One term, several techniques
Sanitization is the practice. Its goal is that no recoverable data remains when a medium is reused, repurposed, or disposed of. A sanitization method is how that goal is reached on a specific device: the concrete mechanism an operator runs.
The difference matters. Methods vary by the storage technology they work on, the strength of the protection they give, whether the medium survives, and how the result can be proven later.
Methods fall into two families. Logical methods (overwriting, block erase, cryptographic erase) act on data through software or the storage controller, so the medium can stay reusable. Physical methods (degaussing and destruction) act on the medium itself and end its working life.
NIST Special Publication 800-88 places each method under one of three outcome levels. Clear defeats ordinary software recovery. Purge defeats state-of-the-art laboratory techniques. Destroy removes the medium from use entirely.
The five recognized methods
Formal guidance and industry practice converge on five methods. Each fits a class of media and reaches a set outcome level:
| Method | How it works | Outcome | Typical media |
|---|---|---|---|
| Overwrite | Writes a fixed pattern over every addressable location | Clear | Working magnetic disks |
| Block erase | A controller command erases flash cells the host cannot reach | Purge | SSDs, USB flash, embedded storage |
| Cryptographic erase | Destroys the encryption key, so the data is unreadable | Purge | Encrypted drives and flash media |
| Degauss | A strong magnetic field collapses the domains that hold data | Purge | Hard disks and magnetic tapes |
| Physical destruction | Shredding, pulverizing, or incineration makes the medium unusable | Destroy | Any medium, including failed drives |
How each method behaves in practice
The table hides practical differences, and these often decide a disposal policy.
Overwriting: one pass with a known pattern is enough for modern magnetic disks, but the medium must be fully working. The pass cannot reach remapped sectors or space the host never addressed. That is why overwriting counts as clear, not purge.
Block erase: the drive's own controller runs the sanitize command. It can erase cells the operating system never sees, including over-provisioned areas. The command must complete successfully to count.
Cryptographic erase: it is near-instant at any capacity. Its strength depends on key management. A key that was escrowed, backed up, or leaked can undo the erase, so the key inventory matters as much as the command.
Degauss: one exposure wipes everything magnetic, including firmware and servo data, so the medium never works again. It has no effect on flash or optical media, so it cannot serve as a general method.
Physical destruction: the only reliable option for media that cannot run commands, such as failed drives or optical discs. It is the usual choice for the most sensitive data. Protection depends on the particle size the equipment achieves.
Choosing a method
Choosing a method means matching inputs, not ranking strength. A workable policy sets the inputs, and the method follows from them:
- 1
Storage technology
It determines which methods are physically possible. Overwriting suits magnetic disks, block erase suits flash, degaussing suits magnetic media only, and destruction suits everything.
- 2
Data sensitivity
The higher the classification, the higher the outcome level the policy demands. Less sensitive data may need only clear. Regulated data usually needs purge or destroy.
- 3
Next destination
Reuse at the same sensitivity level permits clear. Transfer to a less trusted environment or disposal calls for purge or destroy.
- 4
Condition of the medium
A drive that no longer accepts commands cannot be logically sanitized. It goes straight to degaussing or destruction.
- 5
Encryption from first use
On a well-managed encrypted drive, destroying the key gives purge-grade protection in seconds. That is why encrypting data at write time is recommended.
- 6
Practical constraints
Volume, time, equipment cost, and whether the result can be verified. A fast method that cannot be evidenced is weaker in practice than a slower one that can.
Two common cases
Two combinations cover most decisions. A healthy magnetic disk that stays inside the organization is cleared by overwriting. Any medium that leaves it, whether resold, returned to a lessor, or recycled, is purged or destroyed according to the classification of the data it held.
Verification and records
An unverified result is only an assumption, whatever the method. Overwriting and block erase are verified by sampling the medium and reading back no recognizable data. Cryptographic erase is verified by confirming the key is gone from every place it was kept, including backups and escrow. Destruction is verified by the equipment's rated particle size and by witnesses or certificates. A failed check sends the medium through the method again, or up the ladder to destruction.
Mature programs record, for each device, the serial number, data classification, method, and tool, operator, date, and verification result. Years later, when retired drives are questioned, the organization can show which medium was sanitized and how, instead of relying on memory.
A sanitization method is only as good as the record that proves it ran.
Anexet Team