Guides:NIST SP 800-88 Media Sanitization with QuantaStor - Revision history

Qadmin: /* Can I purge one project's data (Network Share) without wiping the whole pool? */

2026-10-30T19:02:21Z

Can I purge one project's data (Network Share) without wiping the whole pool?

← Older revision		Revision as of 19:02, 30 October 2026
Line 113:		Line 113:

	Yes, if the data lives in its own encrypted network share. Each share has its own AES-256 key, so deleting the share and destroying all copies of its key is a cryptographic erase limited to that dataset. Deleting an unencrypted share is a logical deletion. The data can no longer be reached through NFS, SMB or the management interfaces, but the freed blocks remain on disk until they are overwritten so on its own it so doesn't meet Clear level. That said, the data can reach Purge or Clear level later when the pool is decommissioned.		Yes, if the data lives in its own encrypted network share. Each share has its own AES-256 key, so deleting the share and destroying all copies of its key is a cryptographic erase limited to that dataset. Deleting an unencrypted share is a logical deletion. The data can no longer be reached through NFS, SMB or the management interfaces, but the freed blocks remain on disk until they are overwritten so on its own it so doesn't meet Clear level. That said, the data can reach Purge or Clear level later when the pool is decommissioned.

	'''Decommissioning Encrypted Pool'''		'''Decommissioning Encrypted Pool'''
	* Software encryption: delete the pool with Shred Encryption Keys selected, and destroy the pool key on any KMIP server and in every exported key backup.		* Software encryption: delete the pool with Shred Encryption Keys selected, and destroy the pool key on any KMIP server and in every exported key backup.
	* Hardware encryption (SED): run SED Instant Erase on each drive so that it discards its media encryption key. Discarding only QuantaStor's copy of the drive credentials is not a cryptographic erase.		* Hardware encryption (SED): run SED Instant Erase on each drive so that it discards its media encryption key. Discarding only QuantaStor's copy of the drive credentials is not a cryptographic erase.

	'''Decommissioning Unencrypted Pool'''		'''Decommissioning Unencrypted Pool'''
	* Clear: on HDDs, use one of the overwrite shred modes (zeros, random, DoD, NNSA or US Army) when deleting the pool or formatting the disks, or another approved overwrite utility.		* Clear: on HDDs, use one of the overwrite shred modes (zeros, random, DoD, NNSA or US Army) when deleting the pool or formatting the disks, or another approved overwrite utility.

Qadmin: /* Can I purge one project's data (Network Share) without wiping the whole pool? */

2026-10-30T19:02:10Z

Can I purge one project's data (Network Share) without wiping the whole pool?

← Older revision		Revision as of 19:02, 30 October 2026
Line 112:		Line 112:
	=== Can I purge one project's data (Network Share) without wiping the whole pool? ===		=== Can I purge one project's data (Network Share) without wiping the whole pool? ===

	Yes, if the data lives in its own encrypted network share. Each share has its own AES-256 key, so deleting the share and destroying all copies of its key is a cryptographic erase limited to that dataset. Deleting an unencrypted share is a logical deletion. The data can no longer be reached through NFS, SMB or the management interfaces, but the freed blocks remain on disk until they are overwritten so on its own it doesn't meet Clear. That said, the data can reach Purge or Clear level later when the pool is decommissioned.		Yes, if the data lives in its own encrypted network share. Each share has its own AES-256 key, so deleting the share and destroying all copies of its key is a cryptographic erase limited to that dataset. Deleting an unencrypted share is a logical deletion. The data can no longer be reached through NFS, SMB or the management interfaces, but the freed blocks remain on disk until they are overwritten so on its own it so doesn't meet Clear level. That said, the data can reach Purge or Clear level later when the pool is decommissioned.
	'''Decommissioning Encrypted Pool'''		'''Decommissioning Encrypted Pool'''
	* Software encryption: delete the pool with Shred Encryption Keys selected, and destroy the pool key on any KMIP server and in every exported key backup.		* Software encryption: delete the pool with Shred Encryption Keys selected, and destroy the pool key on any KMIP server and in every exported key backup.

Qadmin: /* Can I purge one project's data without wiping the whole pool? */

2026-10-30T19:01:21Z

Can I purge one project's data without wiping the whole pool?

← Older revision		Revision as of 19:01, 30 October 2026
Line 110:		Line 110:
	NIST 800-88 is a set of guidelines for a sanitization process, not a product certification. QuantaStor provides Clear methods (overwrite shredding, logical deletion) and Purge methods (cryptographic erase through share and pool keys, NVMe secure format, SED instant erase). Combine these with your own verification and documentation to meet the guideline.		NIST 800-88 is a set of guidelines for a sanitization process, not a product certification. QuantaStor provides Clear methods (overwrite shredding, logical deletion) and Purge methods (cryptographic erase through share and pool keys, NVMe secure format, SED instant erase). Combine these with your own verification and documentation to meet the guideline.

	=== Can I purge one project's data without wiping the whole pool? ===		=== Can I purge one project's data (Network Share) without wiping the whole pool? ===

	Yes, if the data lives in its own encrypted network share. Each share has its own AES-256 key, so deleting the share and destroying all copies of its key is a cryptographic erase limited to that dataset. ~~Data in~~ unencrypted ~~shares~~ can only ~~be logically deleted unless~~ the disks ~~are shredded~~.		Yes, if the data lives in its own encrypted network share. Each share has its own AES-256 key, so deleting the share and destroying all copies of its key is a cryptographic erase limited to that dataset. Deleting an unencrypted share is a logical deletion. The data can no longer be reached through NFS, SMB or the management interfaces, but the freed blocks remain on disk until they are overwritten so on its own it doesn't meet Clear. That said, the data can reach Purge or Clear level later when the pool is decommissioned.
			'''Decommissioning Encrypted Pool'''
			* Software encryption: delete the pool with Shred Encryption Keys selected, and destroy the pool key on any KMIP server and in every exported key backup.
			* Hardware encryption (SED): run SED Instant Erase on each drive so that it discards its media encryption key. Discarding only QuantaStor's copy of the drive credentials is not a cryptographic erase.
			'''Decommissioning Unencrypted Pool'''
			* Clear: on HDDs, use one of the overwrite shred modes (zeros, random, DoD, NNSA or US Army) when deleting the pool or formatting the disks, or another approved overwrite utility.
			* Purge: requires media that supports a cryptographic or block erase, such as Instant Secure Erase (ISE) drives, SEDs or NVMe devices. Use the SED Instant Erase or NVMe Secure shred modes.

	=== Does deleting a file remove it from snapshots? ===		=== Does deleting a file remove it from snapshots? ===

Qadmin: osn-seo-utilities: quantastor-security-features-nist-sp800-88-complia @ f46320258242 (approved in the portal)

2026-10-29T22:51:36Z

osn-seo-utilities: quantastor-security-features-nist-sp800-88-complia @ f46320258242 (approved in the portal)

New page

''By Steve Umbehocker, CTO, OSNexus · Updated October 29, 2026''

NIST Special Publication 800-88 is the US federal guideline for media sanitization. Research contracts, data use agreements and security policies often require that data be deleted "in accordance with NIST 800-88" at the end of a project, and sponsors increasingly ask for evidence that it was. The guideline defines three outcomes: Clear, Purge and Destroy. It leaves the device-specific methods largely to IEEE 2883. QuantaStor gives administrators sanitization tools at several levels: deleting shares, volumes and snapshots, cryptographic erase through per-share and per-pool encryption keys, and disk-level shredding with overwrite patterns, NVMe secure format or SED instant erase when a pool is deleted or a disk is formatted. This guide maps each tool to an 800-88 category and shows how to build an evidence trail for an attestation.

== Why it matters ==

A deletion request under a data use agreement usually arrives at the end of a contract, long after the storage was designed. If one shared pool holds data for many projects, overwriting disks is not an option, and plain file deletion leaves data recoverable from snapshots and freed blocks. Deciding at provisioning time how a dataset will be sanitized makes the end-of-contract step routine and defensible.

The three NIST categories, in storage terms:

{| class="wikitable"
! Category !! NIST intent !! Typical method
|-
| Clear || Data is not recoverable through normal interfaces || Overwrite, logical delete plus overwrite, factory reset
|-
| Purge || Recovery is infeasible even with laboratory techniques || Cryptographic erase, sanitize/secure-erase commands, degaussing
|-
| Destroy || The media can no longer be used || Shredding, pulverizing, incineration
|}

== How it works ==

=== Logical deletion of shares, volumes and snapshots ===

Deleting a file over NFS or SMB removes it from the share, but any snapshot taken while it existed still holds its blocks. Deleting the whole network share with [[Network Share Delete]] removes the share and its snapshots, and deleting a block volume with [[Storage Volume Delete]] does the same for a volume. After that the data can't be reached through NFS, SMB, iSCSI or the management plane. Freed blocks are not overwritten straight away, though. On its own, logical deletion is a user-interface-level Clear. Treat it as Clear only when combined with one of the methods below.

[[Snapshot Schedules]] matter here: as long as a retained snapshot references a deleted file, the file can be restored. A file-level deletion request therefore has to cover every snapshot that contains the file, or wait for those snapshots to expire.

=== Cryptographic erase with encrypted network shares ===

Network shares can be created with encryption enabled. Share encryption uses AES-256, and each encrypted share has its own key. The key can be unloaded so the share's data becomes unreadable, loaded again with [[Network Share Load Encryption Key]], and exported to a key block for safekeeping. When a key is unloaded, QuantaStor shreds the clear-text copy of the key held on the system.

This is the practical answer to "one key per tenant": give each project, sponsor or data use agreement its own encrypted share. At the end of the contract, delete the share and destroy every exported copy of its key block. The remaining ciphertext in freed blocks can't be decrypted. This is cryptographic erase, which 800-88 lists as a Purge method, applied to one dataset rather than a whole disk.

=== Cryptographic erase of encrypted storage pools ===

[[Software Encryption]] encrypts every device in a storage pool, and [[Hardware Encryption]] uses self-encrypting drives (SEDs) with keys managed by QuantaStor. Pool keys can be exported with [[Storage Pool Export Encryption Keys]] or held on an external KMIP server configured with [[Create Key Server Profile]].

When an encrypted pool is deleted, the '''Shred Encryption Keys''' security option shreds the pool's key files on the system. A cryptographic erase is only as complete as the destruction of every copy of the key, so revoke or delete the key on any key server and destroy exported key backups as well.

=== Disk-level shredding ===

The '''Shred Data''' option runs when a pool is deleted (as a security option of the pool delete dialog) or when individual disks are formatted from [[Physical Disks/Device Management]]. Format first clears encryption settings and partitions. Without Shred Data it does only a quick format. These shred modes are available:

{| class="wikitable"
! Mode !! What it does !! 800-88 category
|-
| Fill-zeros single pass || Overwrites the device with zeros || Clear (HDD)
|-
| Random-data single pass || Overwrites with random data || Clear (HDD)
|-
| DoD 5220.22-M || 4-pass overwrite procedure || Clear (HDD)
|-
| NNSA NAP-14.1-C || 4-pass overwrite procedure || Clear (HDD)
|-
| US Army AR380-19 || Multi-pass overwrite procedure || Clear (HDD)
|-
| NVMe Secure || Runs an NVMe format on the device || Purge, when the drive implements a cryptographic or block erase
|-
| SED Instant Erase || Factory-resets a self-encrypting drive with its PSID, discarding the media encryption key || Purge
|}

Overwrite modes suit rotational disks. On SSDs, wear levelling and over-provisioned flash mean an overwrite doesn't reach every cell. For those drives, use NVMe Secure, SED Instant Erase or encryption. SED Instant Erase needs the drive's PSID (printed on the drive label) to be registered with QuantaStor. Without it, the operation is refused rather than silently skipped.

After a shred, each physical disk records a '''Last Shred''' timestamp, a '''Last Shred Mode''' and a '''Shred Signature'''. These fields can be shown in the physical disk grid and are the per-device evidence an attestation needs.

== Design and sizing ==

Plan sanitization when you provision, not at the end of the contract:

* '''One encrypted share per data use agreement.''' This is what makes Purge-level deletion possible on shared hardware. Use [[Storage Pools]] with software or hardware encryption underneath when policy also requires encryption at rest.
* '''Keep snapshot retention shorter than your deletion deadline.''' If a sponsor requires deletion within 30 days of contract end, a schedule that keeps snapshots for 90 days can't meet it without manual snapshot deletion.
* '''Track every copy.''' [[Remote-replication (DR)]] targets, exported key blocks and backups are all copies. Delete replicas on the target system too, and record that you did.
* '''Budget time for overwrite shredding.''' Multi-pass overwrite is a long-running task that can take hours per disk on large HDDs. SED Instant Erase and NVMe format finish in seconds to minutes.
* '''Record PSIDs at deployment''' for SED-based pools, so that instant erase is available at end of life.

== Setting it up ==

# Create an encrypted storage pool if policy requires encryption at rest (see [[Software Encryption]] or [[Hardware Encryption]]), and export its keys to a controlled location.
# Create one network share per project with encryption enabled. Export each share's key block and store it with the project's records, for example in your secrets vault under the project ID.
# Set snapshot schedules with retention that fits the shortest deletion deadline among the projects on the pool.
# Review [[Audit Logging]] so that administrative actions on the system are recorded, and keep the logs long enough to cover your contracts.

The same disk and pool operations are available from the QuantaStor CLI. To delete a pool, shred its keys and overwrite its disks:

<pre>qs pool-destroy --pool=pool1 --shred-keys=true --shred-mode=dod --flags=force</pre>

To sanitize a pair of NVMe drives that are no longer in a pool:

<pre>qs disk-format --disk-list=nvme0n1,nvme1n1 --shred-mode=nvme_secure</pre>

The valid <code><nowiki>--shred-mode</nowiki></code> values are <code><nowiki>zeros</nowiki></code>, <code><nowiki>random</nowiki></code>, <code><nowiki>dod</nowiki></code>, <code><nowiki>nnsa</nowiki></code>, <code><nowiki>usarmy</nowiki></code>, <code><nowiki>nvme_secure</nowiki></code>, <code><nowiki>ssd_secure</nowiki></code>, <code><nowiki>sed-instant-erase</nowiki></code>, <code><nowiki>auto</nowiki></code> and <code><nowiki>none</nowiki></code> (the default).

== Operating and testing ==

A typical end-of-contract procedure for one project's data on a shared pool:

# Confirm which shares, volumes and replicas hold the project's data.
# Delete the replicas on the DR target, then delete the shares on the primary system with [[Network Share Delete]]. This removes their snapshots too.
# Destroy every exported copy of each share's key block.
# Collect the audit log entries and task history that show the deletions and when they ran.
# Write the attestation: list the datasets, the method (cryptographic erase of per-share AES-256 keys plus deletion of the share and its snapshots), the date, and the key-destruction step.

For decommissioning hardware, delete the pool with Shred Data and Shred Encryption Keys selected. Then check each disk's Last Shred Mode and timestamp in the physical disk grid and include them in the certificate of sanitization. NIST 800-88 also asks for verification. For overwrite modes, read back a sample of each drive. For crypto and SED erase, confirm that the drive presents as unformatted with no recognizable pool labels.

== FAQ ==

=== Is QuantaStor NIST 800-88 compliant? ===

NIST 800-88 is a set of guidelines for a sanitization process, not a product certification. QuantaStor provides Clear methods (overwrite shredding, logical deletion) and Purge methods (cryptographic erase through share and pool keys, NVMe secure format, SED instant erase). Combine these with your own verification and documentation to meet the guideline.

=== Can I purge one project's data without wiping the whole pool? ===

Yes, if the data lives in its own encrypted network share. Each share has its own AES-256 key, so deleting the share and destroying all copies of its key is a cryptographic erase limited to that dataset. Data in unencrypted shares can only be logically deleted unless the disks are shredded.

=== Does deleting a file remove it from snapshots? ===

No. A file deleted over NFS or SMB stays in every snapshot taken while it existed. Delete those snapshots, let them expire, or delete the entire share, which removes its snapshots too.

=== How long does disk shredding take? ===

Overwrite modes write the whole device once (zeros, random) or several times (DoD, NNSA, US Army), so expect hours per large HDD. NVMe secure format and SED instant erase complete much faster because the drive discards its internal keys or blocks instead of rewriting every sector.

=== What evidence can I give a sponsor? ===

Use audit log entries for share, volume, replica and key operations, plus the Last Shred, Last Shred Mode and Shred Signature recorded on each sanitized disk. Together with your key-destruction records, these support a certificate of sanitization as described in NIST SP 800-88 ([https://csrc.nist.gov/pubs/sp/800/88/r1/final NIST SP 800-88 Rev. 1]).

----
''Part of the [[Guides:Index|QuantaStor Guides]] series. For reference documentation, see the [[Main Page|QuantaStor documentation]].''

[[Category:Guides]]