Many organizations believe that encryption alone is enough to protect data, even when a device is disposed of. This is a myth. Encryption protects data while it remains encrypted and the encryption keys are protected. Secure data sanitization helps ensure that data is not recoverable after the drive is no longer under organizational control. They are complementary security controls, not substitutes. It is therefore important to wipe an encrypted drive securely so that no data traces are left behind, and data security is maintained.
The purpose of media sanitization is to ensure that the data, as well as the encryption keys, are not recoverable after the drive leaves organizational control. The sanitization process should always be selected according to the storage technology, the confidentiality of the information, and the organization's media sanitization policy.
How Are Encrypted Drives Wiped?
How an encrypted drive is wiped depends on how the encryption was performed and what kind of device it is. Common encrypted drive sanitization techniques include overwrite, firmware-based sanitize commands, and Cryptographic Erase (CE).
Let's look at how to wipe software-encrypted and self-encrypting drives.
- Software-Encrypted Drives: These drives use the operating system’s key management for encrypting data, and the encryption keys are usually protected by Trusted Platform Module (TPM) or Apple Secure Enclave. These drives can be sanitized using overwrite commands or firmware-based sanitize commands like Secure Erase.
- Self-Encrypting Drives: In these drives, the encryption is performed inside the storage device, not the operating system. Any block written to the drive is automatically encrypted with a Media Encryption Key (MEK), usually generated at the time of manufacture. The MEK is typically wrapped by a Key Encryption Key (KEK), which is itself unlocked by an Authentication Key (AK) derived from the user's credentials. As this MEK key stays with the drive through its entire lifecycle, it does not come into contact with the operating system or memory. These devices can be sanitized using the ‘Cryptographic Erase’ method, prescribed by both NIST 800-88 Rev.2 & IEEE 2883:2022.
How to Wipe an Encrypted Drive Using NIST or IEEE?
For encrypted storage devices, NIST 800-88 Rev.2 recognizes Cryptographic Erase as a Purge technique provided the encryption was active from the point of data storage, the encryption strength meets current standards, and destruction of the associated cryptographic keys can be verified. Cryptographic Erase does not overwrite every addressable sector. Instead, it ‘Sanitizes’ the drive by invalidating access to the encryption key. Once the key is securely destroyed or replaced, the encrypted data can no longer be decrypted.
This approach is particularly relevant for self-encrypting drives because encryption is performed within the storage device itself. Since every block of data is already encrypted, securely removing the encryption key is sufficient to render the stored information inaccessible.
Similarly, IEEE 2883:2022 also recognizes Cryptographic Erase as a supported sanitization technique for encrypted devices. Where Cryptographic Erase is not supported, organizations should select another sanitization method appropriate for the storage technology and consistent with their internal media sanitization policy.
Note: Software-encrypted drives store encryption keys within the operating system or encryption application rather than on the storage device, and media sanitization is performed using overwrite-based methods or supported device sanitization commands.
How Does BitRaser Securely Wipe Encrypted Drives?
BitRaser Drive Eraser automatically selects the appropriate sanitization approach based on the encryption technology and storage device. BitRaser does not rely solely on one erasure technique, but supports overwrite, firmware-based purge commands, and Cryptographic Erase for compatible Self-Encrypting Drives. This allows organizations to securely sanitize software-encrypted HDDs, SSDs, NVMe drives, and hardware-encrypted SEDs while staying in compliance with industry standards including NIST SP 800-88 Rev.2 and IEEE 2883:2022. BitRaser supports erasure of BitLocker-encrypted drives and other software encryption like Apple FileVault and VeraCrypt.
For supported self-encrypting drives (SEDs), the application performs Cryptographic Erase. In this method, the Media Encryption Key (MEK) stored on the drive is destroyed. Since encrypted information is inaccessible without this key, the information becomes inaccessible.
