Disk Sanitization

It's a wise precaution to remove sensitive data from computer disks before the disks are either transferred from one area to another or discarded. The process is referred to as disk sanitizing, cleaning, purging, or wiping. The method you choose to sanitize a disk should depend on the security requirements of your organization.

Removing a file actually only removes the pointer to the file. Common utilities can often recover deleted files, so the data may still be recoverable. Three techniques available for disk sanitization are:

• overwriting
• degaussing
• destruction

Overwriting a disk by using the format command is usually enough for most purposes, because it greatly reduces the chance that any data can be recovered from the disk. However, any data that remains can potentially be accessed by someone with enough expertise, determination, or money. To ensure that no one could ever recover data from a disk, you need to degauss or destroy it or keep it in a secure location until the disk is needed again.

Special Publication 800-88, "Guidelines for Media Sanitization" (PDF)
This guide from the National Institute of Standards and Technology (NIST) is intended to assist organizations and system owners in making practical sanitization decisions based on the level of sensitivity of their information. It does not specifically address all known types of media, however, the described draft sanitization decision process can be applied universally to all forms of media and categorizations of information.

Destroying Data the DOD Way: Military Standards Help Ensure Compliance for Electronic Data Security by Angie Singer Keating, Journal of AHIMA, July – August 2005
One of the most efficient and effective ways to sanitize or physically destroy computer hard drives is to follow the stringent standards established by the US Department of Defense (DOD). This article compares digital sanitation and physical destruction and helps you determine which method is best for your organization.

Secure Removal of Protected Health Information whitepaper by Steve Hardwick, Infraworks, April 29, 2003

Ultimate Data Destruction: Software Tools by Patrick Norton, David Prager, and Roman Loyola, TechTV, February 20, 2003
If you don't want to physically destroy the hard drive, there are several software tools you can use to wipe out your data. They do a lot better job that a simple reformat.

"Sanitization of Information Technology Equipment and Electronic Media" Policy from the KY Governor’s Office of Technology

"Remembrance of Data Passed: A Study of Disk Sanitization Practices"