When disposing of SSDs, what method is most secure?

A.  Degaussing

B.  Overwriting

C.  Physical Destruction

D.  Reformatting

Answer:  C

Explanation:
A. Degaussing
Degaussing uses a powerful magnetic field to scramble the magnetic alignment of a storage medium.

Why it fails for SSDs: Solid-State Drives (SSDs) store data using Flash Memory (NAND), which uses electrical charges in integrated circuits rather than magnetic domains on a platter. Since there is no magnetism involved in SSD storage, a degausser has zero effect on the data.

The HDD Context: Degaussing is highly effective for traditional Hard Disk Drives (HDDs) and magnetic tapes, as it destroys both the data and the drive's low-level formatting.

B. Overwriting
Overwriting involves writing patterns of 1s and 0s over existing data to hide the original bits.

The SSD Problem: SSDs use a technology called Wear Leveling. To extend the life of the drive, the controller moves data around to different physical blocks so that no single block wears out too fast.

The "Ghost" Data: When you try to "overwrite" a file on an SSD, the controller may write the new data to a fresh block and simply mark the old block as "unmapped." The old data still exists in the physical NAND cells until the "Garbage Collection" or TRIM command eventually clears it. Therefore, standard overwriting software cannot guarantee that every physical cell has been erased.

C. Physical Destruction
Physical destruction involves mechanically rendering the drive unusable and the data unrecoverable.

Why it's the Answer: Because of the complexities of flash memory, the most "failsafe" way to ensure data remains confidential is to destroy the physical chips.

The Requirement: For SSDs, standard "shredding" isn't always enough if the pieces are too large. To be truly secure, SSDs should be disintegrated or pulverized into particles no larger than 2mm, ensuring that an attacker cannot recover an intact NAND flash chip and read it using specialized laboratory equipment.

D. Reformatting
Reformatting simply clears the "table of contents" (the file system index) so the operating system thinks the drive is empty.

The Risk: The actual data remains on the drive until it is overwritten by new data. Any basic data recovery tool can "unformat" the drive and restore the original files. In a security context, reformatting is never considered a valid method for data destruction or media sanitization.

Key Takeaway for the CISSP Exam
Media Sanitization Terms (NIST SP 800-88):

• Clear: Basic software-based erasure (overwriting). Good for reuse within the same security level.
• Purge: Advanced methods (like Crypto-Erase or Secure Erase commands) that make data recovery infeasible even in a lab.
• Destroy: Physical destruction (shredding, melting, or pulverizing). Required for the most sensitive data.