Frequently Asked Questions
Answers about sanitization documentation, NIST 800-88 compliance, and how DestructLog works.
What is a sanitization record?
A sanitization record is a document that lists each storage asset by serial number, the sanitization method used, the date, and who performed or verified the work. ITAD providers and internal IT departments use these records as evidence for auditors and clients that media were sanitized according to policy and the NIST 800-88 standard.
What does NIST SP 800-88 require for documentation?
NIST SP 800-88 Rev. 1 (Guidelines for Media Sanitization) defines three sanitization categories — Clear, Purge, and Destroy — and provides a decision matrix mapping which methods apply to each media type. The standard expects documentation that records which sanitization category was used, what technique was applied, on what media type, who verified it, and when. A record that names only "sanitized" without specifics does not satisfy what an auditor looks for.
What is the difference between Clear, Purge, and Destroy?
Clear (overwrite) applies basic rewrite of addressable storage locations. It is effective for magnetic HDDs and tape but not for SSDs or flash devices due to wear-leveling algorithms. Purge includes overwrite with verification, degaussing, cryptographic erase, and block erase — methods designed to resist laboratory recovery. Destroy makes the media physically unusable through shredding, disintegration, pulverization, or incineration. The standard specifies which methods apply to which media types.
Does DestructLog verify that drives were actually sanitized?
No. DestructLog documents what the operator enters into the tool. It does not connect to any hardware, perform any verification, or certify that sanitization actually occurred. The document includes a disclaimer stating this explicitly. Verification is a separate operational step that must be performed by the organization issuing the documentation.
Is my asset data stored anywhere?
DestructLog processes data server-side through its API. The CSV text you send is parsed, validated, and returned as a sanitization record in a single request-response cycle. No account is required, and the submitted data is not stored, logged, or retained after the response is delivered. DestructLog has no database or persistent storage layer.
What format should my asset list be in?
DestructLog accepts CSV (comma-separated), TSV (tab-separated), and pipe-delimited formats. Column headers are matched flexibly — for example, "serial number", "serial#", "asset id", and "asset tag" all map to the serial_number field. The required columns are serial_number, media_type, and method. Optional columns are make_model, date, and verifier. See how DestructLog works for details.
What media types does DestructLog support?
DestructLog supports all media types defined in NIST SP 800-88 Rev. 1: HDD (hard disk drives), SSD (solid state drives), magnetic tape, optical discs (CD/DVD/BD), flash drives/USB, floppy disks, paper media, and mixed media assemblies that require disassembly per component.
What is an ITAD sanitization record?
An ITAD sanitization record is issued by an IT asset disposition vendor to document that retired IT equipment has been sanitized. ITAD providers use these records as evidence for their clients and for auditors. The record documents which assets were processed, by what method, and when. DestructLog generates documentation that meets the per-asset specificity auditors expect.
Can I use DestructLog for compliance auditing?
DestructLog produces a numbered document with per-asset detail and NIST citations that can be used as part of your documentation for audits and compliance reviews. However, it is a documentation tool — the actual sanitization verification must be performed by your organization. The document states what was entered, not what was verified independently.