A hard drive in a box is not just hardware. It is everything that was ever stored on it, and it stays that way until someone sanitizes it. Organizations ship drives for repair, for lease returns, for forensic work and for destruction, and each trip is a moment when data can be lost, copied or mislaid. This guide explains what the U.S. National Institute of Standards and Technology (NIST) says in its media sanitization guideline, SP 800-88 Rev. 2, about clearing, purging and destroying media, and how to ship data-bearing devices so that custody is documented from the first hand-off to the final certificate. It is general information, not legal or security advice.
Quick answer
- NIST SP 800-88 Rev. 2, Guidelines for Media Sanitization, was published in September 2025 and supersedes Revision 1 of December 2014.
- It describes three levels: Clear, Purge and Destroy. Purge makes recovery infeasible against state-of-the-art laboratory methods, and cryptographic erase is a purge technique based on sanitizing the encryption keys.
- Until sanitization is done and verified, a device still holds data. Ship it as a sensitive item.
- NIST says a certificate of sanitization should be completed for each device sanitized, recording details such as the make, model, serial number, method and verification. A serial-number manifest from the first hand-off mirrors that record.
- Use sealed tamper-evident packaging, a named recipient and a signed, time-stamped hand-off, and never send passwords or recovery keys in the same package.
Three Levels of Sanitization
NIST's guideline defines media sanitization as making the data on storage media effectively inaccessible at a defined level of effort, and it helps an organization choose methods based on how sensitive the information is. Section 3.1 sets out the three levels:
| Level | What NIST says | What it means when you ship |
|---|---|---|
| Clear | Logical techniques that protect against simple, non-invasive recovery using the user interface. NIST says Clear is not appropriate for hard copy under any conditions | The device may be reused. Until the result is verified, treat the device as holding data |
| Purge | Physical or logical techniques that make recovery infeasible against state-of-the-art laboratory methods, while keeping the media potentially reusable. NIST says Purge should be used instead of Clear when possible | A purged device is safer to move, but the certificate and the verification still matter |
| Destroy | Appropriate for all hard copy and for most information storage media, except logical or virtual storage | Devices go to a destruction provider with their data intact. This is the riskiest leg of the trip |
NIST also describes cryptographic erase as a purge technique based on sanitizing the keys used to encrypt data. It cautions that the technique requires that no sensitive data was previously stored in plaintext, and that backed-up or escrowed keys must be understood before it is trusted. In short, an encrypted drive whose keys are gone is a small problem if it is lost, and a drive whose keys are stored elsewhere may not be.
Why Shipping Is the Weak Point
- The data is still there. The point of many trips is that the drive has not yet been sanitized or destroyed. A drive on its way to a destruction facility holds exactly what it held on the desk.
- Movement is unwatched. Between the sender's door and the vendor's dock, no one in your organization is looking at the box.
- Small objects get lost. A drive fits in a pocket. Boxes of them get mixed with other parcels.
- Records break at the hand-off. If the serial numbers sent are not the serial numbers received, no one can prove what happened.
For organizations that hold personal information, the privacy dimension is covered in our guide to Law 25 and courier delivery.
Before You Ship: A Sender's Checklist
- Decide the purpose. Repair, lease return, forensic copy, sanitization or destruction. The purpose decides what must be removed first and who may open the device.
- Consider removing the media. If a laptop is going for a repair that does not need the storage, the drive can be sanitized or removed first. NIST notes that media sent to a maintenance provider may remain under the organization's control if contractual agreements protect confidentiality.
- Prefer encrypted devices. This is good practice rather than a NIST requirement, and it only helps if the keys are not in the box.
- Write a manifest listing every device by make, model, serial number, media type and asset tag, along with what should happen to it. Keep a copy.
- Pack each device in anti-static or padded protection, then in a tamper-evident bag or seal, and record the seal numbers. See tamper-evident packaging.
- Keep credentials out of the box. No passwords, PINs or recovery keys with the device. If the recipient needs them, send them through a separate, agreed channel.
- Name the recipient and agree the receiving time, so the package does not wait at a loading dock.
- Photograph the sealed package and the manifest before it leaves.
What a Good Manifest Records
NIST's section on documentation says a certificate should be completed for each device that has been sanitized, per the organization's policies. The details it lists include the manufacturer, model, serial number and media type, the sanitization method and technique, the tool and its version, the verification method, and the people who verified and validated the work. A manifest that captures the first four items before the trip makes the final certificate easy to match.
| Column | Why it matters |
|---|---|
| Make, model and serial number | Matches each device to its certificate and to the receiving record |
| Media type | Different media need different sanitization methods |
| Asset tag or owner | Links the device to your inventory and to the person responsible |
| Intended action | Repair, return, copy, purge or destroy, so that nothing is done by default |
| Seal number and condition at pickup | Lets the recipient compare the number and the seal on arrival |
| Hand-off record | Names, signatures and times at pickup and delivery. See chain of custody |
How the Courier Fits In
- At pickup: count the pieces, compare the seal numbers with the manifest, and sign only if they match.
- In transit: keep the shipment in the driver's custody. For the most sensitive loads, ask for a direct run with no other stops. See dedicated and shared routes.
- At delivery: hand to the named person, ask for a printed name, signature and time, and have the recipient compare the seal numbers. If a seal is broken, stop and report before opening.
- Afterward: the sender receives the signed record. For destruction or sanitization, the sender then waits for the provider's certificate and matches the serial numbers.
For evidence and legal media, where the rules are stricter, read our guide to delivering electronic evidence and storage media.
Common Mistakes
- Sending a drive with its password written on the label or in the box.
- Shipping loose drives in a mixed carton, with no serial list.
- Assuming a quick format counts as sanitization. NIST describes levels of effort, and a simple delete is not among them.
- Skipping the certificate, so that no one can prove the drive was destroyed.
- Booking a shared route for a box that deserves a direct run.
Frequently Asked Questions
What does NIST SP 800-88 cover?
It is NIST's guideline on media sanitization. Revision 2, published in September 2025, helps organizations establish a sanitization program and choose techniques and controls based on how sensitive the information is. It supersedes Revision 1 of December 2014.
What is the difference between Clear, Purge and Destroy?
According to NIST, Clear uses logical techniques against simple, non-invasive recovery. Purge uses physical or logical techniques that make recovery infeasible against state-of-the-art laboratory methods. Destroy is appropriate for all hard copy and most information storage media. NIST says Purge should be used instead of Clear when possible.
Does a drive have to be wiped before it is shipped?
It depends on the purpose. A drive going to a sanitization or destruction provider ships with its data, so it must be handled as a sensitive item. A drive going for repair may be sanitized or removed first, or sent under a contract that protects confidentiality.
What should a certificate of sanitization contain?
NIST says a certificate should be completed for each device sanitized, and the details include the manufacturer, model, serial number, media type, sanitization method and technique, tool and version, verification method, and the verifier's and validator's information.
Should I send the password with the drive?
No. Credentials and recovery keys should not travel in the same package as the device. If the recipient needs them, use a separate channel that you have agreed in advance.
Treat the Box as Its Contents
The value of a data-bearing device is not in the metal. Ship it as you would ship the information on it: sealed, listed by serial number, handed to a named person, and matched to a certificate at the end.
Rush Expedited Courier handles sealed, documented deliveries across Montréal, with dispatch around the clock. Describe the devices and where they are going in the quote form; the rest of our work is under courier services.
Sources and Further Reading
Facts on this page were checked against the sources below on October 28, 2026.
- NIST: SP 800-88 Rev. 2, Guidelines for Media Sanitization (publication page)
- NIST: SP 800-88 Rev. 2, Guidelines for Media Sanitization (full text, PDF)