Media Sanitization

Media sanitization applies whenever a storage medium leaves one owner's control. A laptop is resold, a leased server is returned, a USB stick moves between projects, a failed drive goes back to the vendor, and backup tapes reach the end of their retention. In each case, the next holder must not be able to recover what the previous holder stored on it.

The term covers more than computers, because storage hides in devices people do not think of as drives. It includes internal and external drives, USB sticks, memory cards and portable SSDs, phones, and tablets with built-in flash, backup tapes and optical discs, and the internal disk or flash module inside printers, scanners, and network equipment. Every removable medium that changes hands needs the same decision.

Sanitization is a ladder, not a single strength level. NIST SP 800-88 names its three rungs, and the right one depends on how sensitive the data was and where the medium goes next: back into a similar environment, into a less trusted one, or out of the organization entirely. Each rung is a sanitization method with its own limits.

When an operating system deletes a file, it removes the file-system entry that points to the data and marks the space as free. The bytes stay on the medium until that space is reused, and until then they can often be recovered with widely available tools. This leftover data is called remanence. A quick format is no stronger, because it rewrites the index rather than necessarily the data area.

Sanitization must also reach data the current operating system cannot see: remapped sectors on a failing drive, the over-provisioned area of an SSD, partitions left by earlier installations, and slack space at the end of partly overwritten blocks. That is why it acts on the storage itself, and why it is required before any medium changes hands.

Overwriting, the classic clearing technique, was designed for magnetic disks, where the host can address every sector directly. Flash storage breaks that assumption. Wear leveling and over-provisioning let the controller write to cells the host never sees, so an overwrite pass cannot prove that it reached every physical copy. For SSDs, USB sticks and phones, sanitization therefore relies on drive-native sanitize commands or on cryptographic erase, which destroys the encryption key instead of the data.

Cryptographic erase is fast and complete only when the medium was encrypted from its first day of use, and only as far as the key management behind it. A key that was escrowed, backed up or leaked can undo the erase. For media that cannot run a sanitize command and were never encrypted, physical destruction is usually the only defensible answer.

A sanitization action that cannot be evidenced did not happen, as far as an auditor is concerned. Mature programs treat the action and its record as one control. The operator runs the technique, samples the result to confirm that the data is gone, and issues a certificate. Where disposal is outsourced, the chain of custody and the vendor's certificates join the record. The usual sequence is this:

1. 1

   Run the technique

   The operator applies the chosen sanitization method to the medium.

2. 2

   Sample the result

   A sample confirms that the data can no longer be recovered.

3. 3

   Issue the certificate

   The certificate names the medium, technique, tool, operator, date, and outcome.

A certificate can only name a medium that someone has recorded. Anexet Inventory keeps a card for each device with its type, manufacturer, serial number, status, and location, so the serial number on a certificate can be matched to a register entry. Anexet does not sanitize media itself. It supplies the inventory that the sanitization record depends on.

Sanitization is a lifecycle control, not a one-time event. It connects the asset register, which knows which media exist and where they are, to the data classification scheme, which sets how strong sanitization must be, and to the retention schedule, which sets when the data's retention period ends.

Written requirements appear in several frameworks. NIST SP 800-88 covers the subject directly, ISO/IEC 27001 expects documented media handling through disposal, and sector rules for payment card and health data call for controlled disposal too. Inside an organization, the data owner classifies, IT executes and security verifies. The policy also sets defaults for common exits: internal reuse, return of leased equipment, resale, recycling, and destruction.