A format prepares a drive to store files. A secure erase makes the old files unrecoverable. For a business retiring laptops, servers or SSDs, that difference decides whether a resold or recycled device leaks customer records. A standard format is not a sanitization method. A secure erase, done with the drive’s own firmware command, can be one.
This guide explains what each action does, why SSDs change the answer, how NIST 800-88 sorts the options, and how to decide between erasing, reusing and destroying.
TL;DR
- A quick format rebuilds the file system and leaves the underlying data in place. Under NIST’s categories it is at best a basic Clear action, not protection against forensic recovery.
- Secure erase means a firmware-level command (ATA Secure Erase, NVMe Sanitize, or cryptographic erase) that the drive controller carries out itself. That is what reaches every cell on an SSD.
- If a device will be resold, reused or leased back, aim for Purge. If media has failed, or held highly sensitive data, Destroy is the final step.
- Whatever you choose, keep proof: tool logs, a separate validation check, serial numbers and a certificate.
Table of Contents
- What a format actually does
- What secure erase means
- Why SSDs change the answer
- Clear, Purge, Destroy: where each action lands
- How to choose: confidentiality and what happens next
- When erasing is not enough
- Proof matters as much as the method
- Our perspective
- Getting this done for a fleet
- Common mistakes to avoid
- FAQ
- Sources
What a format actually does
When you format a volume, the operating system writes a new, empty file system structure. Microsoft’s own guidance says formatting a volume destroys data on the partition and tells you to back up anything you want to keep. That warning is about your access to the data, not about whether someone else could read it.
The research behind this article describes a quick format as recreating the file system table while leaving the underlying data reachable by simple recovery utilities. NIST SP 800-88 places that kind of logical action in the lowest sanitization category, Clear, and does not treat it as protection against forensic tools.
There are two flavors worth separating:
- Quick format: rewrites the file system structures. Data blocks are untouched until something overwrites them.
- Full format: also writes across the volume on many systems. That is better than a quick format on a spinning disk, but it is still a logical operation run through the operating system. It does not reach areas the OS cannot address, and it does not give you a documented, verifiable result.
The industry has no shortage of loose vocabulary here. SNIA notes that terms such as wiping, deletion, erasure and secure deletion mean different things to different people: deletion may only remove a few file system pointers, and “secure deletion” may address only the copies currently accessible. When you write a disposal policy, name the method and the standard, not the verb.
What secure erase means
Secure erase is a family of commands the drive’s own controller executes. You are not asking the operating system to write over files. You are telling the drive to sanitize itself. The main variants are:
| Method | Where it applies | How it works |
|---|---|---|
| ATA Secure Erase / ATA Sanitize | SATA HDDs and SSDs | Controller-level erase command |
| NVMe Sanitize (Block Erase) | NVMe SSDs | Controller resets all NAND cells, including spare areas |
| Cryptographic erase | Self-encrypting drives | Destroys the encryption key so stored data is unreadable |
| Software overwrite | HDDs mostly | Writes patterns across addressable sectors |
One practical trap: ATA Secure Erase does not work on NVMe drives. NVMe SSDs need NVMe-specific commands, and NVMe Sanitize with Block Erase is described there as the most thorough option because it resets all NAND cells, including over-provisioned space. Using the wrong tool for the interface can leave you with a log that looks fine and a drive that is not clean.
Why SSDs change the answer
On a hard disk, overwriting every sector is a reasonable way to clear data, because logical addresses map predictably to physical locations. On an SSD, the controller decides where data physically lives. Wear leveling and spare capacity mean a software overwrite can never be sure it touched every cell that once held your data.
That is why firmware-level Purge commands such as NVMe Sanitize or ATA Sanitize are the preferred approach for modern SSDs. They instruct the controller to reset every NAND cell, and the same source says this takes seconds or minutes rather than hours. Cryptographic erase is also a valid Purge for self-encrypting drives that meet specific requirements, such as at least 128-bit encryption strength, and the source notes it can complete in under a second.
Two consequences for IT teams:
- Formatting an SSD tells you very little. Search results for this topic are full of forum threads asking whether formatting restores speed or whether a full format harms the drive. Those are performance questions. The security question is separate, and a format answers neither reliably.
- Encrypt-then-format is not the same as crypto erase. Encrypting a drive that already holds plaintext does not necessarily protect the old blocks. Cryptographic erase works when the data was encrypted from the start under a key the drive can destroy. For the engineering and audit detail, see our guide on cryptographic erase and the proof it needs.
Clear, Purge, Destroy: where each action lands
NIST SP 800-88 and IEEE 2883-2022 sort sanitization into three levels, as summarized in the NIST guidelines:
- Clear: logical techniques that protect against simple, non-invasive recovery.
- Purge: physical or logical techniques that make recovery infeasible even with state-of-the-art laboratory methods.
- Destroy: the media is rendered unrecoverable and can no longer be reused.
Mapped to your options:
| Action | Typical level | Safe for resale or reuse? |
|---|---|---|
| Delete files | Below Clear | No |
| Quick format | Clear at best | No, for anything sensitive |
| Full format or overwrite on an HDD | Clear | Low-risk reuse only |
| NVMe or ATA Sanitize, crypto erase | Purge | Yes, with verification |
| Shredding, disintegration, incineration | Destroy | Not applicable, media is gone |
We go deeper on picking between the three in Clear vs Purge vs Destroy, and on the standard itself in NIST data destruction: the rules that matter.
How to choose: confidentiality and what happens next
Experts quoted by SNIA stress that the right method depends on how sensitive the information is and what will happen to the media afterward, not just on the media type. Two questions get you most of the way.
Will the device be reused, resold or returned? Then Purge is the standard to meet. A quick format will not get you there. If you plan to sell equipment and want a payout, a clean Purge with a record is what makes a buyer and your auditor comfortable. If the equipment is moving between offices rather than leaving your control, an IT relocation checklist helps you track which drives travel intact and which must be sanitized first.
Has the media failed, or did it hold highly sensitive data? Then Destroy is the necessary final step. A dead drive will not respond to firmware commands, so you cannot prove it was purged. SNIA’s guidance says that for the most sensitive data, destruction is required even if other methods were tried first.
A quick decision path
- Does the drive respond to commands? If no, go to destruction.
- Will it leave your control as a working device? If yes, Purge and verify. If no, Purge or Destroy, depending on policy.
- Is the data regulated or classified? Follow the stricter rule your regulator or contract sets.
- Record the result for every serial number, whichever path you took.
When erasing is not enough
Some cases call for physical destruction regardless of what the software says:
- Failed or unresponsive drives that cannot accept a sanitize command.
- Media that held highly sensitive data under a contract or regulation that requires destruction.
- Drives you cannot confirm are self-encrypting, or devices where the firmware behavior is unknown.
Be careful with old assumptions about shredding. According to SNIA’s guidance, modern standards such as IEEE 2883-2022 and NIST 800-88 Rev. 2 recognize that particles as small as 2 mm can still contain recoverable data. Destruction is now mostly reserved for failed media, ideally with methods like incineration or melting, or with stricter particle-size requirements. Our write-up on SSD destruction methods compares purge-in-minutes with shred-to-particles, and the walkthrough on destroying hard drives safely covers the eco-compliance side.
Destruction is also a retention decision. If a device stored video or surveillance data, your CCTV data retention rules should say how long footage is kept before its media is sanitized or destroyed. Disposal should follow policy, not the other way around.
Proof matters as much as the method
An erase you cannot show happened is hard to defend in an audit. Build these into the process:
- Verification: confirm the sanitize command ran without errors, for example by reading the tool log.
- Validation: confirm the data is actually gone, for example with a spot check of the drive.
- Separation of duties: Purdue’s guidance notes that verification and validation are different steps, and in high-security or regulated environments they should be done by two different people to keep a secure chain of custody.
- Records: serial number, method, date, operator, result, and a certificate when a vendor performs the work.
State policies increasingly spell this out. Minnesota’s enterprise standard, for example, says that when media can be sanitized to NIST SP 800-88 before being repurposed, returned, donated or recycled, entities must use approved software and document the result. Check what applies to your own sector and state.
Manufacturers have built the commands into tooling too. Dell’s data wipe feature is a useful illustration: the BIOS only issues the command and the storage media manufacturer implements the actual wipe behavior. That is the point of secure erase. The drive does the work, and your job is to choose the right command and record the outcome. For a program-level view, see NIST 800-88 guidelines: build a program that leaves proof.
Our perspective
Most of the disposal problems we see are not exotic attacks. They are a pallet of laptops that were “wiped” by a quick format, or a closet of old drives nobody could vouch for. The method is rarely the hard part. The hard part is that nobody can show, serial number by serial number, what was done.
Our view is simple. Use secure erase when a device has a future and you can verify the result. Use destruction when it does not, or when the data demands it. Never let a format stand in for either. We offer both routes: on-site data destruction, which we can perform for 50+ hard drives at your location, and off-site processing at an EPA-certified facility registered with the California Department of Toxic Substances Control. Either way you receive receipts and certificates for your compliance file.
We also think good policy saves money. Equipment that is sanitized properly and documented can often be remarketed instead of scrapped, and we pay upfront for IT asset recovery. Security and value recovery are not in conflict. They depend on the same paperwork.
— Keith
Getting this done for a fleet
If you have a handful of drives and the right tools, an in-house Purge with a validation check can work. Once you are dealing with dozens of devices, mixed interfaces, failed drives and an audit deadline, outsourcing usually costs less than the staff hours and the risk.
We handle hard drive destruction, equipment destruction, computer recycling and IT asset recovery for businesses and organizations, with flexible scheduling and free quotes. Tell us what you have, what it held and whether any of it can be resold, and we will recommend the route. Request a quote on our site.
Common mistakes to avoid
- Treating a factory reset as erasure. A reset on a phone or laptop may reinstall the operating system without sanitizing the storage. Confirm what it does on each model.
- Using HDD-era overwrite tools on SSDs. Multi-pass overwriting was designed for spinning disks and cannot promise to reach every flash cell.
- Using the wrong command for the interface. SATA and NVMe drives need different commands.
- Forgetting secondary media. Printers, copiers, network gear and removable drives can hold data too.
- Skipping the record. If you cannot show what was done, you cannot show it was done right.
FAQ
Is formatting a drive enough before I sell or recycle it?
No, not for business data. A quick format leaves the underlying data in place, and even a full format is only a logical operation. For anything that will leave your control, use a firmware-level Purge such as NVMe Sanitize or cryptographic erase, then verify it. If the drive is dead or the data is highly sensitive, destroy it.
What is a secure erase?
A secure erase is a command built into the drive that makes its controller erase the stored data itself. Examples are ATA Secure Erase, ATA or NVMe Sanitize, and cryptographic erase on self-encrypting drives. Because the controller can reach areas the operating system cannot, it is the right class of tool for SSDs.
Does secure erase wear out an SSD?
A single sanitize before disposal is not a practical concern for a drive that is leaving service. Block-erase style sanitize commands act at the NAND level and finish quickly. If you plan to keep using the drive for years, ask the manufacturer for its guidance on its sanitize tooling.
Can I secure erase a drive that has stopped working?
Usually not. A failed drive may not accept firmware commands, so you cannot confirm a Purge happened. That is the case where physical destruction is the right final step, with a certificate that lists the serial numbers.
Sources
- NIST SP 800-88, Guidelines for Media Sanitization
- DriveWipe: NVMe Secure Erase guide
- SNIA: Media Sanitization
- SNIA: Media Sanitization, solid-state storage group
- Purdue: Data Sanitization for Apple Devices
- Microsoft Support: Disk Management in Windows
- Dell: Data Wipe supported storage media sanitize actions