Data Sanitization (Bereinigung von Datenträgern)

Deleting, formatting, overwriting, shredding: when IT hardware is decommissioned, many terms circulate for the same goal. Experts summarize them under data sanitization. This means any method that makes data on a data carrier permanently inaccessible. This glossary entry explains the three levels, assigns the common methods to data carriers and shows how to recognize reliable proof.

What does data sanitization mean?

The English word "sanitize" literally means "to make germ-free". Applied to data carriers, it means: after the procedure, no usable data remains. What matters here is not whether files have disappeared in the operating system, but whether the data can still be read with software, laboratory equipment or by removing individual memory chips.

In German, "Data Sanitization" is not a fixed legal term. Common terms are "sicheres Löschen" (secure erasure), "Datenträgerbereinigung" or "Datenvernichtung". Be careful with the word "Datenbereinigung": it usually means tidying up customer data in a CRM system and has nothing to do with erasing data carriers.

The three levels: Clear, Purge and Destroy

The US guideline NIST SP 800-88 has shaped the division into three levels. Since Revision 2 of September 2025, NIST refers for the specific methods for each medium to the standard IEEE 2883, which calls the third level "Destruct".

Level	Protection against	Typical methods	Device usable afterwards?
Clear	Recovery with common software via the normal interfaces	One pass Overwriting over all addressable areas, reset to factory settings on suitable devices	Yes
Purge	Also laboratory attacks with special tools	Firmware commands such as Sanitize or Secure Erase, Crypto Erase, for magnetic media degaussing	Usually yes, no after degaussing
Destroy	Any known recovery	Shredding, crushing, disintegrating, melting, incinerating	No

For physical destruction, the DIN 66399 standard applies in Germany. It defines material classes and security levels, for example H-5 for hard drives. More on this in the guide DIN 66399: protection classes and security levels.

Which method for which data carrier?

Every storage type behaves differently. What works on a magnetic hard drive can leave data behind on an SSD.

Data carrier	Special feature	Suitable sanitization
HDD (magnetic hard drive)	Hidden areas such as HPA and DCO, reallocated sectors	Overwriting including hidden areas, ATA Secure Erase; destruction if defective
SSD and NVMe	Wear leveling and spare blocks cannot be addressed directly from the outside	Firmware commands (Sanitize, NVMe Format), Crypto Erase, if necessary combined with overwriting
Smartphone and tablet	Permanently installed flash memory, device encryption, locks	Specialized erasure software, removal of account and MDM locks
USB stick, memory card	Firmware often undocumented, erase commands missing	Usually physical destruction
Storage systems (SAN, NAS)	Data distributed across many drives, logical units (LUNs)	Erasure per drive or per LUN, if all drives are removed as above

Which method suits your hard drives and SSDs is described in our guide Securely erasing hard drives and SSDs.

Verification and proof

Every sanitization includes a check. In the Erasure verification software reads back samples or the entire data carrier and checks whether only the expected pattern remains. The result goes into a report. A reliable Erasure certificate contains at least:

• manufacturer, model and serial number of the data carrier,
• the method or standard applied,
• start, duration and result of the erasure including verification,
• notes on errors, such as unreadable sectors,
• a signature that makes subsequent changes detectable.

For physical destruction, a certificate of destruction takes the place of the erasure certificate, ideally also with serial numbers.

Limits and typical mistakes

• Formatting instead of sanitizing: A Quick format only deletes the table of contents. The data itself remains.
• HDD methods on SSDs: Multiple overwriting does not reliably reach all memory cells on SSDs.
• Hidden areas overlooked: Host Protected Area and Device Configuration Overlay hide memory from the operating system.
• Defective data carriers: If a drive cannot be addressed completely, secure erasure is not possible. Then only destruction remains.
• Missing assignment: Certificates without a serial number cannot later be assigned to a device.

Even Degaussing has limits: it works only on magnetic media and renders hard drives unusable. For SSDs and flash memory, it is ineffective.

Example: mixed inventory from an office

A simplified example shows how differently a single order turns out. A company hands over 40 notebooks with SSD, 10 older PCs with HDD, 5 smartphones and a box of USB sticks.

1. The 40 SSDs are sanitized with firmware-based commands and then checked. 39 pass the check.
2. The 10 HDDs are overwritten completely, including hidden areas. One drive reports unreadable sectors.
3. The smartphones are erased with specialized software after account locks have been removed.
4. The USB sticks, the faulty SSD and the HDD with read errors are physically destroyed.
5. The company receives an erasure or destruction certificate with serial number for each device.

The example shows: data sanitization is not a single method but a decision for each data carrier.

Data sanitization at Second IT

Second IT erases HDDs, SSDs, servers and mobile devices using Blancco software and is a Blancco ITAD Gold Partner. Hidden areas such as HPA and DCO as well as reallocated sectors are also detected and erased. Every device receives a digitally signed erasure certificate. The report states, among other things, the erasure duration, the erasure algorithm and the number of overwrite passes. Data carriers that cannot be erased are destroyed in-house under video surveillance in accordance with DIN 66399 (up to security level H-5 and E-5) and documented with a certificate of destruction. More on certified data deletion. Why erased devices retain their value can be read in the article Data erasure: security and hardware values.

Frequently asked questions about data sanitization

What is the difference between deleting and data sanitization?

With normal deletion, the operating system removes only the reference to a file. Data sanitization makes the data itself inaccessible, depending on the level even against laboratory attacks. It also includes verification and proof.

Which level do I need for company devices?

That depends on the protection requirement of the data and on whether the devices leave the company. For devices that are resold, at least Purge is usual. For defective or unverifiable data carriers, destruction remains.

Is multiple overwriting more secure than a single pass?

For current hard drives, one complete pass followed by verification is considered sufficient for Clear. Multiple passes come from older standards. On SSDs, even frequent overwriting does not help reliably; there, firmware commands or Crypto Erase are the method of choice.

Does a data carrier have to be destroyed after sanitization?

No. After Clear or Purge with a successful check, a data carrier can be reused. This conserves resources and preserves the value of the hardware. Only what cannot be erased securely, or where your requirements demand it, is destroyed.

Is a quick format enough as data sanitization?

No. A quick format deletes only the table of contents; the data itself remains and can often be recovered. Data sanitization, by contrast, requires a method that makes data permanently inaccessible, plus a check and proof for each data carrier.