Get a NIST SP 800-88 Clear, Purge or Destroy recommendation from media type, data classification and disposition, with a PDF and certificate template.
Answer three questions — what media you are disposing of, how sensitive the data on it is, and where the asset is going — and this decision-tree wizard recommends a sanitization method under NIST Special Publication 800-88 Revision 1, Guidelines for Media Sanitization. It returns the recommended method, the specific procedures for that media type, verification steps, suitable tools, and the regulations that apply, and it can export the whole thing as a PDF that includes a Certificate of Destruction template for your records.
This is decision-support guidance, not a professional assessment. Data destruction decisions carry legal and contractual consequences, and the right answer depends on facts a wizard cannot see — your contracts, your regulator, your classification policy. Use this to reach a defensible starting position, then have it reviewed by whoever owns risk in your organisation.
NIST SP 800-88 Rev. 1 defines exactly three sanitization categories. They are ordered by the level of recovery effort they defeat, and choosing between them is the entire decision.
Clear applies logical techniques through the device’s standard read/write interface to protect against simple, non-invasive data recovery. Overwriting user-addressable storage is the classic example. Clear defeats keyboard-level recovery — undelete utilities, forensic software reading through the normal interface — but it does not reach areas the standard interface cannot address.
Purge applies physical or logical techniques that make data recovery infeasible using state-of-the-art laboratory techniques. Degaussing a magnetic drive, cryptographic erase on a self-encrypting drive, and firmware-level block erase commands are Purge techniques. Purge defeats a well-resourced attacker with laboratory equipment; Clear does not.
Destroy renders the media itself unusable and target data recovery infeasible. Shredding, disintegration, incineration, and pulverisation are Destroy techniques. The media cannot be reused afterwards — that is the point.
An important detail people miss: the three are not a strictness ladder you should always climb. NIST’s own framing is that the method should be proportionate to the confidentiality of the data and the intended disposition of the media. Destroying a serviceable drive holding internal-only data is a waste of an asset and, increasingly, an environmental and cost problem. Clearing a drive holding regulated data before selling it is a breach waiting to happen. The point of the decision tree is to land on the proportionate answer, not the most dramatic one.
The logic follows the shape of the SP 800-88 decision flow. Top Secret / Classified data always goes to Destroy. Restricted data may be Purged if the asset stays inside the organisation but is Destroyed if it leaves. Confidential data is Cleared for internal reuse and Purged otherwise. Internal data is Cleared for internal reuse, Purged when leaving your control through sale, donation, or lease return, and Cleared for recycling. Paper is always Destroy, because there is no meaningful Clear or Purge for a printed page. RAM resolves to Clear outside destruction scenarios, because volatile memory loses its contents when power is removed.
The consistent thread — and the rule to take away even if you never use the tool again — is that media leaving your organisation’s control needs at least Purge. Lease returns and donations are where organisations most often under-sanitize, because the device is not being “thrown away” and so feels lower-risk than it is.
HDDs Clear via ATA Secure Erase or a single-pass overwrite with a fixed pattern. Purge via degaussing with an NSA-approved degausser, cryptographic erase on a self-encrypting drive, or verified firmware secure erase. Note that degaussing destroys the servo tracks — a degaussed drive is no longer usable.
SSDs are the important special case. Overwriting does not work reliably on flash. Wear levelling and over-provisioning mean the controller writes to different physical cells than the logical addresses you targeted, so data can survive in cells the standard interface cannot reach. This is why SP 800-88 Rev. 1 moved away from the multi-pass overwrite thinking of the older DoD 5220.22-M era. For SSDs, Purge means the manufacturer’s block erase command or cryptographic erase on a drive that supports it — not a wipe utility running passes over the filesystem. The tool reflects this: SSD Clear procedures are explicitly caveated as possibly not reaching all cells.
Cryptographic erase deserves its own note, since it is the most practical Purge technique available today. If the drive encrypted everything it ever wrote and you destroy the key, the ciphertext is unrecoverable and the operation takes seconds instead of hours. It depends entirely on the drive having been encrypted from first use with a properly managed key — enabling encryption after the fact does not retroactively protect what was written before.
Magnetic tape Purges by degaussing with a degausser rated for tape. Optical media has no meaningful Clear or Purge and goes straight to destruction — shredding, incineration, or grinding away the data layer. Mobile devices Purge via cryptographic wipe (enable encryption, then factory reset) or MDM remote wipe. Network equipment needs NVRAM wiped and crypto keys and certificates reset, not just a factory reset — router and firewall configurations carry credentials, VPN keys, and internal topology. Paper is destroyed by cross-cut shredding to DIN 66399 level P-4 as a minimum, and P-5 or P-6 for classified material.
Every recommendation cites NIST SP 800-88 Rev. 1 as the baseline. Depending on classification and media, it adds: HIPAA (45 CFR §164.310(d)(2)(i)) for media holding protected health information; PCI-DSS Requirement 9.8 for cardholder data; GDPR Article 17 for the right to erasure; DoD 5220.22-M for classified information under the National Industrial Security Program; the NSA/CSS Evaluated Products List for equipment used to destroy classified media; and DIN 66399, which defines the P-1 to P-7 particle-size security levels for paper and other data media.
Sanitization you cannot evidence is sanitization you cannot defend in an audit or a breach investigation. The PDF export captures the media type, classification, disposition, recommended method, procedures, verification checklist, tools, and cited regulations, dated and referenced to SP 800-88 Rev. 1 — and appends a Certificate of Destruction template for recording serial numbers, the method used, the date, and the personnel or vendor responsible. Where a third party performs destruction, obtain their certificate as well; the verification steps for Destroy include visual inspection, particle size confirmation, and photographic evidence for exactly this reason.
Sanitization decisions depend on classification, so map your data first with the data classification architect. For the surrounding programme, see the compliance checklist, and for health-sector obligations the HIPAA quick assessment.
Clear uses the device’s normal interface to defeat simple recovery. Purge uses physical or logical techniques that defeat laboratory recovery. Destroy renders the media itself unusable. The categories come from NIST SP 800-88 Rev. 1.
For magnetic hard drives, yes — SP 800-88 Rev. 1 recognises a single-pass overwrite as Clear, and the multi-pass folklore from older standards is not required for modern drives. For SSDs, overwriting is not reliable at all; use block erase or cryptographic erase instead.
Wear levelling and over-provisioning mean the controller may write to physical cells other than the ones you addressed, leaving data in areas the standard interface cannot reach. Use the manufacturer’s secure erase or cryptographic erase.
Only as a Clear. For Purge, use a cryptographic wipe — confirm the device is encrypted, then factory reset so the key is discarded — or a manufacturer secure erase utility or MDM remote wipe.
Not necessarily. Recycling with Internal or Confidential data typically calls for Clear or Purge rather than destruction. Restricted and classified data, and any situation where the asset leaves your control unverified, push toward Destroy. Run the wizard with your actual disposition.
Treat it as leaving your control. The recommendation escalates to Purge for Internal and Confidential data and to Destroy for Restricted data — which is why lease agreements for sensitive workloads should be negotiated with drive retention or destruction rights up front.
It produces a template as part of the PDF export, with fields for serial numbers, method, date, and responsible personnel. It is a record for you to complete, not a certification issued by anyone.
No. It is guidance based on SP 800-88 Rev. 1 and the inputs you provide. Confirm the outcome against your own policies, contracts, and regulatory obligations before acting on it.
Media sanitization is the process of irreversibly removing data from storage media to prevent unauthorized recovery. Simply deleting files or formatting a drive does not destroy the underlying data — forensic tools can recover deleted files from hard drives, SSDs, USB drives, and even mobile devices. Proper sanitization ensures that sensitive data is unrecoverable when media is repurposed, sold, donated, or disposed of.
NIST Special Publication 800-88 Revision 1 (Guidelines for Media Sanitization) defines the authoritative framework for sanitization methods, and compliance frameworks including HIPAA, PCI DSS, and GDPR require documented media sanitization procedures for devices containing protected data.
NIST 800-88 defines three levels of sanitization, each appropriate for different risk scenarios:
| Method | Description | Data Recovery Possible? | Use When |
|---|---|---|---|
| Clear | Overwrite with a fixed pattern using standard write commands | Recoverable with specialized lab equipment | Reusing media within the same organization |
| Purge | Use media-specific techniques (crypto-erase, block erase, degauss) that make recovery infeasible even with state-of-the-art lab equipment | Not feasible with known techniques | Releasing media outside organizational control |
| Destroy | Physically destroy the media (shred, incinerate, disintegrate, melt) | Physically impossible | Highest-security data; end-of-life disposal |
| Media Type | Clear Method | Purge Method | Destroy Method |
|---|---|---|---|
| HDD (magnetic) | Full overwrite (1+ pass) | Degaussing or secure erase (ATA) | Shredding or disintegration |
| SSD/Flash | Full overwrite (limited effectiveness) | Crypto-erase or ATA Secure Erase | Shredding or disintegration |
| Optical media | N/A | N/A | Shredding or incineration |
| Magnetic tape | Full overwrite | Degaussing | Shredding or incineration |
| Mobile devices | Factory reset + encryption | Crypto-erase | Shredding |
NIST Special Publication 800-88 "Guidelines for Media Sanitization" provides recommendations for sanitizing media containing sensitive data. It defines three sanitization methods: Clear (logical techniques), Purge (physical or logical techniques that make data infeasible to recover), and Destroy (physical destruction rendering media unusable).
Destroy media containing Top Secret or highly classified data, when media is damaged and cannot be purged, or when the organization has no need for the media. Purge is appropriate for media that will be reused within the same security environment or when data recovery must be infeasible but physical destruction is not required.
SSDs cannot be reliably sanitized by overwriting due to wear leveling, over-provisioning, and spare blocks. For SSDs, use cryptographic erase (if the drive supports hardware encryption), manufacturer-specific secure erase commands, or physical destruction. Traditional degaussing does not work on SSDs as they are not magnetic media.
A certificate of destruction is a formal document verifying that media was sanitized or destroyed according to policy. It typically includes: media description, serial numbers, sanitization method used, date, personnel involved, and verification results. This tool generates a certificate template for your records.
Multiple regulations address data disposal: HIPAA requires proper disposal of PHI, PCI-DSS requires destruction of cardholder data media, GDPR right to erasure requires verifiable deletion, and CMMC/NIST 800-171 requires media sanitization for CUI. This tool maps recommendations to relevant compliance requirements.
Extract deep metadata from any file: EXIF data and GPS coordinates from photos, PDF document properties, audio ID3 tags and album art, Office document metadata (DOCX, XLSX, PPTX), and SHA-256 hashes. All processing happens locally in your browser.
Free Shannon entropy calculator for malware analysis. Detect packed, encrypted, or obfuscated binaries with entropy visualization, byte distribution analysis, and section-by-section scanning.
Design comprehensive data classification policies with government (TS/S/C/U) or commercial (Restricted/Confidential/Internal/Public) schemas. Define handling rules for storage, transmission, disposal, and access with compliance overlays for HIPAA, PCI-DSS, GDPR, and CMMC.