How does disk sanitization in ONTAP help to prevent recovery of data?

Applies to

• ONTAP 9
• Non‑encrypted HDDs and SSDs
• Self‑encrypting drives (SED/NSE/FIPS)

Description

The disk sanitization feature in ONTAP overwrites or cryptographically erases data so that it cannot be recovered from the physical media, in alignment with NIST SP 800‑88r1 and NIST SP 800-88r2 guidelines for media sanitization.

Deleting files or destroying volumes does not immediately remove data from the media; it only removes pointers. The data remains on disk until it is overwritten or cryptographically purged. Disk sanitization ensures that all user‑addressable locations are cleared or purged so that data cannot be recovered by normal or forensic means.

• Disk sanitization is commonly performed in instances where there was either a data spill (classified or sensitive data that ends up in an unsecure location) or when physical media is being returned or removed from production.
• Knowledge of NetApp disk sanitization helps ensure the sanitization method chosen (Clear, Purge or Destroy) meets the confidentiality needs (low, moderate or high impact) of the operational environment.
• For systems running ONTAP without encrypted drives, leveraging the "disk sanitize" command with three cycles of overwrite patterns applied in succession adheres to the standard laid out by the US Department of Defense (DoD) in the National Industrial Security Program Operating Manual (DoD 5220.22-M) for HDD media (SAS/ SATA/ NL-SAS).
• ONTAP systems leveraging encrypted drives can use the "encryption disk sanitize" command to cryptographically sanitize SEDs, making the existing data impossible to retrieve and complies with the NIST 800-88r1 and NIST 800-88r2 Purge standard.