> For the complete documentation index, see [llms.txt](https://support.onlogic.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://support.onlogic.com/support-articles/security-guidelines-iec-62443-4-1/sg-4-secure-disposal-guidelines.md).

# SG-4: Secure Disposal Guidelines

## Overview

SG-4 guidelines for IPCs are primarily focused on the sanitization of storage media (SSDs and NVMe drives). The framework is based on NIST SP 800-88, which defines three levels of sanitization: Clear, Purge, and Destroy. The choice of method depends on the sensitivity of the data and whether the hardware will be reused, sold, or destroyed. Below is a detailed guide for its secure retirement to prevent the leakage of sensitive data

<table data-header-hidden><thead><tr><th width="191.25927734375"></th><th width="99.629638671875"></th><th width="136.7406005859375"></th><th width="132.3333740234375"></th><th width="156.148193359375"></th></tr></thead><tbody><tr><td>Sanitization Level</td><td>Best For...</td><td>Primary Methods</td><td>Top Software/Tools</td><td>Do NOT Use For</td></tr><tr><td>Clear - Logical overwrite of all user-addressable storage locations</td><td>Internal reuse</td><td>Logical Overwrite, Factory Reset</td><td>ShredOS, Active@ KillDisk, Eraser</td><td>SSDs with overprovisioning</td></tr><tr><td>Purge - Physical or logical techniques that make recovery infeasible</td><td>External disposal</td><td>Block Erase, Cryptographic Erase</td><td>NVMe Sanitize, ATA Secure Erase</td><td>Degaussing for SSDs</td></tr><tr><td>Destroy - Physical destruction rendering the media unusable and data irretrievable</td><td>High-risk / Failed drives</td><td>Shredding, Incineration, Melting</td><td>Industrial Shredders, Professional Vendors</td><td>Standard magnetic overwriting</td></tr></tbody></table>

<img src="/files/o43dTDAqZZZ8FPkQO1l7" alt="" height="387" width="745">

## Clear

This method is not appropriate for hard copy under any conditions but may be appropriate for ISM (information storage media). This method applies logical techniques to sanitize data in all user-addressable storage locations of an ISM for protection against simple, non-invasive data recovery techniques using the same interface that is available to the user host interface. These standard techniques generally do not affect the ISM's usability; it involves using software or hardware to overwrite an ISM's user-addressable storage and metadata with non-sensitive data via standard read/write commands. Historically, hard drives were erased using multiple overwrite passes (e.g., DoD 5220.22-M5) with various binary patterns. These methods are ineffective for certain ISM, such as SSDs with overprovisioning; more secure methods like purge or destroy should be utilized. Overwriting is unsuitable for non-rewriteable or inoperable ISM, as it cannot reach all sensitive data areas. ISM type and size further limit its effectiveness. Specifically, flash memory-based devices use spare cells and wear leveling, making it impossible to address all storage areas through standard read/write interfaces. Continuing use of magnetic ISM overwrite methods on newer media, like flash memory, risks unintentional data disclosure. The ISM may support dedicated sanitize commands that address all storage areas more effectively. Clear sanitization techniques vary for devices. Always consult the manufacturer’s documentation for the most effective proprietary tool for your specific device.

* Overwriting. Typically done through the standard read and write commands to the storage device, such as by rewriting with a new value (either random patterns or zeros’) or (if available) using a menu option to reset the device to the factory state (when &  where rewriting is not supported).
  * If compatible with your storage media device. Some devices may come with manufacturer tools, in those cases their tools are best to use for clear sanitization. They work by sending and executing secure erase commands directly to the drive’s firmware, removing the stress of overwriting manually.
    * Manufacturer resets without rewriting still qualify as clear sanitization, provided the standard user interface prevents original data retrieval.
  * Software tools are available ie:
  * ShredOS - open source and highly liked does multiple passes of overwriting
  * Active@ KillDisk - a popular sanitation tool for a wide variety of devices. It supports over 20 international data sanitizing standards
  * BitRaser - a certified tool capable of wiping both HDDs and SSDs beyond recovery. They also support standards like NIST
  * Eraser -  An advanced, open-source security tool for Windows designed to securely delete files, folders, or entire drives by overwriting them with complex patterns

## Purge

This method is not appropriate for hard copy under any conditions but may be appropriate for some ISM. Purge sanitization employs physical or logical methods to make data recovery infeasible against state of the art laboratory techniques while keeping the ISM potentially reusable. This method is preferred over clear sanitization whenever possible.

Logical purge techniques vary by ISM type; acceptable methods are overwrite, block erase, or cryptographic erase using dedicated, standardized device sanitize commands that bypass typical command abstractions, increasing the chance of keeping the device usable. Of the logical purge sanitization techniques, cryptographic erase is noteworthy in its ability to rapidly sanitize target data. However, the effective use of cryptographic erase depends on the pedigree of cryptographic capabilities and meeting certain pre-conditions.

For an ISM that takes the form of logical/virtual storage (e.g., cloud storage), cryptographic erase may be the only viable purge sanitization option. Typically, the underlying physical ISM is abstracted so that the data owner has no direct access to the physical ISM, and sanitizing them is not possible. Organizations should clearly understand their purge sanitization technique options and the effectiveness of the technique prior to storing sensitive data on such ISM.&#x20;

Physical purge sanitization techniques historically included degaussing for magnetic tapes, magnetic removable disks, and magnetic hard disk drives. Degaussing should not be used for non-magnetic ISM (e.g., flash storage, such as SSDs). The use of degaussing as a purge sanitization technique has become more complicated as ISM have evolved to use hybrids of magnetic and non-magnetic storage as well as variations of magnetic recording technologies with higher coercivity (i.e., magnetic force). As a result, many existing degaussers do not have sufficient force to effectively degauss such ISM. Additionally, degaussing can make some types of ISM unusable, potentially making them inoperable (if the servo tracks are damaged), but fail to sanitize the target data. At the time of this writing, degaussing is not considered an approved destroy sanitization technique, but IEEE 2883 and/or NSA/CSS Policy Manual 9-12 should be consulted for further clarification.

Other physical purge sanitization techniques can also exist. The above clear overwrite methods can be reused here as well.

* Overwriting. Typically done through the standard read and write commands to the storage device, such as by rewriting with a new value (either random patterns or zeros’) or (if available) using a menu option to reset the device to the factory state (when &  where rewriting is not supported).
  * If compatible with your storage media device. Some devices may come with manufacturer tools, in those cases their tools are best to use for clear sanitization. They work by sending and executing secure erase commands directly to the drive’s firmware, removing the stress of overwriting manually.
    * Manufacturer resets without rewriting still qualify as clear sanitization, provided the standard user interface prevents original data retrieval.
  * Software tools are available ie:
    * ShredOS - open source and highly liked does multiple passes of overwriting
    * Active@ KillDisk - a popular sanitation tool for a wide variety of devices. It supports over 20 international data sanitizing standards
    * BitRaser - a certified tool capable of wiping both HDDs and SSDs beyond recovery. They also support standards like NIST
    * Eraser -  An advanced, open-source security tool for Windows designed to securely delete files, folders, or entire drives by overwriting them with complex patterns
* Block Erase
  * A command-based sanitization technique used primarily on flash-based storage (SSDs) that instructs the drive controller to reset all storage blocks to an empty state. This bypasses file system abstraction and is highly effective for fast sanitization.
    * Example: Using an "ATA Secure Erase" command or a vendor-specific "NVMe Sanitize" command to trigger a block-level wipe of all NAND flash cells, effectively resetting all storage locations.
* Cryptographic Erase
  * A method that sanitizes data by deleting the internal cryptographic key (Data Encryption Key or DEK) used to encrypt the information on the drive. Once the key is destroyed, the data becomes impossible to decrypt, rendering it effectively erased.
    * Example: A Self-Encrypting Drive (SED) receives a "sanitize" command, which forces the drive to securely delete its internal DEK. This renders the data stored on the drive unreadable almost instantly, regardless of the drive's capacity.
* Degaussing
  * A physical sanitization technique that exposes magnetic storage media (such as hard disk drives and magnetic tapes) to a strong magnetic field, which disrupts the stored magnetic patterns and renders the data unrecoverable. Note: Degaussing should not be used for non-magnetic storage (e.g., flash storage like SSDs) and may be ineffective against modern high-coercivity magnetic media.
    * Example: Using an industrial-grade degausser to expose a magnetic hard drive to a high-intensity magnetic field, which effectively neutralizes the magnetic domains on the platters.

## Destroy

This method is appropriate for all hard copies and most ISM (not including logical or virtual storage). Sanitization techniques make target data recovery infeasible using ‘state of the art laboratory techniques and results in the inability to use the ISM for storage of the data. With the many different types of this technique the ISM is not “the ISM is not considered destroyed unless target data access or recovery is infeasible using state-of-the-art laboratory techniques”. This MAY be the only option when the ISM fails or is obsolete and clear and purge techniques cannot be applied effectively.

Bending, cutting, or other produces (ie. shooting or drilling) may only partly damage the ISM, leaving portions of it still accessible via “state-of-the-art laboratory techniques”. As the density of data and the hardness of the internal components materials increase on an ISM, certain techniques can become ineffective. Note: Pulverize and shred techniques for ISM should be avoided for anything other than the lowest security categories of data.

Below are some of the more common destruction methods for media:

* Disintegrate. Process that destroys the media by breaking, separating, or decomposing media into its constituent elements, parts, or small particles such that there is nothing or very little of it that is recognizable after the process.
  * For example,  dissolving with acid will disintegrate the product or at the very least destroy the outer layer and make content very difficult to impossible to recover.&#x20;
* Incinerate. Process that destroys the media by burning it to ash.
  * Cannot be done probably with household items, most ideal method:
    * Industrial Incinerator: Applies intense heat to completely oxidize the materials, melting platters, memory chips, and circuit boards into ash. They are equipped with high efficiency air pollution control devices to safely filter out the toxic emissions released during the process
  * Hire a professional: They collect the device and can provide you a certificate of destruction, they will handle it in an environmentally compliant way
* Melt. Process that destroys the media by liquefying it (i.e., loses intactness or solidness), generally through the application of extreme heat.
  * Examples can include Industrial Incinerator,:
    * Plasma Smelting: Industrial-scale plasma smelters melt crushed printed circuit boards (PCBs) so the plastics and resins burn off
    * Heat Gun: Small pieces of discarded tech plastic can be melted in a controlled manner using a heat gun.
* Pulverize. Process that destroys the media by reducing it to a fine powder or dust through crushing, grinding, or other mechanical means.
  * Industrial grinder: Tear and grind hard drives, solid-state drives (SSDs), and mobile phones into tiny pieces of chips and dust (destroy all internal chips)
  * Mechanical Crushing and Piercing: Uses heavy-duty steel pins to physically pierce, bend, and crush the media, preventing forensic recovery of sensitive data
  * Optical Disk Grinders: For CDs, DVDs, and Blu-rays, declassifying machines can be used to grind and abrade the data-bearing, metallic layer off the plastic disc, turning critical information into dust
* Shred. Process that destroys the media bTy cutting or tearing it into small particles
  * Examples can include Optical Disk Grinders, Distengrator, and Pulveize methods:
    * Industrial Hard Drive Shredders: Heavy-duty machines that shred hard drives, backup tapes, and smartphones into small metallic fragments
    * Multi-Media Shredders: Smaller, office-grade shredders cut solid-state drives (SSDs) and USBs into tiny cross-cut particles
    * Drive Crushers: Apply extreme hydraulic pressure to warp and fracture internal drive components (like platters in HDDs) so that they cannot be read or accessed