How should drive sanitisation be verified before a dedicated server is returned?
Media sanitisation should follow an approved process matched to the information sensitivity, media technology and next owner. NIST SP 800-88 Revision 2 provides a framework for that programme; the chosen technique still needs applicable device and organisational guidance. Deleting files, reinstalling the OS or removing a partition does not by itself establish that the required sanitisation outcome has been achieved.
Before you start
- Authority to retire the data and media, confirmed retention requirements and an approved sanitisation process.
Instructions
1. Identify every relevant storage device
Create a verified inventory before any erasure is authorised. Include boot media, data drives and other storage that may contain the organisation’s information.
lsblk -d -o NAME,SIZE,MODEL,SERIAL,WWNThis read-only inventory helps identify devices; controllers may hide physical members. Reconcile it with the provider’s hardware record rather than relying on changing Linux device names.
2. Agree the method and responsible party
Select an approved clear, purge or destroy approach appropriate to the media and ownership arrangement. Cryptographic erase needs its own verified prerequisites; it is not automatically sufficient merely because encryption is available.
3. Verify and retain completion evidence
Record asset identity, the approved method, responsible operator, time, verification result and final disposition. Resolve failed or incomplete sanitisation before treating the media as cleared for return.
Check the result
- The evidence identifies the actual media and demonstrates that the approved sanitisation process completed and was accepted for its intended disposition.
Troubleshooting
- A tool reports success but drive identity is uncertain
- Reconcile the serial and hardware mapping before accepting the record.
- The device is failed or inaccessible
- Use the approved failed-media handling process; a software erasure command may not be possible.
- The provider owns the drives
- Confirm the contracted sanitisation and evidence process rather than assuming customer access to every physical device.
Official references
Use the documentation for your installed version when a flag, service name or platform feature differs.