Get NIST SP 800-88 sanitization recommendations for any media type. Free tool provides destruction methods, verification steps, and compliance documentation.
Media sanitization is the process of irreversibly removing data from storage media to prevent unauthorized recovery. Simply deleting files or formatting a drive does not destroy the underlying data — forensic tools can recover deleted files from hard drives, SSDs, USB drives, and even mobile devices. Proper sanitization ensures that sensitive data is unrecoverable when media is repurposed, sold, donated, or disposed of.
NIST Special Publication 800-88 Revision 1 (Guidelines for Media Sanitization) defines the authoritative framework for sanitization methods, and compliance frameworks including HIPAA, PCI DSS, and GDPR require documented media sanitization procedures for devices containing protected data.
NIST 800-88 defines three levels of sanitization, each appropriate for different risk scenarios:
| Method | Description | Data Recovery Possible? | Use When |
|---|---|---|---|
| Clear | Overwrite with a fixed pattern using standard write commands | Recoverable with specialized lab equipment | Reusing media within the same organization |
| Purge | Use media-specific techniques (crypto-erase, block erase, degauss) that make recovery infeasible even with state-of-the-art lab equipment | Not feasible with known techniques | Releasing media outside organizational control |
| Destroy | Physically destroy the media (shred, incinerate, disintegrate, melt) | Physically impossible | Highest-security data; end-of-life disposal |
| Media Type | Clear Method | Purge Method | Destroy Method |
|---|---|---|---|
| HDD (magnetic) | Full overwrite (1+ pass) | Degaussing or secure erase (ATA) | Shredding or disintegration |
| SSD/Flash | Full overwrite (limited effectiveness) | Crypto-erase or ATA Secure Erase | Shredding or disintegration |
| Optical media | N/A | N/A | Shredding or incineration |
| Magnetic tape | Full overwrite | Degaussing | Shredding or incineration |
| Mobile devices | Factory reset + encryption | Crypto-erase | Shredding |
NIST Special Publication 800-88 "Guidelines for Media Sanitization" provides recommendations for sanitizing media containing sensitive data. It defines three sanitization methods: Clear (logical techniques), Purge (physical or logical techniques that make data infeasible to recover), and Destroy (physical destruction rendering media unusable).
Destroy media containing Top Secret or highly classified data, when media is damaged and cannot be purged, or when the organization has no need for the media. Purge is appropriate for media that will be reused within the same security environment or when data recovery must be infeasible but physical destruction is not required.
SSDs cannot be reliably sanitized by overwriting due to wear leveling, over-provisioning, and spare blocks. For SSDs, use cryptographic erase (if the drive supports hardware encryption), manufacturer-specific secure erase commands, or physical destruction. Traditional degaussing does not work on SSDs as they are not magnetic media.
A certificate of destruction is a formal document verifying that media was sanitized or destroyed according to policy. It typically includes: media description, serial numbers, sanitization method used, date, personnel involved, and verification results. This tool generates a certificate template for your records.
Multiple regulations address data disposal: HIPAA requires proper disposal of PHI, PCI-DSS requires destruction of cardholder data media, GDPR right to erasure requires verifiable deletion, and CMMC/NIST 800-171 requires media sanitization for CUI. This tool maps recommendations to relevant compliance requirements.
Extract deep metadata from any file: EXIF data and GPS coordinates from photos, PDF document properties, audio ID3 tags and album art, Office document metadata (DOCX, XLSX, PPTX), and SHA-256 hashes. All processing happens locally in your browser.
Free Shannon entropy calculator for malware analysis. Detect packed, encrypted, or obfuscated binaries with entropy visualization, byte distribution analysis, and section-by-section scanning.
Design comprehensive data classification policies with government (TS/S/C/U) or commercial (Restricted/Confidential/Internal/Public) schemas. Define handling rules for storage, transmission, disposal, and access with compliance overlays for HIPAA, PCI-DSS, GDPR, and CMMC.