What Data Sanitization Is, and What the Standards Actually Require
Data sanitization is the process of rendering access to target data on a storage device infeasible for a given level of effort [1]. That phrase does a lot of work. It does not say the data is gone. It says recovering it is not worth the effort available to whoever might try, and the standard that governs your programme is what defines "available."
That distinction is the difference between a device you can resell and a device that becomes a breach notification.
Deleting is not sanitizing
When a file is deleted, most systems remove the pointer to the data rather than the data itself. A format behaves similarly. The bits stay on the medium until something overwrites them, which means a deleted file and a sanitized device are not remotely the same object, even though both look empty to the person holding the phone.
This is why sanitization is defined by outcome and verification rather than by action. Running a command is not evidence. Confirming that the command achieved a defined level of unrecoverability, and recording that confirmation, is evidence.
The three levels: Clear, Purge, Destroy
NIST SP 800-88 organises sanitization into three categories, each describing a different level of assurance.
Clear applies logical techniques to all user-addressable storage locations. A factory reset is the everyday example [1]. It defeats casual recovery through the device's normal interface, and it leaves the hardware fully reusable. It is also, notably, never appropriate for hard copy media under any conditions [1].
Purge goes further. It targets a state where recovery is infeasible using state-of-the-art laboratory techniques, while still preserving the media in a potentially reusable condition [1]. Acceptable purge techniques can include overwrite, block erase, and cryptographic erase using dedicated device sanitize commands [1]. Where both are possible, the standard says purge should be used instead of clear [1].
Destroy renders recovery infeasible and the media unusable afterward. It suits hard copy and most physical media, but it does not apply to logical or virtual storage [1].
For anyone processing devices for resale, purge is the operative category. Clear is often insufficient for regulated data, and destroy eliminates the resale value that justifies the programme in the first place.
If you want the full breakdown of what changed in each definition, we covered it in NIST 800-88 Rev. 2: Clear, Purge, Destroy.
Why flash storage broke the older methods
Read the Clear definition again and note the qualifier: user-addressable storage locations [1].
Modern flash storage keeps areas that the user-addressable interface cannot reach. Wear levelling moves data across physical cells to spread write cycles, and overprovisioned capacity sits outside the addressable range entirely. A logical overwrite pass writes to the addresses it can see. Cells holding earlier copies of the same data may simply not be among them.
The practical consequence is that a method inherited from the spinning-disk era can complete successfully, report success, and leave recoverable data behind. Nothing errors. The gap only appears under laboratory examination, or in an audit that asks how the result was verified.
This is also why sanitization guidance now points outward rather than prescribing techniques itself. Rev. 2 states that except for cryptographic erase, technology-specific sanitization techniques are out of scope, and directs readers to consult the latest version of standards such as IEEE 2883 [1]. IEEE 2883-2022 is the IEEE Standard for Sanitizing Storage [3].
That is a meaningful architectural change. The standard that tells you what assurance to achieve is no longer the standard that tells you how to achieve it on this particular controller.
What changed in September 2025
NIST SP 800-88 Rev. 1 was published in December 2014 and withdrawn on 26 September 2025, superseded by Rev. 2 [2].
If your data sanitization policy cites Rev. 1, it cites a withdrawn document. That is a finding waiting to happen, and it is a cheap one to fix. The remedy is a policy reference update, not a process rebuild, because the assurance categories survived the revision largely intact. What moved was the technique layer.
Ready to see how audit-grade erasure works across a mixed device fleet? Request a demo.
What auditors actually ask for
Auditors rarely ask whether you sanitize. They ask you to prove a specific device was sanitized, by a named method, and that somebody verified it.
Rev. 2 recommends completing a certificate of sanitization for each device, recording the method, the technique, the tool and its version, the verification performed, and a signature [1]. Per device. Not per batch, not per quarter.
That requirement is what separates a sanitization process from a sanitization programme. A process erases devices. A programme produces per-device evidence that survives someone else's scrutiny months later. We broke down the specific fields in what a certificate of data destruction must include.
The same evidence chain is what makes the wider disposition workflow defensible, which we cover in what IT asset disposition involves.
Building sanitization into device processing
At volume, the constraint is rarely knowing what the standard requires. It is producing per-device evidence for thousands of devices a month without slowing the line.
Phonecheck erasure produces a signed certificate of erasure and a Device History Report for every device processed, and those reports are recognised by major resale marketplaces [4]. The compliance artefact and the resale artefact are the same record, generated once, at the point the device is handled.
You can see the standards the platform aligns to on the standards page, or look at how the Device History Report presents per-device evidence. For teams routing mixed device types through different workflows, workflow automation handles the routing.
Request a demo to see the evidence trail on your own device mix.
Frequently asked questions
Is data sanitization the same as data erasure?
They overlap heavily and are often used interchangeably. Sanitization is the term the standards use, and it covers a broader range of outcomes including physical destruction. Erasure usually refers to the logical techniques that leave the device reusable.
Does a factory reset count as data sanitization?
A factory reset is the example NIST gives for Clear, the lowest of the three assurance levels [1]. It is a recognised sanitization category, but where both are achievable the standard says purge should be used instead of clear [1]. For regulated data, clear is generally not the right target.
Which standard should our policy cite?
NIST SP 800-88 Rev. 2 for the assurance framework, since Rev. 1 was withdrawn on 26 September 2025 [2]. For the technique layer, Rev. 2 directs readers to the latest version of standards such as IEEE 2883 [1].
Can overwriting sanitize an SSD?
Overwrite is listed among acceptable purge techniques when performed using dedicated device sanitize commands, and Rev. 2 directs readers to IEEE 2883 for technology-specific guidance [1]. The distinction that matters is between a logical overwrite of user-addressable locations and a command the storage controller executes across the full medium.
Do we need a certificate for every device?
Rev. 2 recommends a certificate of sanitization per device, recording method, technique, tool and version, verification, and signature [1].
Sources
- NIST SP 800-88 Rev. 2, Guidelines for Media Sanitization, NIST, September 2025.
- NIST SP 800-88 Rev. 1, Guidelines for Media Sanitization (December 2014; withdrawn 26 September 2025), NIST CSRC.
- IEEE 2883-2022, IEEE Standard for Sanitizing Storage, IEEE Standards Association, 2022.
- Phonecheck internal product marketing context, source of truth for product claims (updated 2026-07-02).