Media Sanitization: Clear, Purge and Destroy, and When to Use Each

Media sanitization is removing data from storage so it cannot be recovered. The standard framework sorts methods into three categories by how much effort recovery would take afterwards, and choosing between them is a risk decision driven by data sensitivity and whether the media is leaving your control.

Why deleting is not sanitizing

Deleting a file removes its directory entry. The data stays on the medium until something else is written over it, and recovery is a matter of running readily available software.

A quick format is the same idea at volume scale — the filesystem structures are rewritten and the data is untouched. A full format on modern systems does write zeros, which is closer to sanitization, but the terminology confuses people and it is not what most users mean when they say they formatted the drive.

Emptying the recycle bin, resetting to factory defaults on some devices, and moving files to another volume all leave recoverable data behind. This is the single most common misunderstanding in the topic and it is reliably tested.

The three categories

Clear applies logical techniques through the device's normal read and write interface — typically a single overwrite pass across all addressable locations. It defeats recovery using ordinary software and standard tools, which covers the realistic threat for media staying inside the organization. The medium remains usable.

Purge applies techniques that defeat recovery even in a laboratory with specialist equipment. Methods include cryptographic erase, the drive's own firmware-level secure erase command, multiple overwrite passes where appropriate, and degaussing for magnetic media. The medium may or may not remain usable depending on the method — degaussing destroys the servo information on a modern hard drive and renders it inoperable.

Destroy physically prevents any use of the medium: shredding, disintegration, incineration, pulverization, or melting. Nothing is recoverable and nothing is reusable. This is the choice for the highest-sensitivity data and for media that cannot be reliably sanitized any other way.

The selection logic is straightforward. Media staying in your control and being reused internally: clear. Media leaving your control — resale, donation, return of a leased asset, warranty replacement: purge or destroy. Highest classification, or media that failed and cannot be written to: destroy.

Media type changes the answer

Magnetic hard drives respond to overwriting predictably and can be degaussed. Modern drive densities mean a single well-verified overwrite pass is generally considered sufficient for clear; the old multi-pass folklore comes from drive technology that no longer exists.

Solid state drives are the important exception. Wear levelling means the controller writes to different physical cells than the ones the operating system addressed, and over-provisioned capacity is invisible to the host entirely. An overwrite therefore does not reliably reach all the data, and degaussing does nothing to flash memory. The correct methods are the drive's built-in sanitize command or cryptographic erase — covered in more depth under SSD sanitization and crypto erase — or physical destruction.

Optical media is write-once in most cases and must be destroyed physically; shredding or disintegration rather than scratching. Mobile devices are almost always encrypted by default, so a factory reset that discards the key is effectively a cryptographic erase — provided encryption was genuinely enabled.

Paper still matters. Cross-cut or micro-cut shredding, not strip-cut, which has been reassembled in practice. Locked collection bins prevent material sitting in an unsecured container waiting for collection, which is the weak point in most paper programs — and secure disposal is one of the procedures a clean desk policy is supposed to make routine.

Verification and documentation

Sanitization that is not verified is an assumption. Sample the media afterwards and confirm the data is gone, and where a third party performs the work, require a certificate of destruction naming the serial numbers and the method used.

Maintain a chain of custody for media awaiting sanitization, because a stack of decommissioned drives in an unlocked room is a breach waiting to be discovered. Track each asset from removal through to destruction, and keep the records — regulations frequently require evidence of secure disposal, and data protection obligations such as the right to be forgotten only mean something if deletion is demonstrable.

Remember the media people forget: printer and copier hard drives, network appliances with configuration and cached credentials, backup tapes, and removable media in desk drawers. Each holds data and each leaves the building eventually.

Exam angles

Know clear, purge, and destroy and what each defeats. Recognize that deleting and quick formatting are not sanitization. Know that SSDs cannot be reliably sanitized by overwriting because of wear levelling and over-provisioning, and that cryptographic erase or the drive's sanitize command is the answer. Match degaussing to magnetic media only, cross-cut shredding to paper, and destruction to media leaving your control at high classification. Expect a certificate of destruction to appear as the evidence requirement.