D3-DKE Disk Erasure: Sanitising Compromised Storage and Proving Data Is Gone

A compromised or retiring disk still holds whatever the attacker left and whatever the business stored, and deleting files or reformatting does not remove either. MITRE D3FEND names this countermeasure Disk Erasure (D3-DKE) and defines it as "the process of securely deleting all data on a disk to ensure that it cannot be recovered by any means." It sits under the Evict tactic as a child of Disk Formatting (D3-DKF), which in turn sits under Object Eviction. This card covers what D3FEND says, which erasure method fits which media, how to run it as part of incident eviction and disposal, and how to prove it worked. It is written for incident responders, endpoint and infrastructure teams and asset disposal owners; the full NIST programme view is in the Media Sanitisation Guide.

Key takeaways

• Erasure removes everything, including the attacker. D3-DKE acts on Secondary Storage: anything stored on the disk, from malware and persistence to stolen data staged for exfiltration, is gone after a successful erase.
• Method depends on the media. NIST SP 800-88 Rev. 2 says multi-pass overwriting should be avoided for certain SSDs because wear levelling and spare capacity keep data out of reach of the host; device sanitize commands or cryptographic erase are the better fit.
• Preserve evidence first. Erasure is the last step for a compromised disk, after imaging and scoping. An erased disk cannot answer questions about how the attacker got in.
• Erasure does not reach firmware. Persistence in system or component firmware survives a disk erase, so high-assurance eviction pairs erasure with firmware verification or hardware replacement.
• Proof is a record. NIST asks for verification of each sanitisation and a certificate per item recording method, tool, version and verifier.

D3-DKE at a glance

D3FEND's description reflects magnetic drive practice: several overwrite passes. Current guidance has moved on, and the method table below follows NIST SP 800-88 Rev. 2, published as final on 26 September 2025, which superseded Rev. 1 of 2014.

ATT&CK techniques D3FEND relates to D3-DKE

Relationship type: inferred only. D3FEND lists no direct ATT&CK mapping for D3-DKE. It derives relations through the shared Secondary Storage artefact and labels them "inferred, experimental" (checked November 2026). Each ID was checked against ATT&CK v20.

The parent technique, Disk Formatting, also carries inferred relations to T1561 Disk Wipe and its sub-techniques. That relation runs the other way in practice: attackers use the same erasure capability destructively. Wiper malware and abused device management wipe actions are covered in the MITRE ATT&CK T1561 Disk Wipe and Wiper Malware Guide pages.

NHI Mgmt Group view, not D3FEND: in incident response the main value of disk erasure is eviction of disk-resident persistence and removal of staged data before a device is reused, which is broader than the single inferred row above.

Choosing the erasure method

NIST SP 800-88 Rev. 2 defines three sanitisation methods. Clear uses logical techniques through the normal host interface against simple, non-invasive recovery. Purge makes recovery infeasible using state-of-the-art laboratory techniques while leaving media reusable, and NIST prefers it over Clear where possible. Destroy leaves the media unusable.

Cryptographic erase

NIST treats cryptographic erase (CE) as a Purge technique: sanitising the keys that encrypt the data so the ciphertext cannot be recovered. It is much faster than overwriting when its conditions hold. NIST sets those conditions: at least 128-bit security strength, no ECB mode, keys zeroised along with keys below them in the hierarchy, and no reliance on CE where data was stored in plaintext before encryption or where keys were backed up or escrowed without control. NCSC's guidance makes the same point for BitLocker and FileVault devices: a manufacturer factory reset that deletes the keys is generally sufficient for reuse. Apple's "Erase All Content and Settings" applies to Macs with Apple silicon or the Apple T2 Security Chip running macOS Monterey 12 or later. See D3-DENCR Disk Encryption for the encryption that makes CE possible.

Where it is implemented

Implementation steps for a compromised host

1. Decide eviction scope. Erasure is for disks where cleaning is not trustworthy: confirmed malware persistence, kernel-level tampering, or a host used for staging. Record the decision in the incident log.
2. Preserve evidence. Take a forensic image and memory capture before erasing, following the Disk Imaging and Forensic Acquisition Guide. Hash the image and record chain of custody.
3. Revoke identities on the host. Rotate machine account passwords, service account secrets, API keys and certificates that lived on the disk. Erasing the disk does not invalidate credentials the attacker already copied.
4. Select the method. Use the media table above: device sanitize or cryptographic erase for SSDs, overwrite or sanitize for magnetic disks, destroy for media you cannot sanitise reliably.
5. Erase and verify. Run the method, check the tool's completion status and the device's health, and for overwrite methods read back a sample to confirm the fixed pattern, as NCSC describes.
6. Rebuild from a trusted source. Reinstall from a known-good image and restore data only from backups checked for integrity, then rejoin the network. See D3-RDI Restore Disk Image.
7. Record and close. Complete a certificate of sanitisation and attach it to the incident and asset records.

There is no rollback for erasure. The rollback point is the forensic image and the last verified backup, so confirm both exist before step 5.

Where identity fits

Disks hold non-human identity material: machine certificates and private keys, cached service account credentials, cloud CLI profiles, kubeconfig files and CI runner tokens. Erasure removes the local copies, but the identities remain valid wherever they are trusted. Treat every secret that lived on an erased disk as exposed and rotate it, using D3-CRO Credential Rotation and D3-CR Credential Revocation.

How to verify it works

NIST SP 800-88 Rev. 2 separates verification (section 4.5.1, confirming the technique completed) from validation (section 4.5.2, deciding whether it was effective for the data and media). For logical methods, verification means checking tool completion status and device health; NIST says elaborate sampling is not needed unless policy requires it. Validation fails if parts of the media were out of reach, the method did not suit the media, staff or tools were not qualified, or the scope was too narrow, in which case sanitisation is repeated with a stronger method.

The certificate of sanitisation (section 4.6) records manufacturer, model and serial number, property number, media type and source, method and technique, tool and version, verification method, and the name, date and signature of verifiers and validators.

Limits, bypasses and failure patterns

• Firmware persistence survives: implants in system firmware (T1542.001) or component firmware (T1542.002) sit outside the erased storage. Use firmware verification or replace the hardware where that risk is credible; see D3-FV Firmware Verification.
• Overwriting SSDs as if they were hard disks: NIST warns that carrying overwrite habits to flash may leave data in areas the host cannot reach.
• Erasing before imaging: evidence of initial access, lateral movement and data theft is lost, and notification decisions become guesswork.
• Copies elsewhere: snapshots, backups, sync folders and cloud Recycle Bin retention keep data and malware after the device is clean. Restoring an infected backup reintroduces the attacker.
• Erasure as an attack: the same wipe capability is destructive in the wrong hands. In the Stryker Cyberattack 2026, a compromised administrator account issued device management wipe commands at scale; requiring a second administrator to approve destructive actions limits that risk.
• Encrypted but keys escrowed: cryptographic erase is not complete if recovery keys sit in a directory or vault; remove those as part of the erase.

Framework mapping

Practitioner checklist

• Image and hash compromised disks before any erasure.
• Rotate every credential, key and certificate that lived on the disk.
• Use device sanitize or cryptographic erase for SSDs; never rely on multi-pass host overwrite.
• Remove escrowed recovery keys as part of cryptographic erase.
• Check snapshots, backups and cloud retention rules for copies.
• Require dual approval for bulk or remote wipe actions.
• Verify completion, validate effectiveness and issue a certificate per device.
• Verify firmware or replace hardware where firmware persistence is suspected.

Standards and references

• MITRE D3FEND: Disk Erasure (D3-DKE)
• NIST: SP 800-88 Rev. 2 Guidelines for Media Sanitization
• NIST: SP 800-53 Rev. 5 Security and Privacy Controls (MP-6)
• NCSC: Secure sanitisation and disposal of storage media
• nvme-cli: nvme-sanitize documentation
• Microsoft Learn: format command
• Microsoft Learn: Intune device wipe remote action
• Apple Support: Erase All Content and Settings on Mac

Related NHI Mgmt Group resources: Media Sanitisation Guide · D3-DKF Disk Formatting · Device Reassignment and Reimaging · Wiper Attack Response Playbook · MITRE D3FEND Guide