How to wipe a machine so the certificate means something.

Most people have never done this deliberately, and the advice online is a decade out of date. This walks through what the words mean, how to work out the right method for the machine in front of you, and how to do it on each operating system.

First, the three words everyone uses loosely.

NIST SP 800-88 — the document nearly every policy points at — sorts sanitisation into three levels. They are not degrees of thoroughness so much as answers to a different question: who might try to recover this, and with what?

The trap is that a method that achieves Purge on one kind of drive achieves nothing on another. That is the whole of the next section.

Work out what you are holding.

Four questions, in this order. Simpletag already knows the answers for any machine that has been checking in — they are on the asset's record — but here is how to find them by hand.

Get-PhysicalDisk | Format-List
  FriendlyName,MediaType,BusType

diskutil info / | grep -E \
  "Solid State|Protocol"

lsblk -dno NAME,ROTA,TRAN

manage-bde -status C:

fdesetup status

lsblk -o NAME,TYPE,FSTYPE

Then do it.

Pick the first row that matches. If two apply, the earlier one is simpler and harder to get wrong.

cryptsetup luksErase /dev/nvme0n1p3

nvme format /dev/nvme0n1 \
  --ses=1

hdparm -I /dev/sda   # check
hdparm --user-master u \
  --security-erase p /dev/sda

Or let it work out the method for you.

Answer the four questions from above and this gives you the defensible method for that machine and the actual commands. Nothing is sent anywhere — it runs in your browser.

Simpletag already knows the first three for any machine that has been checking in — they sit on the asset's own page, so nobody has to look them up by hand.

Check that it worked, then write it down.

800-88 asks for verification, not just execution. For a Purge that usually means sampling: boot the machine from a USB stick and look at the drive. If you see a fresh empty partition table and no recoverable filesystem, that is the result you wanted. Sample more machines when you are doing a batch — spot-checking one in ten catches a bad procedure before it has run fifty times.

Then record it while you still remember: the serial, the make and model, the method, the date, and who did it. That last one matters more than people expect — a certificate records an attestation by a named person, and an unnamed one is worth very little to whoever ends up relying on it.

Simpletag writes that record for you from the register, checks the method against what the drive actually was, and says so on the certificate if the two do not match. More on the certificate →

How to check any of this yourself.

Do not take our word for it, and be equally wary of a forum post from 2011.

• NIST SP 800-88 Rev. 1 is the source document, it is free, and Appendix A lists the accepted methods per media type. Appendix G is a certificate template — worth reading even if you never use it, because it shows what a complete record contains.
• The drive manufacturer's own documentation beats general advice every time. Search the exact model plus "sanitize" or "secure erase".
• Your own policy or contract may demand a specific level. Defence work, card data and health records all have their own expectations, and "we did a Purge" is a much easier sentence when it is written down beforehand.

Let the register do the paperwork.

Simpletag already knows the make, model, serial, drive type and encryption state of every machine that has checked in — which is most of what a certificate needs. Free for 25 computers, certificates included.