What certified data destruction means for memory cards

A certificate of erasure is a claim about a specific object on a specific date. Its value depends entirely on whether the claim can be checked. This is what goes into ours, and why.

The three levels

NIST 800-88, the sanitisation guideline that auditors and contracts point at, names three levels. Clear overwrites every block the card lets you address and reads it back. Purge goes further, reaching the spare and remapped blocks inside the flash that an overwrite cannot, either by the controller’s own erase command or by cryptographic erase where the card supports it. Destroy is physical.

On memory cards, Clear is always achievable on a card that accepts writes. Purge is achievable only when the controller honours its erase command and a blank read-back proves it. Many consumer controllers acknowledge the command and quietly mark blocks as discarded instead. We attempt Purge on every card and record which level the evidence supports. A certificate that says Purge without a blank read-back is not one we would issue.

What a certificate has to contain

• The card’s identity from its own registers: manufacturer ID, product name, serial number and manufacture date, read from the card, not from the label. This is what ties the certificate to the object.
• The method and the level reached, with the verification result: how many bytes were read back and compared.
• Date, operator and the batch it was processed in, so the record can be found again.
• A chain of custody from receipt to return or destruction.

A registered serial number is the anchor. Where a card’s registers cannot be trusted, for example a counterfeit with a cloned or blank identity, we tag the physical card with our own asset number, photograph it, and certify the process against that tag. The certificate then says what was done to that object; it does not vouch for what the object claims to be.

Which cards can be certified for what

Erasure is about the data. It can be certified on any card that reads and writes, whatever it is. Recertification for reuse is about the card: its identity, its wear counters and its provenance. That is only possible on industrial parts whose controllers expose health data and whose identity holds up. Consumer cards, and any card with a cloned or invalid identity, get a certificate of erasure or of destruction, never a health certificate.

What we do

Cards arrive under a chain of custody, are identified by their registers, erased on a line that runs the overwrite and read-back across many cards in parallel, put through the Purge attempt, and returned with a certificate each and a manifest for the batch. Cards that cannot be erased with evidence are destroyed with evidence. Our certificates cite NIST SP 800-88 Revision 2. See the service or ask for a quote.