NIST SP 800-88 Rev. 1 — Purge

NIST SP 800-88 Rev. 1 divided media sanitization into three categories:

• Clear
• Purge
• Destroy

The central distinction was the level of protection against data recovery.

Applies logical techniques to user-addressable storage locations and is intended to protect against simple, non-invasive recovery techniques.

Applies physical or logical techniques intended to make Target Data recovery infeasible using state-of-the-art laboratory techniques.

Makes Target Data recovery infeasible while also rendering the media unusable for future data storage.

Therefore:

Purge≠ordinary disk wiping

It represents a higher recovery-resistance objective than Clear while potentially preserving the storage device for reuse.

The objective of Purge is not simply to make files disappear.

It is to address the underlying storage media in a manner intended to prevent recovery of the Target Data even when more advanced laboratory techniques are considered.

The appropriate method depends on factors including:

• Information Confidentiality
• Storage Technology
• Device Architecture
• Sanitization Capability
• Intended Reuse Or Disposal
• Organizational Risk Tolerance
• Availability Of Appropriate Sanitization Technology

NIST Rev. 1 emphasized that sanitization decisions should be based on the confidentiality categorization of the information and the characteristics of the media.

The correct selection depends on the organization's information sensitivity, media technology and disposition requirements.

Rev. 1 did not define Purge as one universal multi-pass overwrite algorithm.

Instead, NIST provided technology-specific recommendations and recognized several categories of sanitization techniques.

Examples included:

• Cryptographic Erase
• Block Erase
• ATA Sanitize
• SCSI Sanitize
• Dedicated device sanitization commands
• Degaussing for applicable magnetic media
• Other validated physical or logical techniques appropriate to the media

The Rev. 1 Appendix A tables provided minimum recommendations for specific media types, while also stating that other methods could satisfy the intent of Clear, Purge or Destroy when appropriately verified by the organization.

Cryptographic Erase (CE) was one of the important Purge techniques discussed in NIST SP 800-88 Rev. 1.

Where data is encrypted and the necessary conditions are satisfied, sanitizing the cryptographic keys can render the encrypted Target Data inaccessible.

However, cryptographic erase is not simply equivalent to deleting a key file.

An organization must consider:

• Whether The Target Data Was Actually Encrypted
• Encryption Architecture
• Cryptographic Key Management
• Whether All Relevant Keys Are Addressed
• Device Implementation
• External Versus Internally Managed Keys
• Whether The Implementation Provides Sufficient Assurance

For this reason, CE should be selected based on the actual device and encryption architecture rather than treated as a universal method.

For supported ATA storage devices, device-level sanitization commands can provide an alternative to conventional host-based overwriting.

The important distinction is that the command is handled by the storage device's own firmware/controller rather than simply writing data through the operating system's normal filesystem interface.

This can be particularly relevant when the device has internal storage-management mechanisms that are not visible to the host.

DSP's device assessment can help identify available device information and capabilities before the sanitization operation is selected.

SCSI Sanitize

SCSI-based enterprise storage can provide device-level sanitization capabilities through the SCSI SANITIZE command family.

This is particularly relevant to environments containing:

• SAS HDDs
• SAS SSDs
• Enterprise Storage
• Servers
• Data-Center Storage Systems

Where supported and appropriate, device-level sanitization can address storage through mechanisms implemented within the storage device.

The actual command capability depends on the specific device and its implementation.

Block Erase is another technology-specific technique discussed in the Rev. 1 guidance for applicable storage technologies.

Rather than performing conventional host-level overwriting of every logical block, a device-supported erase operation can instruct the storage technology to erase storage blocks through its native capabilities.

The applicability and assurance of such a technique depend on the device architecture and implementation.

Degaussing is a physical sanitization technique applicable to certain magnetic storage media.

A sufficiently strong magnetic field can disrupt the magnetic representation of stored information.

However, degaussing is not a universal storage sanitization technique.

It is not applicable to many modern non-magnetic technologies such as:

• SSDs
• NVMe SSDs
• USB Flash Storage
• SD Cards
• microSD Cards
• CFexpress
• Other Solid-State Flash Media

Degaussing can also render magnetic storage unusable, meaning the operational outcome must be considered when the organization intends to reuse the media.

A critical principle behind NIST SP 800-88 Rev. 1 Purge is that different storage technologies cannot automatically be sanitized using the same technique.

HDD

Magnetic media can potentially use:

• Device-Level Sanitization
• Overwrite Where Applicable
• Degaussing
• Other Validated Physical Techniques

SSD

Flash storage introduces:

• Flash Translation Layers
• Wear Leveling
• Spare Cells
• Over-Provisioning
• Garbage Collection
• Controller-Managed Mapping

Consequently, a conventional overwrite may not provide the same assurance as a technology-specific sanitization mechanism.

NVMe storage adds a controller and command architecture specifically designed for modern high-performance solid-state storage.

The appropriate sanitization technique should therefore consider the actual device capabilities rather than assuming an HDD-style overwrite is sufficient.

NIST Rev. 1 specifically recognized the challenges associated with flash-based media.

A logical overwrite may not necessarily address:

• Previously Used Physical Flash Cells
• Spare Areas
• Remapped Blocks
• Over-Provisioned Regions
• Controller-Managed Locations

This is one reason Purge is fundamentally different from simply executing a conventional disk wipe.

For flash storage organizations should evaluate device-supported sanitization techniques and the assurance available from the device implementation.

A common misconception is that NIST Purge means repeatedly overwriting a disk with a particular number of passes.

It does not.

A Purge operation could use an appropriate physical or logical technique depending on the storage technology.

This is also why methodologies such as:

• Gutmann
• Schneier
• DoD 5220.22-M

should not automatically be described as equivalent to NIST Rev. 1 Purge.

They are separate sanitization methodologies or historical wiping profiles.

Data Sanitization Pro provides a dedicated NIST SP 800-88 Rev. 1 Purge method through its DSP Sanitization Engine.

The software-controlled workflow is designed to distinguish the selected Purge methodology from generic disk wiping.

1. 01Identify Device
2. 02Assess Storage Technology
3. 03Select NIST SP 800-88 Rev. 1 Purge
4. 04Select Applicable Purge Technique
5. 05DSP Sanitization Engine
6. 06Execute Sanitization
7. 07Verify Result
8. 08Validate Outcome
9. 09Document Operation
10. 10Audit-Ready Certificate

DSP's sanitization workflow can work with multiple storage technologies supported by the platform, including:

• SATA HDD
• SATA SSD
• SAS HDD
• SAS SSD
• NVMe
• U.2
• M.2
• mSATA
• Pata/ide
• USB Storage
• Pen Drives
• SD Cards
• microSD Cards
• CompactFlash
• CFexpress
• RAID Storage
• DAS
• NAS
• SAN
• Server Storage

The selected sanitization approach should correspond to the actual storage technology and available sanitization capability.

Executing a sanitization command is not the end of the process.

A professional data erasure workflow should also determine whether the operation completed as intended.

DSP can record relevant verification information such as:

• Sanitization Status
• Device Response
• Command/process Result
• Completion Status
• Errors
• Exceptions
• Verification Result
• Process Timestamps
• Device Identification

Where a device reports errors or cannot reliably complete the selected operation, the organization should be able to identify that condition rather than treating the device as successfully sanitized.

These concepts should not be treated as identical.

Storage defects are especially important when performing sanitization.

Potential conditions include:

• Logical Bad Sectors
• Physical Media Errors
• Uncorrectable Sectors
• Read Failures
• Remapped Sectors
• Device Communication Errors

If a storage device cannot reliably address or process relevant storage areas, a conventional software sanitization operation may not provide the intended assurance.

DSP can record relevant storage-health and error information as part of the sanitization workflow.

For high-risk cases, the organization may determine that another sanitization technique or physical destruction is appropriate.

DSP can collect relevant storage-health information before and during the sanitization workflow.

Depending on device support, this may include:

• SMART Health
• Temperature
• Power-On Hours
• Firmware
• Model
• Serial Number
• Capacity
• Error Information
• Performance-Related Information
• Sector Condition

This creates additional operational context around the sanitization result.

Purge is particularly relevant when an organization wants to sanitize sensitive storage while potentially preserving the physical device for continued use.

Typical applications include:

• Enterprise Hardware Reuse
• Data-Center Decommissioning
• ITAD
• Refurbishment
• Secure Resale
• Hardware Transfer
• Government Asset Disposition
• Corporate Equipment Retirement
• Storage-Device Reuse

The organization can select a sanitization method based on the confidentiality of the information and the intended disposition of the asset.

Enterprise environments may need to process large numbers of storage devices while maintaining consistent sanitization records.

DSP can support controlled workflows for:

• Multiple HDDs
• Multiple SSDs
• NVMe Devices
• SAS Storage
• USB Media
• Removable Media
• Server Storage

Operational information can be recorded for each sanitization job.

This provides a repeatable process for enterprise IT and ITAD teams.

DSP can support offline sanitization workflows for environments where storage devices must be processed without relying on public internet connectivity.

This can be useful for:

• Government Environments
• Restricted Facilities
• High-Security Operations
• Air-Gapped Systems
• Enterprise Data Centers
• Controlled ITAD Facilities

The sanitization operation can be performed within the organization's controlled environment, with reports generated as part of the local workflow.

NIST SP 800-88 Rev. 1 included a sample Certificate of Sanitization in Appendix G.

DSP provides its own audit-ready sanitization certificate documenting the operation performed by the software.

A certificate can include:

The certificate documents the actual sanitization operation performed by Data Sanitization Pro.

It does not mean:

• NIST Certified DSP;
• NIST Approved DSP;
• NIST Issued The Certificate;
• The Storage Device Received An External NIST Certification.

The certificate is an audit record generated by DSP describing the selected method, execution, device information and verification results.

These methodologies should not be treated as interchangeable.

The number of overwrite passes alone does not determine whether an operation satisfies the Rev. 1 Purge objective.

The Gutmann Method is a historical 35-pass wiping methodology.

NIST Rev. 1 Purge is a media sanitization category with an objective of making recovery infeasible using state-of-the-art laboratory techniques.

Therefore:

Gutmann 35-pass≠NIST Rev. 1 Purge

A specific wiping methodology may be appropriate for a particular organizational requirement, but it should not automatically be relabeled as NIST Purge.

NIST SP 800-88 Rev. 2 was published in September 2025 and superseded Rev. 1. NIST states that Rev. 2 shifts the focus toward establishing and maintaining an enterprise or agency media sanitization program and, except for Cryptographic Erase, replaces detailed sanitization technique/tool descriptions with recommendations to follow IEEE 2883, NSA specifications or an organizationally approved standard.

For new sanitization programs organizations should evaluate the current Rev. 2 guidance and applicable current technology-specific standards.

Although Rev. 1 is withdrawn organizations may still have:

• Legacy SOPs
• Existing ITAD Contracts
• Customer Specifications
• Procurement Requirements
• Historical Audit Procedures
• Archived Compliance Documentation
• Existing Software Profiles
• Internal Sanitization Procedures

A dedicated Rev. 1 Purge implementation can therefore be useful when an organization specifically needs to execute and document the historical methodology.

For new policies, the organization should assess the current NIST SP 800-88 Rev. 2 framework and applicable technology-specific standards.

The DSP Sanitization Engine separates individual sanitization methodologies rather than treating every operation as a generic disk wipe.

For NIST SP 800-88 Rev. 1 Purge:

1. 01Select Method
2. 02Identify Device
3. 03Assess Storage
4. 04Select Applicable Purge Technique
5. 05Execute
6. 06Verify
7. 07Validate
8. 08Document
9. 09Certify

This provides a method-specific workflow for organizations maintaining Rev. 1 sanitization requirements.

DSP provides dedicated implementations for supported sanitization methodologies within one data erasure platform.

Each method can have its own:

The certificate identifies the method actually executed rather than applying a generic "secure wipe" label.

• 01DSP-DPDP India
• 02NIST SP 800-88 Rev. 1 Clear
• 03NIST SP 800-88 Rev. 1 Purge
• 04NIST SP 800-88 Rev. 2 Clear
• 05NIST SP 800-88 Rev. 2 Purge
• 06IEEE 2883-2022
• 07ISO/IEC 27040:2024
• 08Random Overwrite
• 09DoD 5220.22-M
• 10DoD 5220.22-M ECE
• 11NSA/CSS Policy Manual 9-12
• 12HMG IS5 Baseline
• 13HMG IS5 Enhanced
• 14CSEC ITSG-06
• 15BSI-GSE
• 16BSI VSITR
• 17Gutmann Method
• 18Schneier Algorithm
• 19Pfitzner Method
• 20AFSSI-5020
• 21AR 380-19
• 22GOST R 50739-95
• 23NZISM
• 24NAVSO P-5239-26
• 25RCMP TSSIT OPS-II