Data and Media Sanitization

The capabilities of Android devices are determined by device manufacturers and service providers. As such, the level of assurance provided by the factory data reset option may depend on architectural and implementation details of a particular device. Devices seeking to use a factory data reset to purge media should use the eMMC Secure Erase or Secure Trim command, or some other equivalent method (which may depend on the device’s storage media).

Some versions of Android support encryption, and may support Cryptographic Erase. Refer to the device manufacturer (or service provider, if applicable) to identify whether the device has a Purge capability that applies media-dependent sanitization techniques or Cryptographic Erase to ensure that data recovery is infeasible, and that the device does not simply remove the file pointers.

Proper initial configuration using guides such as the DISA STIGs helps
ensure that the level of data protection and sanitization assurance is as robust as possible. Following the Clear or (if applicable) Purge operation, manually navigate to multiple areas of the device (such as browser history, files, photos, etc.) to verify that no personal information has been retained on the device. When in doubt, check device manual or call tech support.

For both Clear and Purge, refer to the manufacturer for additional information on the proper sanitization procedure.

The capabilities of Windows Phone devices are determined by device manufacturers and service providers. As such, the level of assurance provided by the factory data reset option may depend on architectural and implementation details of a particular device. Devices seeking to use a factory data reset to purge media should use the eMMC Secure Erase or Secure Trim command, or some other equivalent method (which may depend on
the device’s storage media).

In some environments, Windows Phone devices may support encryption, and may support Cryptographic Erase. Refer to the device manufacturer (or service provider, if applicable) to identify whether the device has a Purge capability that applies media-dependent sanitization techniques or Cryptographic Erase to ensure that data recovery is infeasible, and that the device does not simply remove the file pointers.

Following the Clear/Purge operation, manually navigate to multiple areas of the device (such as browser history, files, photos, etc.) to verify that no personal information has been retained on the device. Before sanitizing your device, ensure that you back up your data to a safe location.

Refer to the manufacturer for proper sanitization procedure, and for details about implementation differences between device versions and OS versions. Proper initial configuration using guides such as the DISA STIGs helps ensure that the level of data protection and sanitization assurance is as robust as possible.

Following the Clear or (if applicable) Purge operation, manually navigate to multiple areas of the device (such as call history, browser history, files, photos, etc.) to verify that no personal information has been retained on the device.

For both Clear and (if applicable) Purge, refer to the manufacturer for proper sanitization procedure.

Four options are available:
1. Use one of the ATA Sanitize Device feature set commands, if supported, to perform a Sanitize operation. One or both of the following options may be available:

a. The overwrite EXT command. Apply one write pass of a fixed pattern across the media surface. Some examples of fixed patterns include all zeros or a pseudorandom pattern. A single write pass should suffice to Purge the media. 
Optionally: Instead of one write pass, use three total write passes of a
pseudorandom pattern, leveraging the invert option so that the second write pass is the inverted version of the pattern specified.
b. If the device supports encryption and the technical specifications described in this document have been satisfied, the Cryptographic Erase (also known as CRYPTO SCRAMBLE EXT) command. 
Optionally: After Cryptographic Erase is successfully applied to a device, use the overwrite command (if supported) to write one pass of zeros or a pseudorandom pattern across the media. If the overwrite command is not supported, the Secure Erase or the Clear procedure could alternatively be applied following Cryptographic Erase.
2. Use the ATA Security feature set’s SECURE ERASE UNIT command, if support, in Enhanced Erase mode. The ATA Sanitize Device feature set commands are preferred over the over the ATA Security feature set SECURITY ERASE UNIT command when supported by the ATA device.
3. Cryptographic Erase through the Trusted Computing Group (TCG) Opal Security Subsystem Class (SSC) or Enterprise SSC interface by issuing commands as necessary to cause all MEKs to be changed (if the requirements described in this document have been satisfied). Refer to the TCG and device manufacturers for more information.
Optionally: After Cryptographic Erase is successfully applied to a device, use the overwrite command (if supported) to write one pass of zeros or a pseudorandom pattern across the media. If the overwrite command is not supported, the Secure Erase or the Clear procedure could alternatively be applied following Cryptographic Erase.
4. Degauss in an organizationally approved automatic degausser or disassemble the hard disk drive and Purge the enclosed platters with an organizationally approved degaussing wand.

Verification must be performed for each technique within Clear and Purge as described in the Verify Methods subsection, except degaussing. The assurance provided by degaussing depends on selecting an effective degausser, applying it appropriately and periodically spot checking the results to ensure it is working as expected.
When using the three pass SCSI sanitize overwrite procedure with the invert (also known as complement) option, the verification process would simply search for the original pattern (which would have been written again during the third pass). While it is widely accepted that one pass of overwriting should be sufficient for Purging the data, the availability of a dedicated command that incorporates the ability to invert the data pattern allows an efficient and effective approach that mitigates any residual risk associated with variations in implementations of magnetic recording features across device manufacturers.
The storage device may support configuration capabilities that artificially restrict the ability to access portions of the media, such as “SCSI mode parameter block descriptor’s NUMBER OF LOGICAL BLOCKS field (accessible with the SCSI MODE SENSE and MODE SELECT commands”. Even when a dedicated sanitization command addresses these areas, their presence may affect the ability to reliably verify the effectiveness of the sanitization procedure if left in place. Any configuration options limiting the ability to access the entire addressable area of
the storage media should be reset prior to applying the sanitization technique.
When Cryptographic Erase is applied, verification must be performed prior to additional sanitization techniques (if applicable), such as a Clear or Purge technique applied following Cryptographic Erase, to ensure that the cryptographic operation completed successfully. A quick sampling verification as described in the Verify Methods subsection should also be performed after any additional techniques are applied following Cryptographic Erase.
Not all implementations of encryption are necessarily suitable for reliance upon Cryptographic Erase as a Purge mechanism. The decision regarding whether to use Cryptographic Erase depends upon verification of attributes previously identified in this guidance and in Appendix D.
This guidance applies to Legacy Magnetic media only, and it is critical to verify the media type prior to sanitization. Note that emerging media types, such as HAMR media or hybrid drives may not be easily identifiable by the label. Refer to the manufacturer for details about the media type in a storage device. 

Degaussing the media in a storage device typically renders the device unusable.

Verification must be performed for each technique within Clear and Purge as described in the Verify Methods subsection.
When Cryptographic Erase is applied, verification must be performed prior to additional sanitization techniques (if applicable), such as a Clear or Purge technique applied following Cryptographic Erase, to ensure that the cryptographic operation completed successfully. A quick sampling verification as described in the Verify Methods subsection should also be performed after any additional techniques are applied following Cryptographic Erase.

The storage device may support configuration capabilities that artificially restrict the ability to access portions of the media as defined in the ATA standard, such as a Host Protected Area (HPA), Device Configuration Overlay (DCO), or Accessible Max Address. Even when a dedicated sanitization command addresses these areas, their presence may affect the ability to reliably verify the effectiveness of the sanitization procedure if left in place. Any configuration options limiting the ability to access the entire addressable area of the storage media should be reset prior to applying the sanitization technique. Recovery data, such as an OEM-provided restoration image may have been stored in this manner, and sanitization may therefore impact the ability to recover the system unless reinstallation media is also available.
Not all implementations of encryption are necessarily suitable for reliance upon Cryptographic Erase as a Purge mechanism. The decision regarding whether to use Cryptographic Erase depends upon verification of attributes previously identified in this guidance and in Appendix D. 
Given the variability in implementation of the Enhanced Secure Erase feature, use of this command is not recommended without first referring the manufacturer to identify that the storage device’s model-specific implementation meets the needs of the organization.
Whereas ATA Secure Erase was a Purge mechanism for magnetic media, it is only a Clear mechanism for flash memory due to variability in implementation and the possibility that sensitive data may remain in areas such as spare cells that have been rotated out of use.
Degaussing must not be solely relied upon as a sanitization technique on flash memory-based storage devices or on hybrid devices that contain non-volatile flash memory storage media.
Degaussing may be used when non-volatile flash memory media is present if the flash memory components are sanitized using media-dependent techniques

Overwrite media by using organizationally approved and tested overwriting technologies/methods/tools.  The Clear procedure should consist of at least one pass of writes with a fixed data value, such as all zeros. Multiple passes or more complex values may alternatively be used.

Note: It is important to note that overwrite on flash-based media may significantly reduce the effective lifetime of the media and it may not sanitize the data in unmapped physical media (i.e., the old data may still remain on the media). 

Two options are available:

1. Apply the SCSI SANITIZE command, if supported.  One or both of the following options may  be available:

a. The BLOCK ERASE service action.  

b. If the device supports encryption, the CRYPTOGRAPHIC ERASE service action. Optionally:  After Cryptographic Erase is successfully applied to a device, use the block erase command (if supported) to block erase the media.  If the block erase command is not supported, the Clear procedure could alternatively be applied.

2. Cryptographic  Erase through the TCG Opal SSC or Enterprise SSC interface by issuing commands as necessary to cause all MEKs to be changed.  Refer to the TCG and vendors shipping TCG Opal or Enterprise storage devices for more information. Optionally:  After Cryptographic Erase is successfully applied to a device, use the block erase command (if supported) to block erase the media.  If the block erase command is not supported, the Clear procedure is an acceptable alternative.

Verification must be performed for each technique within Clear and Purge as described in the Verify Methods subsection.

The storage device may support configuration capabilities that artificially restrict the ability to access portions of the media, such as SCSI mode select.  Even when a dedicated sanitization command addresses these areas, their presence may affect the ability to reliably verify the effectiveness of the sanitization procedure if left in place.  Any configuration options limiting the ability to access the entire addressable area of the storage media should be reset prior to applying the sanitization technique.

When Cryptographic Erase is applied, verification must be performed prior to additional sanitization techniques (if applicable), such as a Clear or Purge technique applied following Cryptographic Erase, to ensure that the cryptographic operation completed successfully.  A quick sampling verification as described in the Verify Methods subsection should also be performed after any additional techniques are applied following Cryptographic Erase.

Not all implementations of encryption are necessarily suitable for reliance upon Cryptographic Erase as a Purge mechanism. The decision regarding whether to use Cryptographic Erase depends upon verification of attributes previously identified in this guidance and in Appendix D of NIST 800-88.  

Degaussing must not be performed as a sanitization technique on flash memory-based storage devices. 

Two options are available:

1. Apply the NVM Express Format command, if supported.  One or both of the following options may  be available:

a. The User Data Erase command.  

b. If the device supports encryption, the Cryptographic Erase command. Optionally:  After Cryptographic Erase is successfully applied to a device, use the User Data Erase command (if supported) to erase the media.  If the User Data Erase command is not supported, the Clear procedure could alternatively be applied.

2. Cryptographic Erase through the TCG Opal SSC or Enterprise SSC interface by issuing commands as necessary to cause all MEKs to be changed.  Refer to the TCG and vendors shipping TCG Opal or Enterprise storage devices for more information. Optionally:  After Cryptographic Erase is successfully applied to a device, use the User Data Erase command (if supported) to erase the media.  If the User Data Erase command is not supported, the Clear procedure is an acceptable alternative. 

Verification must be performed for each technique within Clear and Purge.  

When Cryptographic Erase is applied, verification must be performed prior to additional sanitization techniques (if applicable), such as a Clear or Purge technique applied following Cryptographic Erase, to ensure that the cryptographic operation completed successfully.  A quick sampling verification as described in the Verify Methods subsection should also be performed after any additional techniques are applied following Cryptographic Erase.

Not all implementations of encryption are necessarily suitable for reliance upon Cryptographic Erase as a Purge mechanism.  The decision regarding whether to use Cryptographic Erase depends upon verification of attributes previously identified in this guidance.  

Degaussing must not be performed as a sanitization technique on flash memory-based storage devices

While Embedded flash memory has traditionally not been specifically addressed in media sanitization guidelines, the increasing complexity of systems and associated use of flash memory has complementarily increased the likelihood that sensitive data may be present.  For example, remote management capabilities integrated into a modern motherboard may necessitate storing IP addresses, hostnames, usernames and passwords, certificates, or other data that may be considered sensitive.  As a result, for Clearing, it may be necessary to interact with multiple interfaces to fully reset the device state.  When this concept is applied to the example, this might include the BIOS/UEFI interface as well as the remote management interface.

As with other types of media, the choice of sanitization technique is based on environmentspecific considerations.  While the choice might be made to neither Clear nor Purge embedded flash memory, it is important to recognize and accept the potential risk and continue to reevaluate the risk as the environment changes.