Data was effectively 

sanitized. When supported by the device interface (such as an ATA or SCSI hard 

drive or solid state drive), the highest level of assurance of effective sanitization 

(outside of a laboratory) is typically achieved by a full reading of all accessible areas 

to verify that the expected sanitized value is in all addressable locations. A full 

19
 
Guidelines for Media Sanitization 

verification should be performed if time and external factors permit. This manner of 

verification typically only applies where the device is in an operational state 

following sanitization so that data can be read and written through the native 

interface. 

If an organization chooses representative sampling then there are three main goals 

applied to electronic media sanitization verification: 

1.	 Select pseudorandom locations on the media each time the analysis tool 

is applied. This reduces the likelihood that a sanitization tool that only 

sanitizes a subset of the media will result in verification success in a 

situation where sensitive data still remains. 

2.	 Select locations across the addressable space. For instance, conceptually 

break the media up into equally sized subsections. Select a large enough 

number of subsections so that the media is well-covered. The number of 

practical subsections depends on the device and addressing scheme. The 

suggested minimum number of subsections for hard drives leveraging 

LBA addressing is one thousand. Select at least two non-overlapping 

pseudorandom locations from within each subsection. For example, if 

one thousand conceptual subsections are chosen, at least two 

pseudorandom locations in the first thousandth of the media addressing 

space would be read and verified, at least two pseudorandom locations 

in the second thousandth of the media addressing space would be read 

and verified, and so on. 

a.In addition to the locations already identified, include the first and 

last addressable location on the storage device. 

3.	 Each consecutive sample location (except the ones for the first and last 

addressable location) should cover at least 5% of the subsection and not 

overlap the other sample in the subsection. Given two non-overlapping 

samples, the resulting verification should cover at least 10% of the 

media once all subsections have had two samples taken. 

Cryptographic Erase has different verification considerations than procedures such 

as rewriting or block erasing, because the contents of the physical media, following 

Cryptographic Erase may not be known and therefore cannot be compared to a 

given value. When Cryptographic Erase is leveraged, there are multiple options for 

verification, and each uses a quick review of a subset of the media. Each involves a 

selection of pseudorandom locations to be sampled from across the media 

The first option is to read the pseudorandom locations prior to Cryptographic Erase, 

and then again following Cryptographic Erase to compare the results. This is likely 

the most effective verification technique. However, this technique may not always 

20
 
Guidelines for Media Sanitization 

be available because, for example, the person performing the sanitization may not 

have access to the cryptographic key needed to decrypt the data stored on the drive. . 

Alternatives include searching for strings across the media or looking for files that 

are in known locations, such as operating system files likely to be stored in a specific 

area. 

The number of locations and size of each sample should take into consideration the 

risks in transferring the Target Data to the storage media of the machine hosting the 

sanitization application. As a result, the proportion of the media covered by 

verification for the Cryptographic Erase technique may be relatively small (or at 

least lower than the above guidance of 10% for verification of non-cryptographic 

sanitization techniques), but should still be applied across a wide range of the 

addressable area. 

As part of the sanitization process, in addition to the verification performed on each 

piece of media following the sanitization operation, a subset of media items should 

be selected at random for secondary verification using a separate validation tool. 

The secondary validation tool should be from a separate developer. For the 

secondary validation, a full validation should be performed. At least 20% of 

sanitized media (by number of media items sanitized) should be verified. The 

secondary validation provides assurance that the primary operation is working as 

expected. 

4.8 Documentation 

Following sanitization, a certificate of media disposition should be completed for each piece 

of electronic media that has been sanitized. A certification of media disposition may be a 

piece of paper or an electronic record of the action taken. For example, most modern hard 

drives include bar codes on the label for values such as model and serial numbers. The 

person performing the sanitization might simply enter the details into a tracking application 

and scan each bar code as the media is sanitized. 

The decision regarding whether to complete a certificate of media disposition and how 

much data to record depends on the confidentiality level of the data on the media. For a 

large number of devices with data of very low confidentiality, an organization may choose 

not to complete the certificate. 

When fully completed, the certificate should record at least the following details: 

• Manufacturer 

• Model 

• Serial Number 

• Organizationally Assigned Media or Property Number (if applicable) 

• Media Type (ie magnetic, flash, hybrid, etc.) 

• Media Source (ie. user or computer the media came from) 

• Pre-Sanitization Confidentiality Level 

21
 
Guidelines for Media Sanitization 

• Sanitization Description (ie. Clear, Purge, Damage, Destruct) 

• Method Used (ie. degauss, overwrite, block erase, crypto erase, etc.) 

• Tool Used (including version) 

• Verification Method (ie. full, quick sampling, etc.) 

• Post-Sanitization Confidentiality Level 

• If known, post-sanitization destination 

• For Both Sanitization and Validation: 

o Name of Person 

o Position/Title of Person 

o Date 

o Location 

o Phone or Other Contact Information 

o Signature 

Optionally, and organization may choose to record the following (if known): 

• Data Backup (ie. if data was backed up, and if so, where) 

A sample certificate is included in Appendix G. 

If the storage device has been successfully verified and the sanitization results in a lower 

confidentiality level of the storage device, all markings on the device indicating the previous 

confidentiality level should be removed. A new marking indicating the updated 

confidentiality level should be applied, unless the device is leaving the organization and is 

stored in a location where access is carefully controlled until the device leaves the 

organization to prevent reintroduction of sensitive data. 

The value of a certification of media disposition depends on the organization’s handling of 

storage media over the media’s lifecycle. If records are maintained when the media is 

introduced to the environment, when the media leaves the place it was last used, and when it 

reaches the sanitization destination, the organization can most effectively identify how well 

media sanitization is being applied across the enterprise. If there is a breakdown in tracking 

at locations other than the sanitization destination, the sanitization records only show that 

specific media was sanitized (and not whether the organization is effectively sanitizing all 

media that has been introduced into the operating environment). 

22
 
 

Guidelines for Media Sanitization 

5 Summary of Sanitization Techniques 

Several different methods can be used to sanitize media. Four of the most common are 

presented in this section. Users of this guide should categorize the information to be disposed 

of, assess the nature of the medium on which it is recorded, assess the risk to confidentiality, 

and determine the future plans for the media. Then, using information in Table 5-1, decide on 

the appropriate method for sanitization. The selected method should be assessed as to cost, 

environmental impact, etc., and a decision should be made that best mitigates the risks to an 

unauthorized disclosure of information. 

Table 5-1. Sanitization Methods 

Method Description 

Clear One method to sanitize media is to use software or hardware products to overwrite useraddressable storage space on the media with non-sensitive data, using the standard read 

and write commands for the device. This process may include overwriting not only the logical 

storage location of a file(s) (e.g., file allocation table) but also should include all useraddressable locations. The security goal of the overwriting process is to replace Target Data 

with non-sensitive data. Overwriting cannot be used for media that are damaged or not 

rewriteable, and may not address all areas of the device where sensitive data may be 

retained. The media type and size may also influence whether overwriting is a suitable 

sanitization method. For example, flash-based storage devices may contain spare cells and 

perform wear levelling, making it infeasible for a user to sanitize all previous data using this 

approach because the device may not support directly addressing all areas where sensitive 

data has been stored using the native read and write interface. 

The Clear operation may vary contextually for media other than dedicated storage devices, where 

the device (such as a basic cell phone or a piece of office equipment) only provides the ability to 

return the device to factory state (typically by simply deleting the file pointers) and does not directly 

support the ability to rewrite or apply media-specific techniques to the non-volatile storage contents. 

Where rewriting is not supported, manufacturer resets and procedures that do not include rewriting 

might be the only option to Clear the device and associated media. These still meet the definition 

for Clear as long as the device interface available to the user does not facilitate retrieval of the 

Cleared data. 

Purge Some methods of purging (which vary by media and must be applied with considerations 

described further throughout this document) include overwriting, block erase, Cryptographic 

Erase, through the use of dedicated, standardized device sanitize commands that apply 

media-specific techniques to bypass the abstraction inherent in typical read and write 

commands. One type of data that could remain without invalidating the sanitization 

procedure is device log data, which is not necessarily sanitized when using the available 

interface commands. 

Destructive techniques also render the device Purged when effectively applied to 

the appropriate media type, including incineration, shredding, disintegrating, 

degaussing, and pulverizing. The common benefit across all these approaches is 

assurance that the data is infeasible to recover using state of the art laboratory 

techniques. However, Bending, Cutting, and the use of some emergency procedures (such as 

using a firearm to shoot a hole through a storage device) may only be Damage techniques if the 

action does not cover the whole surface of the media, as portions of the media may remain 

undamaged and therefore accessible using advanced laboratory techniques. 

Degaussing renders a Legacy Magnetic Device Purged when the strength of the degausser is 

carefully matched to the media coercivity. Coercivity may be difficult to determine based only on 

information provided on the label. Therefore, refer to the device manufacturer for coercivity details. 

Degaussing should never be solely relied upon for flash-based storage devices or for magnetic 

23
 
Guidelines for Media Sanitization 

Method Description 

storage devices that also contain non-volatile non-magnetic storage. Degaussing renders many 

types of devices unusable (and in those cases, Degaussing is also a Destruction technique). 

Destroy There are many different types, techniques, and procedures for media Destruction. While some 

techniques may render the Target Data infeasible to retrieve through the device interface and 

unable to be used for subsequent storage of data, the device is not considered Destructed unless 

Target Data retrieval is infeasible using state of the art laboratory techniques. 

• Disintegrate, Pulverize, Melt, and Incinerate. These sanitization methods are designed to 

completely Destruct the media. They are typically carried out at an outsourced metal 

Destruction or licensed incineration facility with the specific capabilities to perform these 

activities effectively, securely, and safely. 

• Shred. Paper shredders can be used to Destruct flexible media such as diskettes once 

the media are physically removed from their outer containers. The shred size of the refuse 

should be small enough that there is reasonable assurance in proportion to the data 

confidentiality that the data cannot be reconstructed. To make reconstructing the data 

even more difficult, the shredded material can be mixed with non-sensitive material of the 

same type (ie. shredded paper). 

The application of Destructive techniques may be the only option when the media fails and other 

Clear or Purge techniques cannot be effectively applied to the media, or when the validation of 

Clear or Purge methods fails (for known or unknown reasons). 

24
 
 

Guidelines for Media Sanitization 

Appendix A. Minimum Sanitization Recommendations 

Once a decision is made based on factors such as those described in Section 4, and after 

applying relevant organizational environmental factors, then the tables in this appendix can be 

used to determine recommended sanitization of specific media. This recommendation should 

reflect the Federal Information Processing Standard (FIPS) 199 security categorization of the 

system confidentiality to reduce the impact of harm of unauthorized disclosure of information 

from the media. 

Although use of the tables in this appendix is recommended here, other methods exist to 

satisfy the intent of Clear, Purge, Damage, and Destruct. Methods not specified in this table 

may be suitable as long as they are vetted and found satisfactory by the organization. Not all 

types of available media are specified in this table. If your media are not included in this 

guide, organizations are urged to identify and use processes that will fulfill the intent to Clear, 

Purge, Damage, or Destruct their media. 

When an organization or agency has a sanitization technology, method and/or tool that they 

trust and have validated, they are strongly encouraged to share this information through public 

forums, such as the Federal Agency Security Practices (FASP) website. The FASP effort was 

initiated as a result of the success of the Federal Chief Information Officer (CIO) Council’s 

Federal Best Security Practices (BSP) pilot effort to identify, evaluate, and disseminate best 

practices for critical infrastructure protection (CIP) and security. FASP can be found at 

http://csrc.nist.gov/groups/SMA/fasp/. 

The proper initial configuration of each type of device helps ensure that the sanitization 

operation is as effective as possible. While called out for some specific items below, users are 

encouraged to check manufacturer recommendations and guides such as the DISA Security 

Technical Implementation Guides (STIGs) (http://iase.disa.mil/stigs/) for additional 

information about recommended settings for any other items in this list as well. 

If a mobile device has a SIM card, it may contain additional information that may or may not 

be addressed by the sanitization process identified in Table A-3. Contact the manufacturer 

and/or cellular provider to determine what types of data are stored on the SIM card and to 

identify whether any additional sanitization is required for the SIM card. Additional details 

about SIM cards and associated data recovery capabilities are available in NIST SP800-101. 

Many internal storage devices (as opposed to removable media, such as an SD card) as well as 

storage subsystems that incorporate installed media, support dedicated sanitize commands. 

The availability of these commands is impacted in some cases by system (ie. BIOS/UEFI) 

characteristics, such as how and when freeze lock commands are issued to a device. The use 

of a dedicated computer or equipment to perform sanitization that facilitates leveraging these 

commands (such as a PC or workstation, with an external drive bay that facilitates safely 

connecting a drive after the system has been powered on) can help address this issue. The 

behavior and methods to bypass freeze lock or other limitations on command availability vary 

between computers, so refer to the computer manufacturer for details about the behavior of 

specific models. Alternative approaches exist for addressing the issue, and will vary 

25
 
 

 

 

 

 

 

 

Guidelines for Media Sanitization 

depending on the hardware, software, and firmware of the computer. UCSD’s Center for 

Magnetic Recording Research (CMRR) has also developed some tools and documentation 

about work-arounds for this issue (see Appendix C for details). 

Some sanitization procedures feature additional optional methods. The choice regarding 

whether to apply the optional components depends on the level of confidentiality of the data 

and assurance of correct implementation of the non-optional portion of the sanitization 

procedure. For example, an organization might decide that for PII, for example, that any 

method applied with an available optional component should execute that optional 

component. The choice may also be based on the time factor, as some procedures, including 

the optional method, can be executed in a total of a manner of minutes. In that case, the 

organization might decide to include the optional component even if the data is not in a higher 

confidentiality category. 

Table A-1. Hard Copy Storage Sanitization 

Hard Copy Storage 

Paper and microforms 

Clear/ Purge: N/A, see Destruct. 

Destroy: Destruct paper using cross cut shredders which produce particles that are 1 x 5 millimeters 

in size (or smaller), or pulverize/disintegrate paper materials using disintegrator devices 

equipped with 3/32 inch security screen. 

Destruct microforms (microfilm, microfiche, or other reduced image photo negatives) by 

burning. 

Notes: When material is burned, residue must be reduced to white ash. 

Table A-2. Networking Device Sanitization 

Networking Devices 

Routers and Switches (home, home office, enterprise) 

Clear: Perform a full manufacturer’s reset to reset the router or switch back to its factory default settings. 

Purge: See Destruct. Most routers and switches only offer capabilities to Clear (and not Purge) 

the data contents. A router or switch may offer Purge capabilities, but these capabilities 

are specific to the hardware and firmware of the device and should be applied with caution. 

Refer to the device manufacturer to identify whether the device has a Purge capability that 

applies media-dependent techniques (such as rewriting or block erasing) to ensure that 

data recovery is infeasible, and that the device does not simply remove the file pointers. 

Destroy: Shred, Disintegrate, Pulverize, or Incinerate by burning the device in a licensed incinerator. 

Notes: For both Clear and (if applicable) Purge, refer to the manufacturer for additional information on 

the proper Sanitization procedure. 

Network Devices may contain removable storage. The removable media must be removed and 

sanitized using media-specific techniques. 

Table A-3. Mobile Device Sanitization 

Mobile Devices 

Apple iPhone and iPad 

26
 
 

 

 

 

Guidelines for Media Sanitization 

Clear/ Purge: Select the full sanitize option (typically in the ‘Settings > General > Reset > Erase All Content and 

Settings’ menu). The sanitization operation may take only minutes if Cryptographic Erase is 

supported, or may take as long as several hours if media-dependent non-cryptographic 

sanitization techniques that leverage overwriting are applied by the device (depending on the 

media size). 

Destroy: Shred, Disintegrate, Pulverize, or Incinerate by burning the device in a licensed incinerator. 

Notes: Following the Clear/Purge operation, manually navigate to multiple areas of the device (such as 

browser history, files, photos, etc.) to verify that no personal information has been retained on the 

device. 

Refer to the manufacturer for proper sanitization procedure, and for details about implementation 

differences between device versions and OS versions. Proper initial configuration using guides 

such as the DISA STIGs (http://iase.disa.mil/stigs/) helps ensure that the level of data protection 

and sanitization assurance is as robust as possible. 

Blackberry 

Clear/ Purge: Select the full sanitize option (typically in either the ‘Options > Security Options > General 

Settings > [menu button] > Wipe Handheld’ OR in ‘Options > Security Options > Security Wipe’ 

menu), making sure to select all subcategories of data types for sanitization. The sanitization 

operation may take as long as several hours depending on the media size. 

Destroy: Shred, Disintegrate, Pulverize, or Incinerate by burning the device in a licensed incinerator. 

Notes: Following the Clear/Purge operation, manually navigate to multiple areas of the device (such as 

browser history, files, photos, etc.) to verify that no personal information has been retained on the 

device. 

Refer to the manufacturer for additional information on the proper sanitization procedure, and for 

details about implementation differences between device versions and OS versions. Proper 

initial configuration using guides such as the DISA STIGs (http://iase.disa.mil/stigs/) helps ensure 

that the level of data protection and sanitization assurance is as robust as possible. If the device 

contains removable storage media, ensure that the media is sanitized using appropriate mediadependent procedures. 

Devices running the Google Android OS 

Clear: Select the full sanitize option (typically in the ‘Menu > Settings > [Privacy OR SD and Phone 

Storage]> Factory data reset’ menu). 

Purge: Android settings and capabilities may be modified by device vendors or service providers, and 

therefore no assumptions should be made about the level of assurance provided by performing a 

factory data reset. Some versions of Android support encryption, and may support Cryptographic 

Erase. Refer to the device manufacturer (and potentially the service provider as well, if 

applicable) to identify whether the device has a Purge capability that applies media-dependent 

techniques (such as rewriting or block erasing) or Cryptographic Erase to ensure that data 

recovery is infeasible, and that the device does not simply remove the file pointers. 

Destroy: Shred, Disintegrate, Pulverize, or Incinerate by burning the device in a licensed incinerator. 

Notes: Proper initial configuration using guides such as the DISA STIGs (http://iase.disa.mil/stigs/) helps 

ensure that the level of data protection and sanitization assurance is as robust as possible. 

Following the Clear or (if applicable) Purge operation, manually navigate to multiple areas of the 

device (such as browser history, files, photos, etc.) to verify that no personal information has 

been retained on the device. 

For both Clear and (if applicable) Purge, refer to the manufacturer for additional information on 

the proper sanitization procedure. 

All other mobile devices This includes cell phones, smart phones, PDAs, tablets, and other devices not 

covered in the preceding mobile categories. 

Clear: Manually delete all information, then perform a full manufacturer’s reset to reset the mobile 

device to factory state. 

27
 
 

 

 

 

Guidelines for Media Sanitization 

Purge: See Destruct. Many mobile devices only offer capabilities to Clear (and not Purge) the data 

contents. A mobile device may offer Purge capabilities, but these capabilities are specific to the 

hardware and software of the device and should be applied with caution. The device 

manufacturer should be referred to in order to identify whether the device has a Purge capability 

that applies media-dependent techniques (such as rewriting or block erasing) or Cryptographic 

Erase to ensure that data recovery is infeasible, and that the device does not simply remove the 

file pointers. 

Destroy: Shred, Disintegrate, Pulverize, or Incinerate by burning the device in a licensed incinerator. 

Notes: Following the Clear or (if applicable) Purge operation, manually navigate to multiple areas of the 

device (such as call history, browser history, files, photos, etc.) to verify that no personal 

information has been retained on the device. 

For both Clear and (if applicable) Purge, refer to the manufacturer for proper sanitization 

procedure. 

Table A-4. Equipment Sanitization 

Equipment 

Office Equipment This includes copy, print, fax, and multifunction machines 

Clear: Perform a full manufacturer’s reset to reset the office equipment to its factory default settings. 

Purge: See Destruct. Most office equipment only offers capabilities to Clear (and not Purge) the 

data contents. Office equipment may offer Purge capabilities, but these capabilities are 

specific to the hardware and firmware of the device and should be applied with caution. 

Refer to the device manufacturer to identify whether the device has a Purge capability that 

applies media-dependent techniques (such as rewriting or block erasing) or Cryptographic 

Erase to ensure that data recovery is infeasible, and that the device does not simply 

remove the file pointers. Office equipment may have removable storage media, and if so, 

media-dependent sanitization techniques may be applied to the associated storage device. 

Destroy: Shred, Disintegrate, Pulverize, or Incinerate by burning the device in a licensed incinerator. 

Notes: For both Clear and (if applicable) Purge, manually navigate to multiple areas of the device (such 

as stored fax numbers, network configuration information, etc.) to verify that no personal 

information has been retained on the device. 

For both Clearing and (if applicable) Purge, the ink, toner, and associated supplies (drum, fuser, 

etc.) should be removed and destroyed or disposed of in accordance with applicable law, 

environmental, and health considerations. Some of these supplies may retain impressions of 

data printed by the machine and therefore could pose a risk of data exposure, and should be 

handled accordingly. If the device is functional, one way to reduce the associated risk is to print a 

blank page, then an all-black page, then another blank page. For devices with dedicated color 

components (such as cyan, magenta, and yellow toners and related supplies), one page of each 

color should also be printed between blank pages. The resulting sheets should be handled at the 

confidentiality of the Office Equipment (prior to sanitization). Note that these procedures do not 

apply to supplies such as ink/toner on a one-time use roll, as they are typically not used again 

and therefore will not be addressed by sending additional pages through the equipment. Office 

Equipment supplies may also pose health risks, and should be handled using appropriate 

procedures to minimize exposure to the print components and toner. 

For both Clear and (if applicable) Purge, refer to the manufacturer for additional information on 

the proper sanitization procedure. 

Table A-5. Legacy Magnetic Media Sanitization 

Legacy Magnetic Media 

Floppies 

Clear: Overwrite media by using organizationally approved software and validate the overwritten data. 

28
 
 

 

 

 

 

 

 

 

 

Guidelines for Media Sanitization 

The Clear pattern should be at least a single pass with a fixed data value, such as all zeros. 

Multiple passes or more complex values may alternatively be used. 

Purge: Degauss in an organizationally approved degausser. 

Destroy: Incinerate floppy disks and diskettes by burning in a licensed incinerator or Shred. 

Zip Disks 

Clear: Overwrite media by using organizationally approved software and validate the overwritten data. 

The Clear pattern should be at least a single pass with a fixed data value, such as all zeros. 

Multiple passes or more complex values may alternatively be used. 

Purge: Degauss in an organizationally approved degausser. 

Destroy: Incinerate disks and diskettes by burning in a licensed incinerator or Shred. 

Notes: Degaussing zip disks typically renders the disk permanently unusable. 

Reel and Cassette Format Magnetic Tapes 

Clear: Re-record (overwrite) all data on the tape using an organizationally approved pattern, using a 

system with similar characteristics to the one that originally recorded the data. For example, 

overwrite previously recorded sensitive VHS format video signals on a comparable VHS format 

recorder. All portions of the magnetic tape should be overwritten one time with known nonsensitive signals. Clearing a magnetic tape by re-recording (overwriting) may be impractical for 

most applications since the process occupies the tape transport for excessive time periods. 

Purge: Degauss the magnetic tape in an organizationally approved degausser. 

Destroy: Incinerate by burning the tapes in a licensed incinerator or Shred. 

Notes: Preparatory steps for Destruct, such as removing the tape from the reel or cassette prior to 

Destruction, are unnecessary. However, segregation of components (tape and reels or 

cassettes) may be necessary to comply with the requirements of a Destruction facility or for 

recycling measures. 

ATA Hard Drives This includes PATA, SATA, eSATA, etc. 

Clear: Overwrite media by using organizationally approved and validated overwriting 

technologies/methods/tools. The Clear pattern should be at least a single pass with a fixed data 

value, such as all zeros. Multiple passes or more complex values may alternatively be used. 

Purge: Four options are available: 

1. Apply the ATA sanitize command, if supported. One or both of the following options 

may be available: 

a. The overwrite command. Apply one pass of a fixed pattern across the media 

surface. Some examples of fixed patterns include all 0s or a pseudorandom 

pattern. 

Optionally: Instead of one pass, use three total passes of a pseudorandom 

pattern, leveraging the invert option so that the second pass is the inverted 

version of the pattern specified. 

b. If the device supports encryption and the requirements described in this 

document have been satisfied, the Cryptographic Erase (also known as 

sanitize crypto scramble) command. 

Optionally: After Cryptographic Erase is successfully applied to a device, use 

the overwrite command (if supported) to write one pass of zeros or a 

pseudorandom pattern across the media. If the overwrite command is not 

supported, the Secure Erase or the Clear procedure could alternatively be 

applied following Cryptographic Erase. 

2. Apply the ATA Secure Erase command. The ATA sanitize command is preferred to 

ATA Secure Erase when the ATA sanitize command is supported by the device. 

3. Cryptographic Erase through the Trusted Computing Group (TCG) Opal Security 

Subsystem Class (SSC) or Enterprise SSC interface by issuing commands as 

29
 
 

 

 

 

 

Guidelines for Media Sanitization 

necessary to cause all MEKs to be changed (if the requirements described in this 

document have been satisfied). Refer to the TCG and device manufacturers for more 

information. 

Optionally: After Cryptographic Erase is successfully applied to a device, use the 

overwrite command (if supported) to write one pass of zeros or a pseudorandom 

pattern across the media. If the overwrite command is not supported, the Secure Erase 

or the Clear procedure could alternatively be applied following Cryptographic Erase. 

4. Degauss in an organizationally approved automatic degausser or disassemble the hard 

disk drive and Purge the enclosed platters with an organizationally approved 

degaussing wand. 

Destroy: Shred, Disintegrate, Pulverize, or Incinerate by burning the device in a licensed incinerator. 

Notes: Verification must be performed for each technique within Clear and Purge, except degaussing. 

The assurance provided by degaussing depends on selecting an effective degausser, applying it 

appropriately and periodically spot checking the results to ensure it is working as expected. 

When using the three pass ATA sanitize overwrite procedure with the invert option, the 

verification process would simply search for the original pattern (which would have been written 

again during the third pass). 

The storage device may support configuration capabilities that artificially restrict the ability to 

access portions of the media as defined in the ATA standard, such as a Host Protected Area 

(HPA), Device Configuration Overlay (DCO), or Accessible Max Address. Even when a 

dedicated sanitization command addresses these areas, their presence may affect the ability to 

reliably verify the effectiveness of the sanitization procedure if left in place. Any configuration 

options limiting the ability to access the entire addressable area of the storage media should be 

reset prior to applying the sanitization technique. Recovery data, such as an OEM-provided 

restoration image may have been stored in this manner, and sanitization may therefore impact 

the ability to recover the system unless reinstallation media is also available. 

When Cryptographic Erase is applied, verification must be performed prior to additional 

sanitization techniques (if applicable), such as a Clear or Purge technique applied following 

Cryptographic Erase, to ensure that the cryptographic operation completed successfully. A quick 

sampling verification as described in the Verify Methods subsection should also be performed 

after any additional techniques are applied following Cryptographic Erase. 

Not all implementations of encryption are necessarily suitable for reliance upon Cryptographic 

Erase as a Purge mechanism. The decision regarding whether to use Cryptographic Erase 

depends upon verification of attributes previously identified in this guidance and in Appendix D. 

Given the variability in implementation of the Enhanced Secure Erase feature, use of this 

command is not recommended without first referring the manufacturer to identify that the storage 

device’s model-specific implementation meets the needs of the organization. 

This guidance applies to Legacy Magnetic media only, and it is critical to verify the media type 

prior to sanitization. Note that emerging media types, such as HAMR media or hybrid drives may 

not be easily identifiable by the label. Refer to the manufacturer for details about the media type 

in a storage device. 

Degaussing the media in a storage device typically renders the device unusable. 

SCSI Hard Drives This includes SCSI, SAS, Fibre Channel, etc. 

Clear: Overwrite media by using organizationally approved and validated overwriting 

technologies/methods/tools. The Clear pattern should be at least a single pass with a fixed data 

value, such as all zeros. Multiple passes or more complex values may alternatively be used. 

Purge: Four options are available: 

1. Apply the SCSI sanitize command, if supported. One or both of the following options 

may be available: 

a. The overwrite command. Use three total passes of a pseudorandom pattern, 

leveraging the invert option so that the second pass is the inverted version of 

the pattern specified. 

30
 
 

 

Guidelines for Media Sanitization 

b. If the device supports encryption, the Cryptographic Erase (also known as 

sanitize crypto scramble) command. 

Optionally: After Cryptographic Erase is successfully applied to a device, use 

the overwrite command (if supported) to write one pass of zeros or a 

pseudorandom pattern across the media. If the overwrite command is not 

supported, Secure Erase or the Clear procedure could alternatively be 

applied. 

2. Cryptographic Erase through the TCG Opal SSC or Enterprise SSC interface by 

issuing commands as necessary to cause all MEKs to be changed. Refer to the TCG 

and vendors shipping TCG Opal or Enterprise storage devices for more information. 

Optionally: After Cryptographic Erase is successfully applied to a device, use the 

overwrite command (if supported) to write one pass of zeros or a pseudorandom 

pattern across the media. If the overwrite command is not supported, Secure Erase or 

the Clear procedure could alternatively be applied. 

3. If neither of the first two options is supported, use the native read and write interface to 

write least a single pass with a fixed data value, such as all zeros. Multiple passes or 

more complex values may alternatively be used. 

4. Degauss in an organizationally approved automatic degausser or disassemble the hard 

disk drive and Purge the enclosed platters with an organizationally approved 

degaussing wand. 

Destroy: Shred, Disintegrate, Pulverize, or Incinerate by burning the device in a licensed incinerator. 

Notes: Verification must be performed for each technique within Clear and Purge as described in the 

Verify Methods subsection, except degaussing. The assurance provided by degaussing 

depends on selecting an effective degausser, applying it appropriately and periodically spot 

checking the results to ensure it is working as expected. 

When using the three pass SCSI sanitize overwrite procedure with the invert (also known as 

complement) option, the verification process would simply search for the original pattern (which 

would have been written again during the third pass). While it is widely accepted that one pass of 

overwriting should be sufficient for Purging the data, the availability of a dedicated command that 

incorporates the ability to invert the data pattern allows an efficient and effective approach that 

mitigates any residual risk associated with variations in implementations of magnetic recording 

features across device manufacturers. 

The storage device may support configuration capabilities that artificially restrict the ability to 

access portions of the media, such as SCSI mode select. Even when a dedicated sanitization 

command addresses these areas, their presence may affect the ability to reliably verify the 

effectiveness of the sanitization procedure if left in place. Any configuration options limiting the 

ability to access the entire addressable area of the storage media should be reset prior to 

applying the sanitization technique. 

When Cryptographic Erase is applied, verification must be performed prior to additional 

sanitization techniques (if applicable), such as a Clear or Purge technique applied following 

Cryptographic Erase, to ensure that the cryptographic operation completed successfully. A quick 

sampling verification as described in the Verify Methods subsection should also be performed 

after any additional techniques are applied following Cryptographic Erase. 

Not all implementations of encryption are necessarily suitable for reliance upon Cryptographic 

Erase as a Purge mechanism. The decision regarding whether to use Cryptographic Erase 

depends upon verification of attributes previously identified in this guidance and in Appendix D. 

This guidance applies to Legacy Magnetic media only, and it is critical to verify the media type 

prior to sanitization. Note that emerging media types, such as HAMR media or hybrid drives may 

not be easily identifiable by the label. Refer to the manufacturer for details about the media type 

in a storage device. 

Degaussing the media in a storage device typically renders the device unusable. 

31
 
 

 

 

 

 

Guidelines for Media Sanitization 

Table A-6. Peripherally Attached Storage Sanitization 

Peripherally Attached Storage 

External Locally Attached Hard Drives This includes, USB, Firewire, etc. (Treat eSATA as ATA 

Hard drive.) 

Clear: Overwrite media by using organizationally approved and validated overwriting 

technologies/methods/tools. The Clear pattern should be at least a single pass with a fixed data 

value, such as all zeros. Multiple passes or more complex values may alternatively be used. 

Purge: See Destruct. The implementation of External Locally Attached Hard Drives varies sufficiently 

across models and vendors that the issuance of any specific command to the device may not 

reasonably and consistently assure the desired sanitization result. 

When the external drive bay contains an ATA or SCSI hard drive, if the commands can be 

delivered natively to the device the device may be sanitized based on the associated mediaspecific guidance. However, the drive could be configured in a vendor-specific manner that 

precludes sanitization when removed from the enclosure. Additionally, if sanitization techniques 

are applied, the hard drive may not work as expected when reinstalled in the enclosure. 

Refer to the device manufacturer to identify whether the device has a Purge capability that 

applies media-dependent techniques (such as rewriting, block erasing, Cryptographic Erase, 

etc.) to ensure that data recovery is infeasible, and that the device does not simply remove the 

file pointers. 

Destroy: Shred, Disintegrate, Pulverize, or Incinerate by burning the device in a licensed incinerator. 

Notes: Verification as described in the Verify Methods subsection must be performed for each technique 

within Clear and Purge. 

Some external locally attached hard drives, especially those featuring security or encryption 

features, may also have hidden storage areas that might not be addressed even when the drive 

is removed from the enclosure. The device vendor may leverage proprietary commands to 

interact with the security subsystem. Please refer to the manufacturer to identify whether any 

reserved areas exist on the media and whether any tools are available to remove or sanitize 

them, if present. 

Table A-7. Optical Media Sanitization 

Optical Media 

CD, DVD, BD 

Clear/ Purge: N/A, see Destruct. 

Destroy: Destroy in order of recommendations: 

1. Removing the information-bearing layers of CD media using a commercial optical 

disk grinding device. Note that this applies only to CD and not to DVD or BD 

media 

2. Incinerate optical disk media (reduce to ash) using a licensed facility. 

3. Use optical disk media shredders or disintegrator devices to reduce to particles 

that have a nominal edge dimensions of point five millimeters (.5 mm) and surface 

area of point two five square millimeters (.25 mm2

) or smaller. 

Table A-8. Flash-Based Storage Device Sanitization 

Flash-Based Storage Devices 

ATA Solid State Drives (SSDs) This includes PATA, SATA, eSATA, etc. 

Clear: 1. Overwrite media by using organizationally approved and validated overwriting 

technologies/methods/tools. The Clear pattern should be at least a single pass with a 

32
 
 

 

Guidelines for Media Sanitization 

fixed data value, such as all zeros. Multiple passes or more complex values may 

alternatively be used. 

2. Leverage (the non-enhanced) ATA Secure Erase, if supported by the device. 

Purge: Three options are available: 

1. Apply the ATA sanitize command, if supported. One or both of the following options 

may be available: 

a. The block erase command. 

Optionally: After the block erase command is successfully applied to a 

device, write binary 1s across the user addressable area of the storage media 

and then perform a second block erase. 

b. If the device supports encryption, the Cryptographic Erase (also known as 

sanitize crypto scramble) command. 

Optionally: After Cryptographic Erase is successfully applied to a device, use 

the block erase command (if supported) to block erase the media. If the block 

erase command is not supported, Secure Erase or the Clear procedure could 

alternatively be applied. 

2. Apply the ATA Secure Erase command. The sanitize command is preferred to Secure 

Erase when the sanitize command is supported by the device. 

3. Cryptographic Erase through the TCG Opal SSC or Enterprise SSC interface by 

issuing commands as necessary to cause all MEKs to be changed. Refer to the TCG 

and vendors shipping TCG Opal or Enterprise storage devices for more information. 

Optionally: After Cryptographic Erase is successfully applied to a device, use the block 

erase command (if supported) to block erase the media. If the block erase command is 

not supported, Secure Erase or the Clear procedure could alternatively be applied. 

Destroy: Shred, Disintegrate, Pulverize, or Incinerate by burning the device in a licensed incinerator. 

Notes: Verification must be performed for each technique within Clear and Purge as described in the 

Verify Methods subsection. 

When Cryptographic Erase is applied, verification must be performed prior to additional 

sanitization techniques (if applicable), such as a Clear or Purge technique applied following 

Cryptographic Erase, to ensure that the cryptographic operation completed successfully. A quick 

sampling verification as described in the Verify Methods subsection should also be performed 

after any additional techniques are applied following Cryptographic Erase. 

The storage device may support configuration capabilities that artificially restrict the ability to 

access portions of the media as defined in the ATA standard, such as a Host Protected Area 

(HPA), Device Configuration Overlay (DCO), or Accessible Max Address. Even when a 

dedicated sanitization command addresses these areas, their presence may affect the ability to 

reliably verify the effectiveness of the sanitization procedure if left in place. Any configuration 

options limiting the ability to access the entire addressable area of the storage media should be 

reset prior to applying the sanitization technique. Recovery data, such as an OEM-provided 

restoration image may have been stored in this manner, and sanitization may therefore impact 

the ability to recover the system unless reinstallation media is also available. 

Not all implementations of encryption are necessarily suitable for reliance upon Cryptographic 

Erase as a Purge mechanism. The decision regarding whether to use Cryptographic Erase 

depends upon verification of attributes previously identified in this guidance and in Appendix D. 

Given the variability in implementation of the Enhanced Secure Erase feature, use of this 

command is not recommended without first referring the manufacturer to identify that the storage 

device’s model-specific implementation meets the needs of the organization. 

Whereas ATA Secure Erase was a Purge mechanism for magnetic media, it is only a Clear 

mechanism for flash due to variability in implementation and the possibility that sensitive data 

may remain in areas such as spare cells that have been rotated out of use. 

Degaussing must not be solely relied upon as a sanitization technique on flash-based storage 

devices or on hybrid devices that contain non-volatile flash storage media. Degaussing may be 

33
 
 

 

Guidelines for Media Sanitization 

used when non-volatile flash media is present if the flash components are sanitized using mediadependent techniques. 

SCSI Solid State Drives (SSDs) This includes SCSI, SAS, Fibre Channel, etc. 

Clear: Overwrite media by using organizationally approved and validated overwriting 

technologies/methods/tools. The Clear pattern should be at least a single pass with a fixed data 

value, such as all zeros. Multiple passes or more complex values may alternatively be used. 

Purge: Two options are available: 

1. Apply the SCSI sanitize command, if supported. One or both of the following options 

may be available: 

a. The block erase command. 

b. If the device supports encryption, the Cryptographic Erase (also known as 

sanitize crypto scramble) command. 

Optionally: After Cryptographic Erase is successfully applied to a device, use 

the block erase command (if supported) to block erase the media. If the block 

erase command is not supported, the Clear procedure could alternatively be 

applied. 

2. Cryptographic Erase through the TCG Opal SSC or Enterprise SSC interface by 

issuing commands as necessary to cause all MEKs to be changed. Refer to the TCG 

and vendors shipping TCG Opal or Enterprise storage devices for more information. 

Optionally: After Cryptographic Erase is successfully applied to a device, use the block 

erase command (if supported) to block erase the media. If the block erase command is 

not supported, the Clear procedure is an acceptable alternative. 

Destroy: Shred, Disintegrate, Pulverize, or Incinerate by burning the device in a licensed incinerator. 

Notes: Verification must be performed for each technique within Clear and Purge as described in the 

Verify Methods subsection. 

The storage device may support configuration capabilities that artificially restrict the ability to 

access portions of the media, such as SCSI mode select. Even when a dedicated sanitization 

command addresses these areas, their presence may affect the ability to reliably verify the 

effectiveness of the sanitization procedure if left in place. Any configuration options limiting the 

ability to access the entire addressable area of the storage media should be reset prior to 

applying the sanitization technique. 

When Cryptographic Erase is applied, verification must be performed prior to additional 

sanitization techniques (if applicable), such as a Clear or Purge technique applied following 

Cryptographic Erase, to ensure that the cryptographic operation completed successfully. A quick 

sampling verification as described in the Verify Methods subsection should also be performed 

after any additional techniques are applied following Cryptographic Erase. 

Not all implementations of encryption are necessarily suitable for reliance upon Cryptographic 

Erase as a Purge mechanism. The decision regarding whether to use Cryptographic Erase 

depends upon verification of attributes previously identified in this guidance and in Appendix D. 

Degaussing must not be performed as a sanitization technique on flash-based storage devices. 

PCI Express Devices Leveraging NVM Express 

Clear: Overwrite media by using organizationally approved and validated overwriting 

technologies/methods/tools. The Clear pattern should be at least a single pass with a fixed data 

value, such as all zeros. Multiple passes or more complex values may alternatively be used. 

Purge: Two options are available: 

1. Apply the NVM Express Format command, if supported. One or both of the following 

options may be available: 

a. The User Data Erase command. 

b. If the device supports encryption, the Cryptographic Erase command. 

34
 
 

 

 

 

 

 

-

 

Guidelines for Media Sanitization 

Optionally: After Cryptographic Erase is successfully applied to a device, use 

the User Data Erase command (if supported) to erase the media. If the User 

Data Erase command is not supported, the Clear procedure could 

alternatively be applied. 

2. Cryptographic Erase through the TCG Opal SSC or Enterprise SSC interface by 

issuing commands as necessary to cause all MEKs to be changed. Refer to the TCG 

and vendors shipping TCG Opal or Enterprise storage devices for more information. 

Optionally: After Cryptographic Erase is successfully applied to a device, use the User 

Data Erase command (if supported) to erase the media. If the User Data Erase 

command is not supported, the Clear procedure is an acceptable alternative. 

Destroy: Shred, Disintegrate, Pulverize, or Incinerate by burning the device in a licensed incinerator. 

Notes: Verification must be performed for each technique within Clear and Purge. 

When Cryptographic Erase is applied, verification must be performed prior to additional 

sanitization techniques (if applicable), such as a Clear or Purge technique applied following 

Cryptographic Erase, to ensure that the cryptographic operation completed successfully. A quick 

sampling verification as described in the Verify Methods subsection should also be performed 

after any additional techniques are applied following Cryptographic Erase. 

Not all implementations of encryption are necessarily suitable for reliance upon Cryptographic 

Erase as a Purge mechanism. The decision regarding whether to use Cryptographic Erase 

depends upon verification of attributes previously identified in this guidance. 

Degaussing must not be performed as a sanitization technique on flash-based storage devices. 

USB Removable Media This includes Pen Drives, Thumb Drives, Flash Drives, Memory Sticks, etc. 

Clear: Overwrite media by using organizationally approved and validated overwriting 

technologies/methods/tools. The Clear pattern should be at least two passes, to include a 

pattern in the first pass and its complement in the second pass. Additional passes may be used. 

Purge: USB removable media does not support sanitize commands, or if supported, the interfaces are 

not supported in a standardized way across these devices. Refer to the manufacturer for details 

about the availability and functionality of any available sanitization features and commands. 

Destroy: Shred, Disintegrate, Pulverize, or Incinerate by burning the device in a licensed incinerator. 

Notes: For most cases where Purging is desired, USB removable media should be Destructed. 

Memory Cards This includes SD, SDHC, MMC, Compact Flash, Microdrive, MemoryStick, etc. 

Clear: Overwrite media by using organizationally approved and validated overwriting 

technologies/methods/tools. The Clear pattern should be at least two passes, to include a 

pattern in the first pass and its complement in the second pass. Additional passes may be used. 

Purge: N/A, See Destruct. 

Destroy: Shred, Disintegrate, Pulverize, or Incinerate by burning the device in a licensed incinerator. 

Notes: None. 

Embedded Flash on Boards and Devices This includes motherboards and peripheral cards such as 

network adapters or any other adapter containing non volatile flash memory. 

Clear: If supported by the device, reset the state to original factory settings. 

Purge: N/A, See Destruct. 

If the flash can be easily identified and removed from the board, the flash may be Destructed 

independently from the disposal of the board that contained the flash. Otherwise, the whole 

board should be Destructed. 

Destroy: Shred, Disintegrate, Pulverize, or Incinerate by burning the device in a licensed incinerator. 

Notes: While Embedded flash has traditionally not been specifically addressed in media sanitization 

guidelines, the increasing complexity of systems and associated use of flash has 

35
 
 

 

 

 

Guidelines for Media Sanitization 

complementarily increased the likelihood that sensitive data may be present. For example, 

remote management capabilities integrated into a modern motherboard may necessitate storing 

IP addresses, hostnames, usernames and passwords, certificates, or other data that may be 

considered sensitive. As a result, for Clearing, it may be necessary to interact with multiple 

interfaces to fully reset the device state. When this concept is applied to the example, this might 

include the BIOS/UEFI interface as well as the remote management interface. 

As with other types of media, the choice of sanitization technique is based on environmentspecific considerations. While the choice might be made to neither Clear nor Purge embedded 

flash, it is important to recognize and accept the potential risk and continue to reevaluate the risk 

as the environment changes. 

Table A-9. RAM and ROM-Based Storage Device Sanitization 

RAM and ROM-Based Storage Devices 

Dynamic Random Access Memory (DRAM) 

Clear/ Purge: Power off device containing DRAM, remove from the power source, and remove the battery (if 

battery backed). Alternatively, remove the DRAM from the device. 

Destroy: Shred, Disintegrate, or Pulverize. 

Notes: In either case, the DRAM must remain without power for a period of at least five minutes. 

Electronically Alterable PROM (EAPROM) 

Clear/ Purge: Perform a full chip Purge as per manufacturer’s data sheets. 

Destroy: Shred, Disintegrate, or Pulverize. 

Notes: None. 

Electronically Erasable PROM (EEPROM) 

Clear/ Purge: Overwrite media by using organizationally approved and validated overwriting 

technologies/methods/tools. 

Destroy: Shred, Disintegrate, Pulverize, or Incinerate by burning the device in a licensed incinerator. 

Notes: None. 

36
 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Guidelines for Media Sanitization 

Appendix B. Glossary 

Glossary Term Definition 

BD Blu-ray Disc: a disc the same shape and size as a CD or DVD; but the BD has a higher 

density and gives the option for data to be multi-layered. 

Bend The use of a mechanical process to physically transform the storage media to alter its shape 

and make reading the media difficult or infeasible using state of the art laboratory 

techniques. 

Clear A method of Sanitization by applying logical techniques to sanitize data in all useraddressable storage locations for protection against simple non-invasive data recovery 

techniques using the same interface available to the user; typically applied through the 

standard read and write commands to the storage device, such as by rewriting with a new 

value or using a menu option to reset the device to the factory state (where rewriting is not 

supported). 

CD Compact Disc: a class of media on which data are recorded by optical means. 

CD-RW Compact Disc Read/Write: A CD that can be Purged and rewritten multiple times. 

CD-R Compact Disc Recordable: A CD that can be written on only once but read many times. 

Also known as WORM. 

CMRR The Center for Magnetic Recording Research (CMRR) advances the state-of-the-art in 

magnetic storage, and trains graduate students and postdoctoral professionals. The Center 

is located at the University of California, San Diego. 

Cut The use of a tool or physical technique to cause a break in the surface of the electronic 

storage media, potentially breaking the media into two or more pieces and making it 

difficult or infeasible to recover the data using state of the art laboratory techniques. 

Cryptographic 

Erase 

A method of Sanitization in which the Media Encryption Key (MEK) for the encrypted 

Target Data is sanitized, making recovery of the decrypted Target Data infeasible. 

Damage A method of Sanitization that renders Target Data recovery difficult or infeasible using 

state of the art laboratory techniques and results in the subsequent inability to use the media 

for storage of data. 

Data Pieces of information from which “understandable information” is derived. 

Degauss To reduce the magnetic flux to virtual zero by applying a reverse magnetizing field. Also 

called demagnetizing. Degaussing any current generation hard disk (including but not 

limited to IDE, EIDE, ATA, SCSI and Jaz) will render the drive permanently unusable 

since these drives store track location information on the hard drive in dedicated regions of 

the drive in between the data sectors. 

Destruct A method of Sanitization that renders Target Data recovery infeasible using state of the art 

laboratory techniques and results in the subsequent inability to use the media for storage of 

data. 

Digital The binary coding scheme generally used in computer technology to represent data as 

binary bits (1s and 0s). 

Disintegration A physically Destructive method of sanitizing media; the act of separating into component 

parts. 

Disposal Disposal is a release outcome following the decision that media does not contain sensitive 

data. This occurs either because the media never contained sensitive data or because 

Sanitization techniques were applied and the media no longer contains sensitive data. 

DVD Digital Video Disc – a disc the same shape and size as a CD; but the DVD has a higher 

density and gives the option for data to be double-sided or double-layered. 

DVD-RW A rewritable (re-recordable) DVD disk for both movies and data from the DVD Forum. 

37
 
 

 

 

 

 

 

 

 

 

 

Guidelines for Media Sanitization 

Glossary Term Definition 

DVD+RW A rewritable (re-recordable) DVD disk for both movies and data from the DVD+RW 

Alliance. 

DVD+R A write-once (read only) version of the DVD+RW optical disk from the DVD+RW 

Alliance. 

DVD-R A write-once (read only) DVD disk for both movies and data endorsed by the DVD Forum. 

Electronic Media General term that refers to media on which data are recorded via an electrically based 

process. 

Erasure Process intended to render magnetically stored information irretrievable by normal means. 

FIPS Federal Information Processing Standard. 

Format Pre-established layout for data. 

Hard Disk A rigid magnetic disk fixed permanently within a drive unit and used for storing data. 

Incineration A physically Destructive method of sanitizing media; the act of burning completely to 

ashes. 

Information Meaningful interpretation or expression of data. 

Legacy Magnetic A class of storage device that uses only magnetic storage media for persistent storage, 

without the assistance of heat (ie. heat assisted magnetic recording, also known as HAMR) 

or the additional use of other persistent storage media such as flash-based media. 

Media Plural of medium. 

Media Sanitization A general term referring to the actions taken to render data written on media unrecoverable 

by both ordinary and extraordinary means. 

Medium Material on which data are or may be recorded, such as paper, punched cards, magnetic 

tape, magnetic disks, solid state devices, or optical discs. 

Melting A physically Destructive method of sanitizing media; to be changed from a solid to a liquid 

state generally by the application of heat. 

Optical Disks A plastic disk that is “written” (encoded) and “read” using an optical laser device. The disc 

contains a highly reflective metal and uses bits to represent data by containing areas that 

reduce the effect of reflection when illuminated with a narrow-beam source, such as a laser 

diode. 

Overwrite Writing one or more patterns of data on top of the physical location of data stored on the 

media. 

Physical 

Destruction 

A Sanitization method for optical media, such as CDs. 

Pulverization A physically Destructive method of sanitizing media; the act of grinding to a powder or 

dust. 

Purge A method of Sanitization by applying physical or logical techniques that render Target 

Data recovery infeasible using state of the art laboratory techniques. 

Read Fundamental process in an information system that results only in the flow of information 

from an object to a subject. 

Record To write data on a medium, such as a magnetic tape, magnetic disk, or optical disc. 

Recovery 

Procedures 

(recoverable) 

Action necessary to store data files of an information system and computational capability 

after a system failure. 

Remanence Residual information remaining on storage media after Clearing. 

Residue Data left in storage after information processing operations are complete, but before 

degaussing or overwriting has taken place. 

ROM Read Only Memory. Generally a commercially available disc or solid state device on 

38
 
 

 

 

 

 

 

 

 

 

 

 

Guidelines for Media Sanitization 

Glossary Term Definition 

which the content was recorded during the manufacturing process. 

Sanitize A process to render access to Target Data on the media infeasible for a given level of effort. 

Clear, Purge, Damage, and Destruct are actions that can be taken to sanitize media. 

Sanitize Command A command in the ATA and SCSI standards that leverages a firmware-based process to 

perform a Sanitization action. If a device supports the sanitize command, the device must 

support at least one of three options: overwriting, block erase (usually for flash-based 

media), or crypto scramble (Cryptographic Erase). These commands typically execute 

substantially faster than attempting to rewrite through the native read and write interface. 

The ATA standard clearly identifies that the Sanitization operations must address user data 

areas, user data areas not currently allocated (including “previously allocated areas and 

physical sectors that have become inaccessible”), and user data caches. The resulting 

media contents vary based on the command used. The overwrite command allows the user 

to specify the data pattern applied to the media, so that pattern (or the inverse of that 

pattern, if chosen) will be written to the media (although the actual contents of the media 

may vary due to encoding). The result of the block erase command is vendor unique, but 

will likely be 0s or 1s. The result of the crypto scramble command is vendor unique, but 

will likely be the ciphertext of the encrypted data (except for areas that were not encrypted, 

which are set to the value the vendor defines). 

Secure Erase 

Command 

An overwrite command in the ATA standard (as ‘Security Erase’) that leverages a 

firmware-based process to overwrite the media. This command typically executes 

substantially faster than attempting to rewrite through the native read and write interface. 

There are up to two options, ‘normal erase’ and ‘enhanced erase’. The normal erase, as 

defined in the standard, is only required to address data in the contents of LBA 0 through 

the greater of READ NATIVE MAX or READ NATIVE MAX EXT, and replaces the 

contents with 0s or 1s. The enhanced erase command specifies that, “...all previously 

written user data shall be overwritten, including sectors that are no longer in use due to 

reallocation” and the contents of the media following Sanitization are vendor unique. The 

actual action performed by an enhanced erase varies by vendor and model, and could 

include a variety of actions that have varying levels of effectiveness. The secure erase 

command is not defined in the SCSI standard, so it does not apply to media with a SCSI 

interface. 

Shred A method of sanitizing media; the act of cutting or tearing into small particles. 

SSD Solid State Drive. A storage device that uses solid state memory to store persistent data. 

Storage Retrievable retention of data. Electronic, electrostatic, or electrical hardware or other 

elements (media) into which data may be entered, and from which data may be retrieved. 

Target Data The information subject to a given process, typically including most or all information on a 

piece of storage media. 

WORM Write-Once Read Many. 

Write Fundamental operations of an information system that results only in the flow of 

information from a subject to an object. 

39
 
Guidelines for Media Sanitization 

This Page Intentionally Left Blank 

40
 
 

Guidelines for Media Sanitization 

Appendix C. Tools and Resources 

Many different government, U.S. military, and academic institutions have 

conducted extensive research in sanitization tools, techniques, and procedures in 

order to validate them to a certain level of assurance. The National Institute of 

Standards and Technology (NIST) does not conduct an evaluation of any tool set to 

validate its ability to Clear, Purge, Damage, or Destruct information contained on 

any specific medium. 

Organizations are encouraged to seek products that they can evaluate on their own. 

They can use a trusted service or other federal organizations’ evaluation of tools 

and products and they are expected to continually monitor and validate the 

effectiveness of their selected sanitization tools as they are used. 

If an organization has a product that they trust and have validated, then they are 

strongly encouraged to share this information through public forums, such as the 

Federal Computer Managers Forum. . 

This guide also recommends that the user consider the NSA devices posted in the 

media Destruction guidance area of the public NSA website. NSA states “The 

products on these lists meet specific NSA performance requirements for sanitizing, 

destroying, or disposing of media containing sensitive or classified information. 

Inclusion on a list does not constitute an endorsement by NSA or the U.S. 

Government.” 

Evaluated product lists are provided on NSA’s website at http://www.nsa.gov/ia/ 

mitigation_guidance/media_destruction_guidance/index.shtml including: 

• Crosscut paper shredders 

• Optical media 

• Degaussers 

• Storage devices 

• Disintegrators 

There are a variety of open source tools available that support leveraging the 

sanitize commands based on standardized interfaces. As with any sanitization tool, 

independent validation should be performed to ensure the desired functionality is 

provided. However, the availability of open source tools helps organizations 

understand how the commands work and allows testing of sanitize commands on a 

drive, as well as supporting the ability of home users to apply sanitization to their 

personal media. 

Open source hdparm project: http://sourceforge.net/projects/hdparm/ 

41
 
 

 

 

 

Guidelines for Media Sanitization 

Organizations and individuals wishing to donate used electronic equipment or 

seeking guidance on disposal of residual materials after sanitization should consult 

the Environmental Protection Agency’s (EPA) electronic recycling and electronic 

waste information website at http://www.epa.gov/e-Cycling/. This site offers 

advice, regulations, and standard publications related to sanitization, disposal, and 

donations. It also provides external links to other sanitization tool resources. 

Organizations can outsource media sanitization and Destruction if business and 

security management decide that this would be the most reasonable option for them 

to maintain confidentiality while optimizing available resources. When exercising 

this option, this guide recommends that organizations exercise “due diligence” 

when entering into a contract with another party engaged in media sanitization. 

Due diligence for this case is accepted as outlined in 16 CFR 682 which states “due 

diligence could include reviewing an independent audit of the disposal company’s 

operations and/or its compliance with this rule [guide], obtaining information about 

the disposal company from several references or other reliable sources, requiring 

that the disposal company be certified by a recognized trade association or similar 

third party, reviewing and evaluating the disposal company’s information security 

policies or procedures, or taking other appropriate measures to determine the 

competency and integrity of the potential disposal company.’5 

Information on the TCG storage specifications is available on the TCG’s website: 

http://www.trustedcomputinggroup.org/ 

Information on the ATA and SCSI standards is available at: 

http://www.t13.org/ 

http://www.t10.org/ 

Information on NVMExpress is available at: 

http://www.nvmexpress.org/ 

5

 Federal Trade Commission 16 CFR Part 682, Disposal of Consumer Report Information and 

Records Section 682.3 (b) (3). 

42
 
               

             

                 

            

             

         

           

     

 

 

Guidelines for Media Sanitization 

Appendix D. Cryptographic Erase Device Guidelines 

The choice regarding whether to leverage Cryptographic Erase on a given device 

depends upon organizational requirements for sanitization, as well as potentially the 

end user’s ability to determine whether the implementation offers sufficient 

assurance against future recovery of the data. The level of assurance depends in 

large part on the factors described in Table D-1. 

Table D-1. Cryptographic Erase Considerations 

Area Consideration(s) Relevant Doc(s) 

Key Generation The level of entropy of the random number 

sources and quality of whitening 

procedures applied to the random data. 

This applies to the cryptographic keys, and 

potentially to wrapping keys affected by the 

CE operation. 

SP800-906 

, 

SP800-90A, 

SP800-90B, 

SP800-90C 

SP800-133 

Media The security strength and validity of FIPS 1407 

, 

Encryption implementation of the encryption 

algorithm/mode used for protection of the 

Target Data. 

FIPS 197, 

SP800-38A (not 

including ECB), 

SP800-38E 

Key Level and The key being sanitized might not be the FIPS 197, 

Wrapping Media Encryption Key, but instead a key SP800-38A, 

used to wrap (that is, encrypt) the MEK or SP800-38F, 

another key. In this case, the security

strength and level of assurance of the

wrapping techniques used should be

commensurate with the level ofstrength

of the CE operation

SP800-131A 

6

 A list of validated DRBGs is available at: 

http://csrc.nist.gov/groups/STM/cavp/documents/drbg/drbgval.html 

7

 Conformance testing for FIPS 140 is conducted within the framework of the 

Cryptographic Module Validation Program (CMVP) and the Cryptographic 

Algorithm Validation Program (CAVP). 

43
 
 

Guidelines for Media Sanitization 

Users seeking to leverage Cryptographic Erase should identify the mechanisms the 

storage device implements to address these areas before relying upon 

Cryptographic Erase for media sanitization. 

Make/Model/Version/Media Type: The product and versions the statement 

applies to, and the type of media the device uses (ie. magnetic, SSD, hybrid, other). 

Key Generation: Identify whether a DRBG such as one of those listed in SP800­

90 was used, and how it has been validated. 

Media Encryption: Identify the algorithm, key strength, mode of operation, and 

any applicable validation(s). 

Key Level and Wrapping: Identify if the MEK (either wrapped with another 

value or not wrapped) is directly sanitized, or if a key that wraps the MEK (a key 

encryption key, or KEK) is sanitized A description of the wrapping techniques 

only applies where a KEK (and not the MEK) is sanitized. Wrapping details, when 

provided, should include the algorithm used, strength, and (if applicable) mode of 

operation. 

Data Areas Addressed: Describe which areas are encrypted and which areas are 

not encrypted. For any unencrypted areas, describe how sanitization is performed. 

Key Life Cycle Management: The key(s) on a device may have multiple 

wrapping activities (wrapping, unwrapping, and rewrapping) throughout the 

device’s lifecycle. Identify how the key(s) being sanitized are handled during 

wrapping activities that are not directly part of the Cryptographic Erase operation. 

For example, a user may have received an SED that was always encrypting, and 

simply turned on the authentication interface. Identify how the previous instance of 

the MEK was sanitized when it was wrapped with the user’s authentication 

credentials. 

Key Sanitization Technique: Describe the media-dependent sanitization method 

for the key being sanitized. Some examples might include three inverted overwrite 

passes if the media is magnetic, a block erase for an SSD, or other media-specific 

techniques for other types of media. 

Key Escrow or Injection: Identify whether the device supports key escrow or 

injection at or below the level of Cryptographic Erase. Identify whether the device 

supports discovery of whether any key(s) at or below the level of the key escrowed 

has/have EVER been escrowed from or injected into the device. If the MEK 

encryption key is directly sanitized and only a KEK can be escrowed, clearly 

identify that fact. 

Error Condition Handling: Identify how the device handles error conditions that 

prevent the Cryptographic Erase operation from fully completing, such as if a 

defect is encountered where an instance of the key to be sanitized is stored. For 

44
 
Guidelines for Media Sanitization 

example, if the location where the key was stored cannot be sanitized, does the 

Cryptographic Erase operation report success or failure to the user? 

Interface Clarity: Identify which interface commands support the features 

described in the statement. If the device supports the use of multiple MEKs, 

identify whether all MEKs are changed using the interface commands available and 

any additional commands or actions necessary to ensure all MEKs are changed. 

D.2 Example Statement of Cryptographic Erase Features 

The following statements should be placed by the storage device vendor in an area 

accessible to potential users of a device, such as on the vendor’s website or in 

product literature that is widely available. Information of a proprietary nature may 

not be available in published product information. 

Make/Model/Version/Media Type: Acme hard drive model abc12345 version 

1+. Media type is Legacy Magnetic media. 

Key Generation: A DRBG is used as specified in SP800-90, with validation 

[number]. 

Media Encryption: Media is encrypted with AES 256 media encryption in CBC 

mode as described in SP800-38A. This device is FIPS 140 validated with 

certificate [number]. 

Key Level and Wrapping: The media encryption key is sanitized directly during 

Cryptographic Erase. 

Data Areas Addressed: The device encrypts all data stored in the LBAaddressable space except for a preboot authentication and variable area and the 

device logs. The preboot authentication and variable areas are sanitized during the 

Cryptographic Erase process by rewriting with three passes, using a pattern that is 

inverted between passes. Device log data is retained by the device following 

Cryptographic Erase. 

Key Lifecycle Management: As the MEK moves between wrapped, unwrapped, 

and re-wrapped states, the previous instance is sanitized using three inverted 

overwrite passes. 

Key Sanitization Technique: Three passes with a pattern that is inverted between 

passes. 

Key Escrow or Injection: The device does not support escrow or injection of the 

keys at or below the level of the sanitization operation. 

45
 
Guidelines for Media Sanitization 

Error Condition Handling: If the storage device encounters a defect in a location 

where a key is stored, the device attempts to rewrite the location and the 

Cryptographic Erase operations continues, reporting success to the user if the 

operation is otherwise successful. 

Interface Clarity: The device has an ATA interface and supports the ATA 

sanitize crypto scramble command and a TCG Opal interface with the ability to 

revert the device and cryptographically erase the contents. Both of these 

commands apply the functionality described in this statement. 

46
 
 

Guidelines for Media Sanitization 

Appendix E: Device-Specific Characteristics of Interest 

Storage vendors implement a range of devices and media types that leverage the same 

standardized command sets. Some examples of command sets include ATA, SCSI, and 

NVM Express. There are likely to be differences in implementation between, for example, 

the enhanced Security Erase command for ATA devices from different vendors. Some 

vendors may have implementations ‘under the hood’ that apply techniques such as 

Cryptographic Erase, block erase (for flash devices), or other techniques. It may be 

difficult or impossible for users to know for sure how the sanitization action is being 

implemented. 

In order to support informed decision making by users, vendors may choose to provide 

information about how a specific device implements any dedicated sanitize commands 

supported by the device. When reported by vendors, this information also helps purchasing 

authorities make informed decisions about which storage devices to acquire based on the 

availability of suitable sanitization functions and approaches. 

•	 The media type (ie. Legacy Magnetic, HAMR, magnetic shingle, SLC/MLC/TLC 

Flash, Hybrid, etc.) 

o	 If the device contains magnetic media, the coercivity of the magnetic 

media (to support an informed decision about whether to attempt to 

degauss the media) 

•	 Which sanitize commands are supported (if any) 

•	 For each command supported: 

o	 A list of any areas not addressed by the sanitization command 

o	 The estimated time necessary for the command to successfully complete 

o	 The results of any validation testing, if applicable 

47
 
Guidelines for Media Sanitization 

Appendix F: Sources 

 All About Degausser and Erasure of Magnetic Media. Athana 

International. 20 June 2005 

 Anastasi, Joe. The New Forensics: Investigating Corporate Fraud and 

the Theft of Intellectual Property . N.p.: John Wiley and Sons, 2003. 1­

288. 

 ANSI INCITS 452-2008, "Information technology – AT Attachment 8 ­

ATA/ATAPI Command Set (ATA8-ACS)" 

 Army Regulation 25–2. U.S Army. ELECTRONIC PUBLISHING 

SYSTEM, 17 Nov 2003. 

 Davis, Harvey A. National Security Agency. NSA/CSS POLICY 

MANUAL 9-12. N.p.: n.p., 2006. 

 "Degaussing Described." Weircliffe International Ltd in the 

interests of magnetic media users and others who are affected by the 

phenomena of Ferro-magnetism (2005). 

 Deng, Yuhui What is the future of disk drives, death or rebirth? ACM 

Computing Surveys, Vol. 43, No. 3, Article 23 April 2011 

 Dictionary definition of EPROM 

The American Heritage® Dictionary of the English Language, Fourth 

Edition Copyright © 2004, 2000 by Houghton Mifflin Company. 

Published by Houghton Mifflin Company. 

 "Future of Computing (Optical & Biological Possibilities)." Future of 

Computing. 04 June 1997. Dept. of Engineering, Imperial College 

London. 10 Nov. 2005 

 Garfinkel, Simson L., and Abhi Shelat. "Remembrance of Data Passed: 

A Study of Disk sanitization Practices." IEEE Security & Privacy 

1st ser. 1 (2003). 09 June 2005 

 Gibson, Garth and Polte, Milo Directions for Shingled-Write and TwoDimensional Magnetic Recording System Architectures: Synergies with 

Solid-State Disks Carnegie Mellon University Parallel Data Laboratory 

(CMU-PDL-09-104) 

http://repository.cmu.edu/cgi/viewcontent.cgi?article=1004&context=p 

dl May 2009 

 Gutmann, Peter, ed. Secure Deletion of Data from Magnetic and 

Solid-State Memory. San Jose: Sixth USENIX Security Symposium 

Proceedings, 1996. 

48
 
Guidelines for Media Sanitization 

 Gutmann, Peter, ed. Data Remanence in Semiconductor Devices. 

Washington, D.C: 10th USENIX SECURITY SYMPOSIUM, 2001. 

 Hughes, G.F.; Coughlin, T.; Commins, D.M. Disposal of Disk and Tape 

Data by Secure Sanitization Volume: 7 , Issue: 4 July/August 2009 

 INCITS T10/1731-D, "Information technology - SCSI Primary 

Commands - 4 (SPC-4)" 

 J.Hasson, “V.A. Toughens Security after PC Disposal Blunders,” 

Federal Computer Week, 26 Aug. 2002; 

 King, Christopher and Vidas, Timothy Empirical analysis of solid state 

disk data retention when used with contemporary operating systems 

Digital Investigation 8 (2011) S111-S117 

http://www.dfrws.org/2011/proceedings/17-349.pdf August 2011 

 Magnetoresistive Random Access Memory (MRAM). Comp. James 

Daughton. 4 Feb. 2000. NVE. 17 June 2005 

 Microsoft, “Microsoft Extensible Firmware Initiative FAT32 File 

System Specification,” 6 Dec. 2000; 

 National Computer Security Center, “A Guide to Understanding Data 

Remanence in Automated Information Systems,” 

 Phillips, B. J., Schmidt, C. D., Kelly, D. R. Recovering data from USB 

flash memory sticks that have been damaged or electronically erased eForensics '08: Proceedings of the 1st international conference on 

Forensic applications and techniques in telecommunications, 

information, and multimedia and workshop January 2008 

 Understand Degaussing. Peripheral Manufacturing Inc. 18 June 

2005. 

 US Department of Defense, “Cleaning and Sanitization Matrix,” DOS 

5220.22-M, Washington, D.C., 1995. 

 Wei, Michael, Grupp, Laura M., Spada, Frederick E., Swanson, Steven 

Reliably Erasing Data From Flash-Based Solid State Drives February 

2011 

 Xu, Baoxi, Yang, Jiaping, Yuan, Hongxing, Zhang, Jun, Zhang, Qide, 

and Chong Tow Chong "Thermal Effects in Heat Assisted Bit Patterned 

Media Recording," Magnetics, IEEE Transactions on , vol.45, no.5, 

pp.2292-2295, May 2009 doi: 10.1109/TMAG.2009.2016466 

http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=4815969&is 

number=4815960 

49
 
 

Guidelines for Media Sanitization 

Appendix G: Sample Sanitization Validation Form 

This certificate is simply an example to demonstrate the types of information that should be 

collected and how a certificate might be formatted. An organization could alternatively 

choose to electronically record sanitization details, either through a native application or by 

using a form such as this one with an automated data transfer utility (such as a PDF form 

with a button to send the data to a database or email address). In the event that the records 

need to be referenced in the future, electronic records will likely provide the fastest search 

capabilities and best likelihood that the records are reliably retained. 

50