Choosing a Sanitization Method Under Uncertainty
Short answer
Choose a sanitization method by checking its eligibility first, then comparing the remaining options under explicit uncertainty. A low estimated cost cannot make an unsupported technique suitable for a drive, satisfy a mandatory requirement or replace missing completion evidence.
When numerical inputs are defensible, compare ranges and identify the assumptions that change the decision. When they are not, keep the uncertainty qualitative and retain custody while obtaining evidence. Do not turn an unknown probability into zero just to make a spreadsheet produce a winner.
Who this is for
This article is for authorized ITAD, refurbishment and storage teams choosing between approved data-removal routes. It introduces a proposed analytical worksheet, not a sanitization standard, established physical law, certification scheme or estimate of any product's effectiveness.
Verification note: The arithmetic below is original explanatory modeling. Every probability and dollar amount in the examples is hypothetical. No drive was erased, no device logs were analyzed and no recovery experiment was performed. The worked calculation validates arithmetic only.
When to use this
Use the worksheet when two or more technically supported, policy-eligible routes remain and the reviewer needs to understand a tradeoff: extra processing, a different supported technique, investigation or approved destruction. It is also useful when a small change in an assumption reverses a proposed reuse decision.
When not to use this
Do not use it to price away a retention hold, override an owner's restriction or authorize release of media with unresolved mandatory acceptance criteria. It cannot determine whether a particular firmware implements a sanitize command correctly. It supplies no universal failure rate for HDDs, SSDs, flash chips or cryptographic erase.
NIST SP 800-88 Rev. 2, published September 2025, supersedes Rev. 1. Its sanitization assurance process separates inspection of an operation's outcome from acceptance of its adequacy. The model below does not replace that review or prescribe which clear, purge or destroy technique applies.
Put eligibility ahead of arithmetic
Before calculating anything, define the asset, target data, proposed destination and applicable requirements. Identify the media and exact supported operation, including model, firmware, processing path and required completion checks.
Treat each candidate as an entire processing route. For example, candidate A might include an approved device operation, verification and review. Candidate B might include a different supported route with additional handling. A route called “destroy” must still include its specified equipment, media treatment, custody and inspection; the word alone is not a result.
Use this short gate table:
| Gate | Question | If unresolved |
|---|---|---|
| Authority | Is data removal permitted for this asset now? | Hold the job |
| Applicability | Is the exact technique supported and suitable for this target? | Obtain scoped evidence or select another route |
| Required outcome | Does the route meet the required disposition and acceptance criteria? | Exclude it from the economic comparison |
| Evidence | Can identity, operation, completion and exceptions be reconciled? | Keep the result unresolved |
An excluded route stays excluded even if its calculated cost is attractive. If no route passes, the next task is escalation, not optimization. Distinguish missing information that can be investigated from a known incompatibility that a second review will not fix.
A proposed expected-cost model
For one defined asset and release scenario, let:
midentify a candidate route.C_mbe its incremental processing and disposition cost, in dollars per asset.p_mbe the dimensionless probability of a defined confidentiality-loss event after that route and release, over a stated assessment horizon.Lbe the expected consequence of that event, conditional on it occurring, in dollars per event.J_mbe the modeled expected total cost, in dollars per asset.
The event must be specific. “Any residual bit exists” and “an unauthorized recipient obtains protected target data within five years” are different events. Use the latter kind of operational scenario consistently if that is the decision being assessed. Do not insert a command-error rate as though it were a post-release disclosure probability.
In this simplified model, processing costs C_m occur either way. If the event does not occur, modeled total cost is C_m; if it occurs, it is C_m + L. Weighting those two outcomes gives:
J_m = (1 - p_m) C_m + p_m (C_m + L) = C_m + p_m L.
The units agree: a dimensionless probability multiplied by dollars per event gives the expected event cost for this one asset scenario. No independence between physical storage regions is assumed by this two-outcome expression. Its weakness is elsewhere: the event definition and inputs may be poorly supported.
The same L across routes is a simplifying assumption. If the consequence differs by route, replace it with a justified conditional value for each route and redo the comparison. If outcomes cannot be meaningfully represented in money, use a different decision framework; do not silently assign them a negligible price.
Include relevant handling, transport, review, lost reuse value and disposal costs consistently in C_m. Avoid counting the same lost resale value twice. A whole-organization breach consequence should not be charged independently to every drive without examining how a batch-level event is actually defined.
Derive the break-even condition
Assume A and B pass the gates, B costs more to process, the same positive L applies, and B has a lower modeled event probability. B has lower modeled expected cost when:
C_B + p_B L < C_A + p_A L.
Subtract the processing costs and divide by positive L:
p_A - p_B > (C_B - C_A) / L.
The right-hand side is a dimensionless break-even reduction in probability. It is not a measured improvement or a required sanitization confidence level.
For hypothetical costs of $40 for A and $70 for B, and a hypothetical consequence of $100,000, the threshold is 30 / 100000 = 0.0003, or 0.03 percentage points. If p_A were 0.05% and p_B 0.01%, the difference would be 0.04 percentage points. Modeled totals would be $90 and $80 respectively, favoring B under those assumptions.
This example demonstrates the inequality, not the effectiveness of two real techniques. If the probabilities lack a credible basis, the threshold tells a reviewer what would need justification; it does not supply that justification.
Compare ranges instead of convenient point estimates
Suppose the analyst can defend only an interval p_m from a_m to b_m, with 0 <= a_m <= b_m <= 1. Keep C_m fixed and L nonnegative for this calculation. Since J_m increases with p_m, its modeled interval is:
C_m + a_m L <= J_m <= C_m + b_m L.
These are sensitivity bounds implied by the inputs. They are not statistical confidence intervals unless a separate, valid statistical construction establishes that interpretation. Here the intervals are purely hypothetical scenario ranges.
| Candidate | Processing cost | Hypothetical probability range | Modeled cost range at L = $100,000 |
|---|---|---|---|
| A | $40 | 0.0001 to 0.002 | $50 to $240 |
| B | $70 | 0.00001 to 0.0001 | $71 to $80 |
B has the lower worst-case modeled cost: $80 versus $240. But A is cheaper at its favorable endpoint: $50 versus B's $71. Therefore this table does not prove B is cheaper for every admissible combination of inputs.
A reviewer may adopt the proposed conservative rule “choose the eligible route with the smallest upper modeled cost.” That rule chooses B here. It is a declared decision preference under uncertainty, not proof that B will cause fewer disclosures.
A sufficient condition for B to be cheaper throughout the full rectangular set of probability combinations is that B's upper cost is below A's lower cost. It fails here because $80 is not below $50. If the two probabilities are linked, a rectangular set may include impossible combinations; document that dependence rather than pretending the bounds describe it.
Now change only L to $10,000. A's range becomes $41 to $60, while B's becomes $70.10 to $71. A is then cheaper throughout these assumed ranges. The reversal shows why the chosen consequence, event and assessment horizon belong in the decision record.
Reproduce the arithmetic without touching a drive
This Python 3.6-or-later example uses only numeric constants and prints the hypothetical worksheet. It performs no device discovery, file writes, erase operation or network request. Its output is not a sanitization report.
python3 - <<'PY'
routes = {"A": (40, 0.0001, 0.002), "B": (70, 0.00001, 0.0001)}
for loss in (100000, 10000):
print(f"Hypothetical consequence: ${loss:,}")
for name, (cost, low, high) in routes.items():
assert 0 <= low <= high <= 1
print(f"{name}: ${cost + low * loss:.2f} to ${cost + high * loss:.2f}")
print(f"Break-even probability reduction: {(70 - 40) / 100000:.6f}")
PY
Expected numeric results are A $50–$240 and B $71–$80 in the first scenario, then A $41–$60 and B $70.10–$71 in the second. The final number is 0.000300. Decimal display rounding does not make the probability estimates precise to six places.
Workflow
1. Freeze the question and scope
Record who owns the decision, which asset and data are included, the planned disposition, assessment horizon and confidentiality-loss event. Name external copies and inaccessible regions that remain outside the claimed scope. Sampling host-visible addresses cannot establish erasure of hidden physical locations.
2. Apply the gates
Confirm authorization, hold status, media suitability and acceptance requirements before evaluating costs. Retain the support evidence for the exact model and firmware. If an irreversible operation is proposed, use its separately approved procedure and target confirmation; this worksheet contains no destructive command.
3. Separate facts from assumptions
Keep actual quotes, observed operation outcomes and documented compatibility separate from analyst judgments. For each numerical input, record its provenance, units, date and limitations. A completed command is an observation, not a calibrated disclosure probability. A qualitative label such as “low” is not automatically 0.001.
4. Calculate sensitivity and identify the disputed input
Compare intervals and compute the break-even condition. State the decision rule before picking an endpoint. If reasonable assumptions reverse the preference, show both outcomes and identify which uncertainty the reviewer needs to resolve. Do not average incompatible scenarios into one reassuring number.
5. Investigate or escalate
Ask whether a specific evidence request could change eligibility or the ranking: exact firmware documentation, a corrected asset identity or missing completion information. Set a custody location and review deadline for held assets. More time in storage does not itself sanitize them.
Avoid claiming a numerical value of information unless the possible investigation outcomes and their probabilities are modeled. A cheaper inspection is not necessarily useful if it cannot resolve the uncertainty that drives the decision. If credible probability ranges cannot be established, use an explicit qualitative assessment and the authorized escalation path.
6. Execute, verify and accept separately
After selecting an eligible route, execute its supported procedure. Reconcile actual outcomes, errors and interruptions with the acceptance criteria. Selection of a route is not completion of that route. A later failure invalidates assumptions that depended on success and requires a new disposition decision.
Verification checklist
- The same target, event and horizon are used across candidates.
- Mandatory gates are satisfied independently of the cost result.
- Numerical inputs are documented as estimates, assumptions or measurements.
- Equations have consistent units and the worked results reproduce.
- Interval endpoints are not mislabeled as confidence levels.
- The chosen rule and sensitivity reversal are visible to the reviewer.
- Actual completion evidence and the acceptance decision are attached separately.
Resale and evidence checklist
Keep the chosen route, rejected alternatives, unresolved questions, private asset linkage and reviewer approval together. Preserve revisions when new evidence changes the decision. Release only after the actual sanitization result meets the required acceptance process; a favorable expected-cost score is not a release certificate.
What not to publish
Do not publish customer identities, real device identifiers, encryption keys, raw evidence or internal loss estimates. Public examples should be synthetic and clearly labeled. Internal numbers can be sensitive even when they are estimates rather than measured losses.
Common mistakes
Errors include multiplying an ordinal risk score by dollars, treating unsupported probabilities as measured rates, assuming destruction has zero execution risk, and counting cheapness as evidence of suitability. Another error is optimizing each drive independently when a shared custody failure could affect the entire batch.
CliDeck workflow fit
A useful runbook keeps eligibility, assumptions, selected route, actual outcome and acceptance in separate fields. This is a proposed review structure, not a claim that forthcoming CliDeck wiping software calculates disclosure probabilities, supports a particular drive or certifies sanitization.
FAQ
Can this equation prove data is unrecoverable?
No. It organizes a decision under stated assumptions. It contains no physical model of data recovery and no inspection of surviving keys or inaccessible media.
Is the cheapest eligible route always acceptable?
Only if it also satisfies the required acceptance criteria after execution. The comparison cannot waive a requirement or resolve missing evidence.
What if no credible probability is available?
Say so. Use qualitative reasoning with clear evidence gaps, retain custody and obtain an authorized decision. An empty input is more honest than an invented percentage.