Guides:NIST SP 800-88 Media Sanitization with QuantaStor

By Steve Umbehocker, CTO, OSNexus · Updated October 29, 2026

NIST Special Publication 800-88 is the US federal guideline for media sanitization. Research contracts, data use agreements and security policies often require that data be deleted "in accordance with NIST 800-88" at the end of a project, and sponsors increasingly ask for evidence that it was. The guideline defines three outcomes: Clear, Purge and Destroy. It leaves the device-specific methods largely to IEEE 2883. QuantaStor gives administrators sanitization tools at several levels: deleting shares, volumes and snapshots, cryptographic erase through per-share and per-pool encryption keys, and disk-level shredding with overwrite patterns, NVMe secure format or SED instant erase when a pool is deleted or a disk is formatted. This guide maps each tool to an 800-88 category and shows how to build an evidence trail for an attestation.

Why it matters

A deletion request under a data use agreement usually arrives at the end of a contract, long after the storage was designed. If one shared pool holds data for many projects, overwriting disks is not an option, and plain file deletion leaves data recoverable from snapshots and freed blocks. Deciding at provisioning time how a dataset will be sanitized makes the end-of-contract step routine and defensible.

The three NIST categories, in storage terms:

Category	NIST intent	Typical method
Clear	Data is not recoverable through normal interfaces	Overwrite, logical delete plus overwrite, factory reset
Purge	Recovery is infeasible even with laboratory techniques	Cryptographic erase, sanitize/secure-erase commands, degaussing
Destroy	The media can no longer be used	Shredding, pulverizing, incineration

How it works

Logical deletion of shares, volumes and snapshots

Deleting a file over NFS or SMB removes it from the share, but any snapshot taken while it existed still holds its blocks. Deleting the whole network share with Network Share Delete removes the share and its snapshots, and deleting a block volume with Storage Volume Delete does the same for a volume. After that the data can't be reached through NFS, SMB, iSCSI or the management plane. Freed blocks are not overwritten straight away, though. On its own, logical deletion is a user-interface-level Clear. Treat it as Clear only when combined with one of the methods below.

Snapshot Schedules matter here: as long as a retained snapshot references a deleted file, the file can be restored. A file-level deletion request therefore has to cover every snapshot that contains the file, or wait for those snapshots to expire.

Cryptographic erase with encrypted network shares

Network shares can be created with encryption enabled. Share encryption uses AES-256, and each encrypted share has its own key. The key can be unloaded so the share's data becomes unreadable, loaded again with Network Share Load Encryption Key, and exported to a key block for safekeeping. When a key is unloaded, QuantaStor shreds the clear-text copy of the key held on the system.

This is the practical answer to "one key per tenant": give each project, sponsor or data use agreement its own encrypted share. At the end of the contract, delete the share and destroy every exported copy of its key block. The remaining ciphertext in freed blocks can't be decrypted. This is cryptographic erase, which 800-88 lists as a Purge method, applied to one dataset rather than a whole disk.

Cryptographic erase of encrypted storage pools

Software Encryption encrypts every device in a storage pool, and Hardware Encryption uses self-encrypting drives (SEDs) with keys managed by QuantaStor. Pool keys can be exported with Storage Pool Export Encryption Keys or held on an external KMIP server configured with Create Key Server Profile.

When an encrypted pool is deleted, the Shred Encryption Keys security option shreds the pool's key files on the system. A cryptographic erase is only as complete as the destruction of every copy of the key, so revoke or delete the key on any key server and destroy exported key backups as well.

Disk-level shredding

The Shred Data option runs when a pool is deleted (as a security option of the pool delete dialog) or when individual disks are formatted from Physical Disks/Device Management. Format first clears encryption settings and partitions. Without Shred Data it does only a quick format. These shred modes are available:

Mode	What it does	800-88 category
Fill-zeros single pass	Overwrites the device with zeros	Clear (HDD)
Random-data single pass	Overwrites with random data	Clear (HDD)
DoD 5220.22-M	4-pass overwrite procedure	Clear (HDD)
NNSA NAP-14.1-C	4-pass overwrite procedure	Clear (HDD)
US Army AR380-19	Multi-pass overwrite procedure	Clear (HDD)
NVMe Secure	Runs an NVMe format on the device	Purge, when the drive implements a cryptographic or block erase
SED Instant Erase	Factory-resets a self-encrypting drive with its PSID, discarding the media encryption key	Purge

Overwrite modes suit rotational disks. On SSDs, wear levelling and over-provisioned flash mean an overwrite doesn't reach every cell. For those drives, use NVMe Secure, SED Instant Erase or encryption. SED Instant Erase needs the drive's PSID (printed on the drive label) to be registered with QuantaStor. Without it, the operation is refused rather than silently skipped.

After a shred, each physical disk records a Last Shred timestamp, a Last Shred Mode and a Shred Signature. These fields can be shown in the physical disk grid and are the per-device evidence an attestation needs.

Design and sizing

Plan sanitization when you provision, not at the end of the contract:

• One encrypted share per data use agreement. This is what makes Purge-level deletion possible on shared hardware. Use Storage Pools with software or hardware encryption underneath when policy also requires encryption at rest.
• Keep snapshot retention shorter than your deletion deadline. If a sponsor requires deletion within 30 days of contract end, a schedule that keeps snapshots for 90 days can't meet it without manual snapshot deletion.
• Track every copy. Remote-replication (DR) targets, exported key blocks and backups are all copies. Delete replicas on the target system too, and record that you did.
• Budget time for overwrite shredding. Multi-pass overwrite is a long-running task that can take hours per disk on large HDDs. SED Instant Erase and NVMe format finish in seconds to minutes.
• Record PSIDs at deployment for SED-based pools, so that instant erase is available at end of life.

Setting it up

1. Create an encrypted storage pool if policy requires encryption at rest (see Software Encryption or Hardware Encryption), and export its keys to a controlled location.
2. Create one network share per project with encryption enabled. Export each share's key block and store it with the project's records, for example in your secrets vault under the project ID.
3. Set snapshot schedules with retention that fits the shortest deletion deadline among the projects on the pool.
4. Review Audit Logging so that administrative actions on the system are recorded, and keep the logs long enough to cover your contracts.

The same disk and pool operations are available from the QuantaStor CLI. To delete a pool, shred its keys and overwrite its disks:

qs pool-destroy --pool=pool1 --shred-keys=true --shred-mode=dod --flags=force

To sanitize a pair of NVMe drives that are no longer in a pool:

qs disk-format --disk-list=nvme0n1,nvme1n1 --shred-mode=nvme_secure

The valid --shred-mode values are zeros, random, dod, nnsa, usarmy, nvme_secure, ssd_secure, sed-instant-erase, auto and none (the default).

Operating and testing

A typical end-of-contract procedure for one project's data on a shared pool:

1. Confirm which shares, volumes and replicas hold the project's data.
2. Delete the replicas on the DR target, then delete the shares on the primary system with Network Share Delete. This removes their snapshots too.
3. Destroy every exported copy of each share's key block.
4. Collect the audit log entries and task history that show the deletions and when they ran.
5. Write the attestation: list the datasets, the method (cryptographic erase of per-share AES-256 keys plus deletion of the share and its snapshots), the date, and the key-destruction step.

For decommissioning hardware, delete the pool with Shred Data and Shred Encryption Keys selected. Then check each disk's Last Shred Mode and timestamp in the physical disk grid and include them in the certificate of sanitization. NIST 800-88 also asks for verification. For overwrite modes, read back a sample of each drive. For crypto and SED erase, confirm that the drive presents as unformatted with no recognizable pool labels.

FAQ

Is QuantaStor NIST 800-88 compliant?

NIST 800-88 is a set of guidelines for a sanitization process, not a product certification. QuantaStor provides Clear methods (overwrite shredding, logical deletion) and Purge methods (cryptographic erase through share and pool keys, NVMe secure format, SED instant erase). Combine these with your own verification and documentation to meet the guideline.

Can I purge one project's data (Network Share) without wiping the whole pool?

Yes, if the data lives in its own encrypted network share. Each share has its own AES-256 key, so deleting the share and destroying all copies of its key is a cryptographic erase limited to that dataset. Deleting an unencrypted share is a logical deletion. The data can no longer be reached through NFS, SMB or the management interfaces, but the freed blocks remain on disk until they are overwritten so on its own it so doesn't meet Clear level. That said, the data can reach Purge or Clear level later when the pool is decommissioned.

Decommissioning Encrypted Pool

• Software encryption: delete the pool with Shred Encryption Keys selected, and destroy the pool key on any KMIP server and in every exported key backup.
• Hardware encryption (SED): run SED Instant Erase on each drive so that it discards its media encryption key. Discarding only QuantaStor's copy of the drive credentials is not a cryptographic erase.

Decommissioning Unencrypted Pool

• Clear: on HDDs, use one of the overwrite shred modes (zeros, random, DoD, NNSA or US Army) when deleting the pool or formatting the disks, or another approved overwrite utility.
• Purge: requires media that supports a cryptographic or block erase, such as Instant Secure Erase (ISE) drives, SEDs or NVMe devices. Use the SED Instant Erase or NVMe Secure shred modes.

Does deleting a file remove it from snapshots?

No. A file deleted over NFS or SMB stays in every snapshot taken while it existed. Delete those snapshots, let them expire, or delete the entire share, which removes its snapshots too.

How long does disk shredding take?

Overwrite modes write the whole device once (zeros, random) or several times (DoD, NNSA, US Army), so expect hours per large HDD. NVMe secure format and SED instant erase complete much faster because the drive discards its internal keys or blocks instead of rewriting every sector.

What evidence can I give a sponsor?

Use audit log entries for share, volume, replica and key operations, plus the Last Shred, Last Shred Mode and Shred Signature recorded on each sanitized disk. Together with your key-destruction records, these support a certificate of sanitization as described in NIST SP 800-88 (NIST SP 800-88 Rev. 1).

---

Part of the QuantaStor Guides series. For reference documentation, see the QuantaStor documentation.