Clear
Logical sanitization that protects against simple, non invasive recovery.
- Use When
- The Drive Stays Inside Your Organization
- Typical Work
- Staff Reassignment, Internal Reuse, Re-Imaging
Data Erasure Standards
Data Erasure Standards & Secure Data Wiping Methods
What NIST 800-88, IEEE 2883, DoD 5220.22-M, HMG IS5 and the other standards actually do, when to use each one, and how to choose the right method to erase HDD, SSD and NVMe drives permanently.
- Erasure Standards
- 25+
- Verification Required
- 13
- Countries Of Origin
- 7
- Passes Per Method
- 1 to 35
Every Standard In Data Sanitization Pro
The same methods, in the same order, as the software's method list. Pass counts are what the engine writes. Each is a way to permanent data erasure, checked and certified.
- 01IndiaDSP-DPDP IndiaAdvanced, fast and audit ready sanitization for modern storage. Sanitize the data, verify the result, handle exceptions and document everything.Read The Standard
- 02IndiaNTLB - No Traces Left BehindThe DSP-DPDP India engine, finished with zeroes on every sector and a full read back. Nothing of the wipe is left on the drive.Read The Standard
- 03United StatesNIST SP 800-88 Rev. 1 ClearOne overwrite pass across every user addressable block. The NIST baseline for media that stays inside your organization.Read The Standard
- 04United StatesNIST SP 800-88 Rev. 1 PurgeThree random passes and a verification read, for media leaving your organization's control.Read The Standard
- 05United StatesNIST SP 800-88 Rev. 2 ClearThe current NIST revision's single pass Clear, for media that stays within your organization.Read The Standard
- 06United StatesNIST SP 800-88 Rev. 2 PurgeThe current NIST revision's Purge profile: three random passes with verification, for media leaving your control.Read The Standard
- 07InternationalIEEE 2883-2022The modern international standard for sanitizing storage, with verification required on every run.Read The Standard
- 08InternationalISO/IEC 27040:2024The international storage security standard's sanitization profile: one random pass, verification required.Read The Standard
- 09No formal standardRandom OverwriteA single pass of cryptographically random data. Fast, and enough for any drive that reports its writes honestly.Read The Standard
- 10United StatesDoD 5220.22-MZeros, ones, then random data. The best known name in data wiping and still written into many contracts.Read The Standard
- 11United StatesDoD 5220.22-M ECEThe extended seven pass DoD sequence for policies that require ECE by name.Read The Standard
- 12United StatesNSA/CSS Policy Manual 9-12Two random passes and a final pass of zeros, following the NSA/CSS storage device manual's overwrite profile.Read The Standard
- 13United KingdomHMG IS5 BaselineOne pass of zeros with a mandatory verification read. The UK government baseline.Read The Standard
- 14United KingdomHMG IS5 EnhancedZeros, ones and random data, all verified. The higher assurance UK government level.Read The Standard
- 15CanadaCSEC ITSG-06Random data, its exact complement, then random again, with verification required.Read The Standard
- 16GermanyBSI-GSESix alternating passes of zeros and ones followed by a random pass, with verification.Read The Standard
- 17GermanyBSI VSITRThe German federal seven pass routine: alternating zeros and ones, ending on 0xAA, with verification.Read The Standard
- 18Legacy researchGutmann MethodThirty five patterns written for 1990s drive encodings. Kept for policies that still name it.Read The Standard
- 19Legacy researchSchneier AlgorithmOnes, zeros, then five random passes, with verification required.Read The Standard
- 20Legacy researchPfitzner MethodThirty three random passes. Very slow and no stronger than one verified pass on modern media.Read The Standard
- 21United StatesAFSSI-5020The US Air Force sequence: zeros, ones, then random data, with verification required.Read The Standard
- 22United StatesAR 380-19The US Army sequence: random data, then 0x55, then 0xAA, with verification required.Read The Standard
- 23RussiaGOST R 50739-95The Russian national standard: a random pass followed by a pass of zeros.Read The Standard
- 24New ZealandNZISMThe New Zealand government manual's overwrite profile: zeros, ones, then random data.Read The Standard
- 25United StatesNAVSO P-5239-26The US Navy sequence: a fixed character, a second pattern, then random data, with verification required.Read The Standard
- 26CanadaRCMP TSSIT OPS-IIThe Canadian police seven pass routine: alternating zeros and ones, a final random pass, verification required.Read The Standard
The Basics
What Are Data Erasure Standards?
A data erasure standard defines how information is removed from a storage device so it cannot be recovered. Different standards were written for different technologies, security needs and regulations.
Data Sanitization Pro includes 25+ methods so you can apply a policy based approach instead of forcing one method onto every device.
Which method has the most passes?
Which method is right for this drive, this data and where the drive goes next?
Clear, Purge And Destroy
NIST SP 800-88 is the most widely referenced framework for media sanitization. It sorts every method into three levels by where the media goes next.
Purge
Stronger sanitization that makes recovery infeasible even with laboratory techniques.
- Use When
- The Drive Leaves Your Control
- Typical Work
- ITAD, Resale, Lease Returns, Server Decommissioning
Destroy
Physical destruction so the media can never be used again.
- Use When
- A Drive Cannot Be Sanitized Or Fails Verification
- Typical Work
- Failed Drives, Damaged Media, Policy Mandated Destruction
Data Sanitization Pro includes Clear and Purge profiles for both NIST SP 800-88 Rev. 1 and the current Rev. 2.
Why The Drive Type Decides The Method
Treating every storage device the same way is the most common mistake in data wiping.
Hard Disk Drives
Data sits on magnetic platters, so overwriting every sector is a reliable way to sanitize.
- NIST 800-88 Rev. 2
- IEEE 2883-2022
- DoD 5220.22-M where a policy names it
- HMG IS5 for UK contracts
SATA SSDs
Wear levelling, over provisioning and retired blocks mean overwriting logical addresses may not reach every flash cell.
- Prefer The Drive's Sanitize, Secure Erase Or Crypto Erase
- Follow With Verification
- DSP-DPDP India uses secure erase where supported
- NTLB ends with zeroes on every sector and leaves nothing on the drive
NVMe Drives
NVMe needs an approach built around the drive's own capabilities.
- Use NVMe Sanitize Or Crypto Erase Where Supported
- Verify The Result
- IEEE 2883 covers NVMe in scope
More Passes, More Time
More Passes Do Not Mean More Security
Multi pass algorithms were written for magnetic drives of the 1990s. On modern drives the right technique depends on the storage technology and your policy, not on the number of passes.
A 35 pass method takes about 35 times as long as a single verified pass and gives no practical security gain. The software keeps the legacy methods because some policies still require them by name.
Proof, Not Promises
Secure Erasure Requires Verification
Running an erase is only half the job. A professional workflow proves that the operation completed on the right device.
13 of the 26 standards make verification part of the procedure. On those, the software keeps it switched on and it cannot be disabled.
- Read back verification
- Integrity checks
- Method verification
- Device identification
- Serial number reconciliation
- Erasure status
- Completion information
- Audit records
How To Choose The Right Data Erasure Standard
No single method is correct for every organization. Answer these six questions first.
- 01
What type of storage are you erasing?
HDD, SATA SSD, NVMe, USB media or memory cards can each need a different approach.
- 02
Is the device staying inside your organization?
If it stays under your control, a Clear level method may be enough.
- 03
Is it being sold, reused or returned?
If it leaves your control, choose Purge or an equivalent method.
- 04
Does a customer or regulator name a standard?
If a contract names NIST, DoD, HMG IS5, IEEE or another standard, use that one.
- 05
Can the drive sanitize itself?
Supported SSD, NVMe and self encrypting drives can use device level sanitize or crypto erase.
- 06
What if the drive fails?
A drive that cannot be sanitized or fails verification must not be marked as successful.
Which Data Erasure Standard Should You Use?
| Situation | Recommended Direction |
|---|---|
| Media Stays Inside The Organization | NIST SP 800-88 Clear or an equivalent |
| Media Leaves Organizational Control | NIST SP 800-88 Purge or an equivalent |
| SSD Or NVMe | Device Level Sanitize Or Crypto Erase, Then Verification |
| Personal Data Under India's DPDP Act | DSP-DPDP India |
| Customer Names A Standard | Use The Named Standard |
| Legacy Policy Requires DoD | DoD 5220.22-M profile |
| UK Policy | HMG IS5 where it applies |
| Drive Cannot Be Sanitized | Flag It For Physical Destruction |
The right method is always media type plus organizational policy plus contract or regulation plus final disposition.
Audit Evidence
Certificates That Tie The Erasure To The Device
A standard is only useful if you can show what happened to each asset. Every certificate records:
- Device serial number
- Device identification
- Capacity
- Erasure standard used
- Verification result
- Start and finish time
- Operator information
- System information
- Audit metadata
A Standards Based Workflow For Every Asset
Before a device is reused, resold, refurbished, returned or recycled, the same six steps apply.
- 1Identify
- 2Select method
- 3Erase
- 4Verify
- 5Reconcile
- 6Certify
When Software Is Not Enough
When To Use Physical Destruction
Software erasure is not always the right final step. Record the exception instead of reporting a false success.
Destruction Services- The drive cannot complete the required sanitization
- It fails verification
- A hardware fault prevents reliable erasure
- It cannot support a suitable method
- Your policy requires physical destruction
Questions About Data Erasure Standards
What is the best data erasure standard?
There is no single best standard. NIST SP 800-88 Rev. 2 with IEEE 2883 is the current reference for modern storage, but the right method depends on the drive, your policy and where the drive goes next.
Is NIST 800-88 better than DoD 5220.22-M?
They serve different purposes. NIST 800-88 is written around modern storage technology. DoD 5220.22-M is a legacy multi pass overwrite that some contracts still name.
Is Gutmann 35 pass wiping more secure?
No. It was designed for 1990s drive encodings. On a modern drive it takes 35 times longer without a security benefit.
How many passes does a hard drive need?
One verified pass is enough under modern guidance. Legacy standards specify more, and you should run them when a policy requires them.
Can I use the same method for SSD and HDD?
Do not assume so. SSD and NVMe controllers hide spare cells from overwriting, so the drive's own sanitize or crypto erase, followed by verification, is often the better route.
What is the difference between Clear and Purge?
Clear suits media that stays in your organization. Purge is for media leaving your control and protects against laboratory recovery.
What happens if a drive fails verification?
It is not marked as sanitized. The report records the failure and the drive can be erased again or physically destroyed.
Not Sure Which Standard You Need?
Tell us what you are erasing, how many devices you have and where they go next. We will suggest an erasure profile.