What is media sanitization?
Media sanitization is the process of making data on storage media infeasible to recover for the level of effort an adversary is expected to spend. A normal delete just tells the file system the space is free, and a quick format builds a fresh, empty directory structure; in both cases the old bytes remain until new data happens to land on them. Recovery software reads exactly that residue, known as data remanence. Sanitization applies to hard drives, SSDs, USB drives, memory cards, phones and backup tapes, and to devices that hide storage inside them, such as copiers, printers and network appliances.
Clear, purge and destroy
NIST Special Publication 800-88, Guidelines for Media Sanitization, groups methods into three levels:
| Level | Protects against | Examples | Reusable? |
|---|---|---|---|
| Clear | Simple recovery with ordinary tools | Overwriting all user-addressable locations, factory reset | Yes |
| Purge | Laboratory recovery techniques | Firmware sanitize or secure erase commands, cryptographic erase, degaussing magnetic media with a rated degausser | Yes, except degaussed hard drives |
| Destroy | Lab recovery; the media cannot be used again | Shredding, disintegration, pulverizing, melting or incineration | No |
Matching the method to the media
- Hard disk drives: a single full overwrite pass is enough to clear a modern drive, and extra passes only lengthen the job. Running the drive's own secure erase or sanitize command also reaches remapped sectors and counts as purge. Degaussing with a unit rated for the drive's coercivity purges it but leaves it unusable.
- SSDs and flash: wear leveling and spare blocks mean a software overwrite may never touch the cells that hold old data. Use the drive's sanitize command, cryptographic erase, or destruction with a small particle size.
- Tapes: degauss or shred.
- Optical discs: they cannot be degaussed, so shred or disintegrate them.
- Phones: modern phones encrypt storage by default, so a factory reset that discards the keys acts as a cryptographic erase.
- Cloud storage: you cannot touch the media, so deleting the data and the customer-managed encryption keys that protected it (crypto shredding) is the practical method.
Choosing a level
Pick the level from the data's sensitivity and the media's next stop. Clearing can be acceptable for a laptop being handed to another employee in the same team, although the current revision of NIST SP 800-88 advises purge over clear whenever purge is practical. Purge or destruction is expected once media leaves the organization's custody: resale, return at the end of a lease, donation or recycling. Media that held highly sensitive data and has no further use is often simply destroyed. Before sanitizing anything, check retention schedules and legal holds, since destroying data under a hold can be treated as spoliation of evidence. Afterward, test a sample of the media to confirm the method worked.
Proving sanitization
Auditors and regulators expect evidence, not assurances. Record each device's asset tag and serial number, the method and tool used, who performed the work, the date and the verification result. When an IT asset disposition (ITAD) vendor does the work, keep a signed chain of custody from pickup onward and require a certificate of destruction or sanitization that lists every serial number. Vendors are often chosen partly on certifications such as NAID AAA. Mark disposed assets in the inventory rather than deleting their records, so the history survives for audits.
Media sanitization on the CompTIA Security+ exam
Sanitization and destruction fall under SY0-801 objective 4.2, which covers the asset life cycle through disposal and decommissioning. Read each scenario for the media type, the data's sensitivity and the media's destination. SSD laptops at the end of their lease points to cryptographic erase or a sanitize command, not shredding. An auditor wants evidence the disks were shredded points to a certificate of destruction. Formatting and deleting are never sanitization, degaussing an SSD is always wrong, and destroying media is the wrong call when it has to be returned or reused. Media sanitization also appears in A+ Core 2 (220-1202) objective 2.9, which covers data destruction and disposal methods.