How Each Erasure Method Works

When you delete a file, nothing is removed from the drive. The drive only crosses the file's name out of its index, a bit like tearing a card out of a library catalogue while the book stays on the shelf.

The data stays exactly where it was until something writes over it. That is why recovery software works, and why a second-hand drive can still hand over its previous owner's files.

Real erasure means putting new content into every storage location, or making the old content permanently unreadable. And then proving that it happened.

Wipora Erase offers seven methods. Two pairs share the same procedure, so there are five distinct ways a drive can be erased.

NIST Clear and IEEE Clear are the same method, and so are NIST Purge and IEEE Purge. The current NIST guideline points to the IEEE standard for the techniques, so the two names describe identical work.

Think of a drive as a warehouse.

Clear empties and refills every shelf you can walk up to. Afterwards, anyone who plugs the drive in, with any software including professional recovery tools, finds nothing of the original data.

Purge also clears the shelves behind locked doors. A drive keeps space you cannot reach by ordinary means: spare areas it swapped in when a shelf wore out, and on solid-state drives, a reserve the drive manages privately. Ordinary writing can never touch those areas. Only the drive itself can.

Clear protects against anyone with software. Purge is designed to make recovery infeasible even with laboratory techniques.

A drive being resold or donated needs a Clear. A drive that held financial, medical, legal or government data should be purged.

1. Is the drive really answering?

We ask the drive how big it is, from three independent sources, and compare the answers. A drive with a bad cable, a failing enclosure or too little power will often report something impossible, a few hundred bytes instead of a terabyte. A drive in that state cannot be erased meaningfully, and sending it commands can leave it locked.

If the size is not believable, we stop before writing anything and ask the operator to check the connection. We would rather report a problem than print a certificate for an erasure that never happened.

2. Unlock the hidden areas

Drives can be set up to hide part of their capacity. Manufacturers do this to reserve space, and so do some system builders. A hidden area is invisible to the computer, so it would be invisible to the erasure too.

We look for every kind of hidden area the drive supports, unlock each one, and record the result of each check, not just the fact that we tried. An area still hidden at this point would be an area the certificate wrongly claims was erased.

3. Erase, then prove it

The erasure itself depends on the method, and is described below. Verification follows every method, and has its own section further down.

In one line: everything you can reach by normal means is overwritten.

1. If the drive has a fast built-in way to clear itself, we use it. NVMe drives can clear all user data on request, and SAS drives can reformat themselves.
2. Otherwise we write zeros to every storage location on the drive, from the first to the last.
3. We read back 20,002 locations spread across the whole drive and confirm every one of them is empty.
4. The certificate is issued.

Step two is the important one. It works on every drive ever made, over every kind of connection, and it is a fully conforming Clear under the standard. That is why a Clear almost never fails.

When a Clear can fail

• The drive is write-protected.
• The drive reports an impossible size, usually a bad cable or enclosure.
• The drive is locked with a password.
• The drive disconnects part-way through and does not come back.

A note about SSDs

An SSD keeps a private reserve of spare storage, known as over-provisioning, that no normal write can reach. A Clear fills every location that can be reached, which is exactly what a Clear promises, so it is a valid Clear. The certificate says so plainly: every addressable location was overwritten, but the drive keeps reserve blocks that no host write can reach, and those may still hold earlier data. They cannot be read through the normal interface. If that leftover is not acceptable for your data, use Purge.

In one line: the drive erases itself, including the parts you cannot reach.

We try the strongest technique the drive actually supports and work downwards:

1. Destroy the encryption key. Almost every drive made in the last ten years encrypts everything it stores, automatically, whether anyone asked it to or not. The key lives inside the drive. Destroy that key and every byte becomes permanent noise, including the hidden areas. This takes seconds, whatever the size of the drive.
2. Erase the storage cells directly. Where there is no key, we ask the drive to wipe its storage cells electrically. This also reaches the hidden areas.
3. Let the drive overwrite itself internally. Used on spinning hard disks only. We skip it on SSDs, because repeatedly overwriting flash memory wears it out for no benefit when the first technique has already done a better job.
4. The drive's built-in secure erase command, as the last resort.

We never quietly substitute something weaker than what you asked for.

When Purge is not available

Purge depends on the drive obeying a command, so it cannot be done from outside the drive.

If Purge is out of reach, the software tells you before the wipe starts rather than two hours later, and tells you what to do about it, for example connecting the drive to a direct SATA port.

In one line: zeros, once, everywhere.

Zeros are written to every storage location from start to finish, a spread of locations is read back to confirm they are empty, and the certificate is issued. It is the same work as the overwrite stage of a Clear, offered on its own because many customers ask for it by name.

In one line: the whole drive is written several times, with different content on each pass.

Every pass has to reach every single location. A pass that covers only part of the drive fails the whole job: a three-pass overwrite that managed two and a half passes is not a three-pass overwrite. A 3-pass run takes about three times as long as a single pass, and a 7-pass run about seven times as long. On a large hard disk, a 7-pass run can take most of a day.

An honest word about the DoD methods

The US Department of Defense stopped accepting overwriting as a sanitization method in 2007, and the regulation that replaced it has no overwrite specification at all. Current guidance is clear that on any drive made this century, a single properly verified pass is as effective as seven. The extra passes take hours and add no protection.

We include the DoD patterns because customers and contracts still ask for them by name. For compliance, use Clear or Purge.

Whenever the software has to write across a drive, three things matter.

Speed. Data goes out in large blocks, so the drive works at full speed rather than being fed a trickle.

Worn spots. Older drives have areas that refuse new data. Instead of abandoning the whole job, the software narrows in on the problem area, retries it, writes everything around it and carries on. It does not hide the problem, though. The exact number of unwritable spots goes on the certificate, those spots are read back to find out whether they still hold readable data, and if even one location could not be written, the erasure is not reported as successful.

Disconnections. Adapters sometimes drop off in the middle of a job and reappear a moment later, often under a different name as far as the computer is concerned. The software waits, recognises the drive again by its own serial number, and resumes from exactly where it stopped. Work already done is not thrown away.

An erasure that nobody checked is a claim, not a result.

After a Clear, Zero Pass or DoD run: sampling

The software reads back 20,002 locations spread across the drive. The drive is divided into 10,000 equal sections, two locations are checked inside each section, and the very first and very last locations are checked as well. About 82 MB is read back in total.

The locations are worked out from the drive's own size, so an auditor can repeat exactly the same check on the same drive and look at exactly the same places. That makes the result evidence rather than a spot check. If any sampled location still holds data, the erasure is marked as failed.

After a DoD run the last pass is random, so the drive is supposed to be full of non-zero content. There, the check looks for any recognisable data that survived, instead of looking for zeros.

After a Purge: it depends on what the drive did

If the encryption key was destroyed or the cells were erased electrically, the drive now holds unpredictable content, and reading it back proves nothing on its own. So before the erase, the software places 512 distinctive markers across the drive, each one recording where it was written. If every marker is gone afterwards, the data that was there has gone with them.

If the drive overwrote itself, the software reads back the entire drive from beginning to end. Not a sample: every location.

When verification cannot be done

Occasionally a drive cannot be read immediately after it has been erased. Some drives legitimately end up in that state, and the standard allows for it. When that happens the result is reported as inconclusive, neither passed nor failed, and the certificate says exactly what was and was not confirmed.

If every available technique for the method you chose fails, the software does not swap in a weaker one and call the job done. The erasure is reported as failed, together with the next step the standard calls for:

• A drive that fails a Clear needs a Purge.
• A drive that fails a Purge needs physical destruction.

A Wipora Erase certificate states what was actually achieved. That is the whole value of holding one.