Deleting files and emptying the recycle bin or reformatting a drive is not sanitizing a data carrier. That only deletes references, which makes files invisible to the operating system. The data is still there, and easily recoverable. It is like tearing the table of contents out of a book. More needs to be done and that is why you need special software.

Data erasure or wiping solutions originated from the need to sanitize magnetic data carriers, such as hard drives. More recently, flash memory, SSD, and mobile phones were added. Today, data erasure via software covers a complete range:  from a micro level (erasing one or more files or folders), to a macro level, like erasing complete storage bays in datacenters, logical units in SAN, or data from virtual machines.

The security levels “clear” and “purge”, defined by NIST can be achieved by using the right software on data storage devices for which it has been developed, tested, and certified. Usage should be embedded in a secure data sanitization process.

The first step is identifying all different data carriers, knowing the technical specifications, and the category of data stored on it. For that, Data Carrier Accounting is a helpful solution.

Sanitizing different storage devices demands different erasure software solutions. The storage technology of  an SSD is completely different from an HDD. Just overwriting a SSD has no sense. And, even within the SSD product group there are differences in wiping software should used.

The erasure software needs to identify and address all remapped or bad sectors, different layers etc. It should include a verification system that erasure has been properly executed. The software must produce tamper-proof erasure reports.

Using certified software is recommended, however it is not the holy grail: you need to be sure to use the right software version for the type of data carrier that is was certified for.

Physical destruction of the data carrier is necessary if the data erasure software has not met the expected results. Combining data erasure software with another sanitization technology can significantly increase security.