Data sanitisation guide When hardware contains storage devices, data sanitisation is the process of permanently destroying all data before the device changes hands. This guide covers every method supported on Bluestar, who it is for, and step-by-step instructions for each one.
The current industry standard
The current industry standard is NIST 800-88 Clear, which means a single verified overwrite pass. This is what the vast majority of enterprise IT departments use today for routine decommissions.
DoD 5220.22-M (3 or 7 pass) is still widely recognised and accepted by auditors, but the US Department of Defense itself stopped using it years ago and moved to NIST 800-88. Many organisations still specify it in legacy policies simply because the name is familiar.
Gutmann (35 pass) was designed in 1996 for drives that no longer exist. No serious IT organisation uses it today. It takes many hours and provides no meaningful security advantage over a single pass on any drive made in the last 20 years.
All Computers Printers Network Mobile Storage Infrastructure Components Peripherals
Servers WIPE REQUIRED RESET REQUIRED ?
Servers typically contain drives in RAID arrays and have out-of-band management interfaces (iDRAC, iLO) that store admin credentials and network configuration.
Workstations and desktop PCs WIPE REQUIRED
Standard desktop computers. Use any of the supported wipe methods depending on the operating system.
Multifunction printers and copiers WIPE REQUIRED RESET REQUIRED
Office MFDs with scanning or fax capability almost always contain an internal hard drive storing every document scanned, printed, faxed, or copied. Most IT teams are unaware of this. Do not transfer before wiping.
Firewalls and UTM appliances RESET REQUIRED
Firewalls store VPN credentials, firewall rules, network topology, admin passwords, and authentication certificates. A factory reset is required. Physical drive wiping via ShredOS does not apply to dedicated appliances.
Routers RESET REQUIRED
Routers store routing tables, BGP and OSPF credentials, VPN configs, SNMP community strings, and admin passwords.
Managed switches RESET REQUIRED
Managed switches store VLAN configs, port security settings, MAC address tables, 802.1X settings, and admin credentials.
Wireless access points RESET REQUIRED
Access points store Wi-Fi credentials, admin passwords, RADIUS server details, 802.1X configs, and captive portal settings.
NAS and storage arrays WIPE REQUIRED RESET REQUIRED
NAS devices contain one or more drives with org data, plus stored credentials in the NAS operating system. Both the drives and the NAS firmware configuration must be wiped.
Tape drives and media DESTROY OR DEGAUSS
Backup tapes contain complete copies of org data. Tapes must be degaussed or physically destroyed. They cannot be reliably overwritten by software.
Smartphones and tablets WIPE REQUIRED
Mobile devices store emails, contacts, app data, authentication tokens, and corporate credentials. The built-in factory reset function is sufficient.
UPS units MINIMAL ACTION
UPS units without network cards contain no sensitive data. Units with network management cards store SNMP credentials, email alert settings, and admin passwords.
PDUs and KVM switches MINIMAL ACTION
Managed PDUs may store admin credentials and SNMP settings. Unmanaged PDUs and all KVM switches contain no data worth clearing.
RAM modules MINIMAL ACTION
RAM is volatile memory. It loses all data the instant power is removed. There is no sensitive data risk from passing on RAM modules. No sanitisation is required, despite RAM being listed here alongside storage devices.
Graphics cards MINIMAL ACTION
Graphics cards contain VRAM, which holds frame buffer and texture data while the GPU is running. Like system RAM, VRAM is volatile and clears completely when power is removed. No sanitisation is required.
Network interface cards MINIMAL ACTION
Network interface cards store a MAC address in firmware, which is a hardware identifier, not organisational data. NICs contain no stored credentials, network configurations, or user data.
CPUs MINIMAL ACTION
CPUs are processing units with no persistent storage. They do not retain data after power is removed. No sanitisation is required.
Power supply units MINIMAL ACTION
Power supply units are purely electrical components. They contain no storage, no firmware that holds configuration data, and no memory of any kind.
Keyboards MINIMAL ACTION
Standard keyboards store no data. A common misconception is that keyboards retain typed content, but they do not. The only edge cases are hardware keyloggers, which are separate devices inserted between the keyboard and the computer, not part of the keyboard itself.
Mice MINIMAL ACTION
Mice store no sensitive data. Wireless mice store a pairing identifier in their USB receiver, but this contains no user or organisational data. Gaming mice with onboard memory store DPI profiles and macros, not credentials.
Monitors MINIMAL ACTION
Monitors contain no persistent storage and present no data security risk. Built-in USB hubs and KVM features on enterprise monitors are pass-through only and store nothing.
Docking stations MINIMAL ACTION
Docking stations are pass-through devices that route video, USB, and network traffic. They contain no persistent storage of user or organisational data.
Cables and adapters MINIMAL ACTION
Cables and adapters contain no electronics capable of storing data. They are entirely safe to pass on without any action.
Laptop chargers and power bricks MINIMAL ACTION
Laptop chargers and power bricks are electrical components only. They contain no storage, no firmware holding configuration data, and no memory of any kind. No action is required before passing them on.
Hard disk drives (HDD) WIPE REQUIRED
Hard disk drives store data on magnetic platters. Deleted files are not removed until overwritten. A full multi-pass overwrite using ShredOS is required before transfer. A single zero-fill pass meets NIST 800-88 Clear and is sufficient for most organisations.
Solid state drives (SSD) WIPE REQUIRED
SSDs store data in flash memory cells. Standard multi-pass overwrite methods are unreliable on SSDs due to wear levelling, which may leave data in cells the operating system cannot directly address. ATA Secure Erase or the manufacturer secure erase tool is required.
NVMe drives (M.2 / PCIe) WIPE REQUIRED
NVMe drives use the same flash memory technology as SATA SSDs but connect via PCIe for higher speeds. The same wear levelling concerns apply. ATA Secure Erase does not work on NVMe drives. Use NVMe Sanitize or Format NVM instead.
External hard drives WIPE REQUIRED
External hard drives are standard HDDs or SSDs in an enclosure. They often contain personal or organisational data from backups, file transfers, and direct use. The same wipe requirements apply as for internal drives.
USB flash drives WIPE REQUIRED
USB flash drives use NAND flash memory with wear levelling, making standard overwrite methods unreliable. ATA Secure Erase is generally not available on flash drives. For drives containing sensitive data, physical destruction is the most reliable option.
SD cards and memory cards DESTROY OR DEGAUSS
SD cards and memory cards use flash memory with no reliable secure erase capability available to end users. Standard formatting does not remove data. Physical destruction is the recommended approach for any card that held organisational data.
Wipe methods reference
ShredOS, BitLocker, Apple Erase, Blancco, and physical destruction. Step-by-step instructions for each method.