Data wiping

NIST SP 800-88 is the US guideline most buyers and auditors ask about. It sorts erasure into levels. reCore records one of two for every wipe:

• Clear: the data can't be read back through the drive's normal interface. A software overwrite of the whole drive is a Clear.
• Purge: recovery is not feasible even with laboratory tools, and the drive can still be reused. This needs the drive's own erase command, run by its firmware, because only the firmware can reach spare and remapped areas the computer can't see.

Which level a wipe reached depends on the method that actually ran and the type of drive. The server works this out itself from the method and drive type. It doesn't take the station's word for it.

The station reads what each drive supports, then tries hardware erase commands in a fixed order. If the drive refuses one, it tries the next. If no hardware command works, it overwrites the drive once in software.

Why the table looks like this:

• ATA Secure Erase on an SSD is only Clear. NIST SP 800-88 Rev. 1 counts it as a Clear on flash, in either mode, because the drive may leave spare flash untouched. Normal mode is Clear on hard drives too. reCore follows that. A drive whose type it can't confirm as a hard drive is treated like an SSD, so the record never claims more than it can stand behind.
• SSDs are overwritten with a random pattern, not zeros. Some SSD controllers skip writing blocks that are all zeros. A random pattern can't be skipped that way. Hard drives get zeros.
• Self-encrypting drives. A crypto erase replaces the drive's internal encryption key, so the old data can't be decrypted any more. It takes seconds. The TCG Opal crypto erase is only used on a drive that really encrypts, never on one locked by its owner.
• Drives behind a USB adapter. When an adapter doesn't pass the drive's own erase command through, the station falls back to the overwrite. To give such a drive a hardware erase, connect it directly instead.

You can also pick one method yourself, at the station or in a workflow. If a drive doesn't support the method you picked, the station switches that drive to the method Smart Selection would use and says so on screen.

1. 1Open the Data wipe step. Under Select Drives you see every drive the station can wipe, with model, the end of its serial, size and type.
2. 2Optional: click Show Details on a drive. It shows the full serial, the recommended method, why it was picked, and an estimated time. Check all health reads each drive's SMART health first.
3. 3Tick the drives to wipe, or Select all drives.
4. 4Under Wipe Method, leave Smart Selection (Auto) unless you have a reason to change it.
5. 5Click Start wipe. The Confirm Secure Wipe window lists each drive with model, size and full serial. Check them against the drives in front of you, then click Yes, Wipe Data.
6. 6Each drive shows Step 1 of 2 (erasing) and then Step 2 of 2 (verifying, which only reads). Drives are wiped at the same time. Don't unplug drives or switch the machine off.

When a drive finishes and passes its check, the station shows Wiped and verified. The certificate waits for an admin. See Certificates for what happens next.

A wipe can't start while diagnostics are running. In a workflow set to run automatically, the station starts the wipe by itself and wipes every drive it is allowed to, so nobody has to click.

• The drive the station runs from. It is shown greyed out with the badge Station runs from this drive. The station checks again right before it erases anything. If it can't work out which drive it started from, it refuses every wipe rather than guess. To wipe that drive, start the machine from the reCore USB stick instead.
• Drives you protect. The Protect button on a drive keeps it, for example for a legal hold, and it shows as Kept: not wiped on every station. Admins manage the list under Protected Drives.
• Drives locked with a password, shown as Locked. See Frozen and locked drives.
• A drive whose own health check (SMART) reports failed. The wipe is refused before anything is written.
• A drive that changed. Right before erasing, the station reads the drive's serial and size again. If they don't match the drive it listed, it refuses.

An automatic run also leaves USB sticks alone. A technician can still pick one by hand on the wipe screen.

An admin can start a wipe on any device whose station is connected right now. A technician can do the same for devices they have had a session on. Read-only users can't.

1. 1Open Live, Live Drives. You see the drives in every connected device.
2. 2Click Wipe next to the drive.
3. 3In Confirm Data Wipe, check the drive, serial, size and device. Pick a wipe method. Auto (Recommended) does the same as Smart Selection at the station.
4. 4Click Start Wipe. Progress shows on the same page and on the station.

The station runs the same safety checks as a wipe started at the bench: it still refuses its own drive and protected drives.

Frozen: many computers lock a SATA drive's security commands when they start up. The drive then refuses ATA Secure Erase until it loses power. This is common on SATA SSDs.

On reCore OS, the station tries to clear the lock by putting the machine to sleep for a few seconds and waking it up again. It then runs ATA Secure Erase. If the drive is still frozen, it gets the overwrite (a Clear). The same sleep is tried once for an NVMe drive that refuses its erase commands, since some computers lock those too.

Some machines don't wake up by themselves. For those, turn off Clear BIOS locks in the workflow's Data wipe settings (Workflows). Frozen drives then go straight to the overwrite.

Locked: a drive with a password set, or a self-encrypting drive locked by its owner, can't be read or erased at all. The station shows it as Locked with steps under To wipe it:. For a password-locked drive: unlock it or clear the password in the BIOS, then start the station again. With no password, send the drive for physical destruction.

A wipe only counts as completed when its check passes. How it is checked depends on what the erase does to the drive.

• How much is read back: at least 10% of the drive. That is the sampling NIST SP 800-88 Rev. 1 describes, and nothing can set it lower. Your assurance level can raise it to 100%.
• What fails a check: any block that reads back wrong without a known cause. Blocks the drive itself has already retired as bad are counted and shown separately.
• Hidden areas: some hard drives have a hidden area (HPA or DCO) that the computer can't see, so an overwrite never reaches it. The station detects one where it can, but doesn't remove it. A certificate is refused for a drive with a hidden area that the wipe did not reach.

For a failed wipe, the station's History has Re-verify. It reads the drive back again at a coverage you choose (10% to 100%) without writing anything. Full verification of a large drive can take several hours.

An admin sets the organisation's level in Settings, under Data Sanitization Assurance Level. A batch can have its own under Data sanitization level on the Batches page, for a customer who contracted something different.

The levels apply the rules ADISA publishes for its DIAL levels. Choosing one changes how stations wipe and check drives. It is not a certification of your organisation.

A change to the organisation's level reaches stations the next time someone signs in. A change to a batch's level applies right away. A wipe already running finishes at the level it started with.

• While it runs: on the station, and in the dashboard under Live, Live Drives.
• Afterwards: every wipe, completed or failed, is in Drives, Wipe Records, with the method that actually ran, its result and its certificate status. The station's History button lists the wipes it ran.
• The method that ran, not the one asked for. When the station fell back from a hardware erase to an overwrite, the record shows the overwrite and Clear.
• Offline stations keep their results and send them when they are next online.

A completed wipe waits for an admin to approve it before its certificate is issued. That is the next guide: Certificates.