Methods
Clear, Purge, Destroy
The U.S. National Institute of Standards and Technology (NIST) publishes the guideline most organisations follow for wiping storage: SP 800-88, revised as Revision 2 in September 2025. Here is what it says, in its own words where it matters, and what it means for an ordinary office or household.
CLEAR
"This method applies logical techniques to sanitize data in all user-addressable storage locations of an ISM for protection against simple, non-invasive data recovery techniques using the same interface that is available to the user."NIST SP 800-88r2, 3.1.1 (ISM = information storage media)
In practice: the device's own factory reset, or one full overwrite of a drive. NIST says manufacturer resets still count as Clear "as long as the device interface available to the user does not facilitate retrieval of the original data". Clear is fine for low-sensitivity data and for devices that stay with you.
PURGE
"Purge sanitization techniques apply physical or logical techniques that make the recovery of target data infeasible using state-of-the-art laboratory techniques but preserves the ISM in a potentially reusable state. When possible, the purge sanitization method should be used instead of the clear sanitization method."NIST SP 800-88r2, 3.1.2
In practice: the drive's own sanitize command (block erase, overwrite or cryptographic erase) run by the drive maker's tool or the computer's firmware, or a built-in cryptographic erase such as Apple's Erase All Content and Settings. For which command counts as Purge on which kind of drive, NIST points to the industry standard IEEE 2883.
DESTROY
"Destroy sanitization techniques render target data recovery infeasible using state-of-the-art laboratory techniques and results in the subsequent inability to use the ISM for the storage of data."NIST SP 800-88r2, 3.1.3
In practice: a destruction service that lists each serial number on its certificate. It is the only option for a drive that no longer works. NIST adds that "Pulverize and shred techniques for ISM should be avoided for anything but the lowest security categories of data"; its FAQ names incineration (smelting, melting) for higher categories, and high-powered approved degaussers for magnetic media.
Choosing a method
"The decision process is based on the confidentiality of the information rather than the type of media."NIST SP 800-88r2, 4.3
Ask how much harm the data could do and whether the device is leaving your hands. NIST lets an owner of moderate-sensitivity data accept Clear where no reliable Purge exists, "acknowledging that some data may be retrievable by someone with the time, knowledge, equipment, and skills to do so". It also names good reasons to prefer Purge over Destroy: lease returns, the environment, and reusing, selling or donating the device. The planner applies these points as four plain rules, shown with every result.
Cryptographic erase
When everything on a device has been encrypted from the start, destroying the keys makes the data unreadable in seconds. NIST counts this cryptographic erase as a Purge technique, under conditions its FAQ lists: no sensitive data was stored unencrypted before the keys were set up, the cipher is at least 128-bit strength, the keys themselves are destroyed, and federal agencies use FIPS 140-validated modules. Apple's deployment guide says erasing a supported Apple device "obliterates all the keys in effaceable storage", which makes user data cryptographically inaccessible.
Old habits that no longer help
- Seven-pass "DoD" wipes. NIST's FAQ: "Revision 2 clarifies that multi-pass overwriting is unnecessary." On flash drives the extra passes mostly wear the drive.
- Overwriting an SSD from the operating system. Spare cells and wear levelling mean a normal overwrite cannot reach every place data was stored (NIST 3.1.1). Use the drive's sanitize command instead.
- Drilling, bending or cutting. These "may only partly damage the ISM, leaving portions of it accessible using state-of-the-art laboratory techniques" (NIST 3.1.3).
- Degaussing as destruction. NIST's FAQ: degaussing "does not constitute a true destroy method", and it does nothing to flash storage.
- Quick format or "delete". The FTC's copier guide puts it plainly: deleting or reformatting does not remove the data.
Proof: verification, validation, certificate
NIST separates verification (checking that the erase finished without errors) from validation (deciding, given how sensitive the data was, that the result is good enough). Then: "a certificate of sanitization (see Appendix C) should be completed for each ISM that has been sanitized, per the organization's policies." The blank certificate and every ledger record carry all the Appendix C fields.
Quotes are from NIST SP 800-88r2 (September 2025) and NIST's FAQ for it (July 16, 2026), and from the Apple and FTC pages listed on Sources. This page explains them; it is not legal or compliance advice, and your organisation's own policy decides.