Classification of data
The first step to methodical data destruction is classifying the type, and therefore the security level, of the data. This sets the level of sanitization required and the methods to use.
Organizations with limited internal guidelines can take guidance from a series of NIST publications, in particular SP 800-60 Vol 1 Rev 1. See also our data classification page.
When deciding which security level describes your information, think about its value and confidentiality, and the consequences of losing it. Your clients' names and home addresses may not seem "high security" to you, but they may be to your clients, employees or other stakeholders. Use this security level to decide how the storage media should be handled.
Clear
Software or hardware products overwrite user-addressable storage space with non-sensitive data, using the device's standard read and write commands. This should cover not only the logical location of files but all user-addressable locations, replacing target data with non-sensitive data.
Overwriting cannot be used on damaged or non-rewritable media, and may not reach every area where sensitive data is retained. Flash-based storage, for example, may contain spare cells and use wear levelling, so not every area can be addressed through the normal interface.
For devices other than dedicated storage, such as a basic mobile phone or office equipment, a manufacturer reset may be the only option. It still counts as Clear as long as the device interface does not allow the cleared data to be retrieved.
Purge
Purge methods include overwrite, block erase and Cryptographic Erase, using dedicated, standardized device sanitize commands that bypass the abstraction of normal read and write commands.
Destructive techniques also purge a device when applied to the right media: incineration, shredding, disintegrating, degaussing and pulverizing all make recovery infeasible with state-of-the-art laboratory techniques. Bending, cutting and some emergency procedures (such as shooting a hole through a drive) may only damage the media, leaving portions readable in a laboratory.
Degaussing purges legacy magnetic devices when the degausser's strength is matched to the media's coercivity. It should never be relied on alone for flash-based storage, or for magnetic storage that also holds non-volatile, non-magnetic storage. Because it makes many devices unusable, degaussing is often also a destruction technique.
Destroy
There are many destruction techniques. Some make target data impossible to retrieve through the device interface, but a device only counts as destroyed when retrieval is infeasible even with state-of-the-art laboratory techniques.
Destruction may be the only option when media has failed and Clear or Purge cannot be applied, or when verification of Clear or Purge fails for known or unknown reasons.
Verify
Verification is needed for techniques whose results are not visible to the naked eye, such as degaussing and software erasure.
- A degaussed hard drive shows no response at all when plugged into its native interface.
- An erased hard drive can be examined with a hex editor to confirm all data has been overwritten. This check is usually built into the erasure software.
