Degaussing, shredding, cryptographic erase, and overwriting are the main ways to sanitize storage media, and the right one depends on the media, not the policy. Applying one method everywhere produces two failure modes: media that was never actually sanitized, and hardware destroyed when a cheaper method would have preserved its value.
Media type is the deciding variable. A technique that reliably sanitizes a magnetic disk can leave a solid state drive fully readable, and the difference is not marginal.
How Does Degaussing Work?
Degaussing applies a magnetic field strong enough to randomize the domains on magnetic media, destroying both the data and the servo tracks the drive needs to operate. It is fast, it processes drives in seconds, and it renders the drive permanently inoperable as a side effect.
It works on magnetic media only. Hard disk drives and magnetic tape are in scope; solid state drives, hybrid drives, and any flash-based media are not, because there is nothing magnetic to disturb. A degausser run against a stack of SSDs does nothing at all, and the operator gets no feedback to that effect.
Field strength has to match the media. Modern high-coercivity drives require correspondingly strong fields, and a degausser rated for older media may leave newer drives partially readable. Equipment on the NSA evaluated products list has been tested against specific media types, and matching the device to the drives is not optional.
The practical weakness is verification. A degaussed drive cannot be powered on to confirm the data is gone, because degaussing destroys the servo information. Confidence rests on the equipment being correct for the media and correctly operated, which is why degaussing is usually paired with physical destruction when the data is sensitive.
How Does Physical Destruction Sanitize Media?
Shredding, disintegration, and crushing reduce media to fragments. It is the method that requires the least reasoning about how the storage technology works, which is its main advantage.
Particle size is the specification that matters, and it differs sharply by media. Fragments adequate for a hard disk platter can be far too large for flash, where a single intact memory package may hold recoverable data. Guidance for solid state media calls for substantially smaller particles, and a shredder configured for spinning disks does not meet it.
Crushing and punching deform a drive enough to prevent normal operation without reducing it to particles. This defeats casual recovery and does not reliably defeat a laboratory attempt, which makes it appropriate for lower sensitivity data and not for the highest.
Physical destruction eliminates resale value entirely. For equipment that would otherwise have been worth recovering, that is a real cost, and it is the reason destruction should not be the default for every device — the value forgone shows up directly in what a disposition program returns.
When Is Cryptographic Erase Enough?
Cryptographic erase applies where the media encrypted everything it stored. Self-encrypting drives hold data encrypted with a key held on the device; destroying that key renders the ciphertext unreadable without touching the data itself.
It is nearly instantaneous, it works regardless of capacity, and it leaves the drive fully functional and resaleable. For large-capacity modern drives, where overwriting every cell takes many hours, the time difference is substantial.
The conditions are strict. The drive must have been encrypting from first use — enabling encryption on a drive that already holds plaintext does not retroactively protect what was written before. The implementation must be trustworthy, which is why validation against a recognized scheme such as the NIST Cryptographic Module Validation Program matters. And the key destruction must be complete, including any escrowed or duplicate copies held elsewhere, which is an organizational question rather than a device one.
Under NIST SP 800-88, cryptographic erase is recognized as a purge technique where these conditions hold. Where they cannot be demonstrated, it is not.
Overwriting
Overwriting writes patterns across the addressable space. On magnetic media it is well understood and effective, and a single pass is sufficient on any drive manufactured in the last two decades — the multi-pass patterns still cited in policies date from media densities that no longer exist.
On flash it is unreliable for reasons inherent to the technology. Wear leveling distributes writes across physical cells that the host cannot address directly, over-provisioned capacity is invisible to the operating system, and reallocated bad blocks may retain data. An overwrite that reports success can leave data in cells it never reached.
Manufacturer sanitize commands are the correct instrument for flash. They instruct the device to erase all cells including the ones the host cannot see, and they are implemented at the firmware level. Where a device supports them and the implementation is trustworthy, they achieve purge; where it does not, destruction is the fallback.
The advantage of overwriting is that it is verifiable. The drive still works, and a sample read confirms what is there.
Which Sanitization Method Should You Choose?
The decision has two inputs: what the media is, and where the device is going. Software methods such as overwriting, sanitize commands, and crypto erase are performed by a licensed contractor or your IT team.
For magnetic drives being resold or redeployed, overwriting or a sanitize command preserves the asset. For magnetic drives being retired, degaussing followed by destruction is thorough and the hardware value is already gone.
For solid state media being resold, cryptographic erase where the drive supports it, or a firmware sanitize command otherwise. For solid state being retired, destruction to a particle size specified for flash.
Where the volume or the assurance requirement exceeds what can be done in house, certified destruction and recycling supplies the equipment and the audited paperwork. For any media whose type, encryption status, or firmware behavior cannot be established, destruction is the defensible answer. Uncertainty about the technology is not a basis for a purge claim.
Sensitivity sets the bar for how much assurance is needed. Regulated data, and anything under a legal obligation such as a retention or legal hold requirement, justifies the more conservative method and the documentation to prove it was used. Whatever the choice, it has to end in a certificate that names the method and the serials — without that, the method is a claim rather than a record.