Host-Side Overwrite Never Reaches Every Physical Block
Regions exist on a drive that the host cannot see: over-provisioned capacity, retired bad blocks, and superseded pages left behind by reclaim and migration. Overwriting through LBAs reaches only the physical locations currently mapped, and none of those. NVMe Sanitize is an in-drive operation whose scope is every physical block rather than the visible LBA space, which is what separates it from a format or a full-drive zero fill. A decommissioning process that stops at a host-side script leaves a residual data volume that can neither be estimated nor demonstrated to anyone.
Pick the Mode by Prerequisite First, Cost Second
Crypto Erase, Block Erase and Overwrite are not casually interchangeable. Crypto Erase carries a hard prerequisite: the drive must have been self-encrypting from its first write. A drive on which encryption was enabled partway through does not qualify, and that has to be confirmed and recorded at deployment — checking at decommissioning time is too late. Block Erase issues erase to every physical block, so cost scales linearly with capacity; with the portfolio's planned per-drive capacity ceiling of 122.88TB, that tier can only be scheduled against a full maintenance window, not in minutes. Overwrite serves compliance regimes still unsatisfied by physical erase, and it spends real program/erase endurance — if the drive will be redeployed afterwards, that consumption belongs in the remaining-life assessment.
Window Planning: After the Command, It Is No Longer a Normal Drive
While erasing, the drive exposes only a restricted command set and refuses read commands outright, so the moment of issue must be sequenced after the service is drained and the drive removed from its array, never the other way round. Power loss is a case that must be handled: the specification requires the operation to resume at the next power-on and forbids any partially readable intermediate state before completion. Firmware records progress in a region that survives power loss and resumes automatically when an unfinished state is detected on power-up. The Sanitize Status log page reports progress and final outcome, and operations scripts should gate the next step on that rather than on waiting out a fixed duration.
What Has to Be Archived Before It Counts as Evidence
A successful completion status is not proof the data is gone; the return code only says firmware believes it finished. Verification bypasses the normal read path, using engineering tooling to read physical pages directly and confirm that erased pages really are in the erased state. Raw captures and tool version from each round, together with the drive's PN and firmware revision, must be archived as one package before the record is something that can be handed over — a record without version information becomes meaningless once the batch changes. The capability sits in the enterprise feature baseline alongside TCG OPAL and Secure Boot and is being validated model by model on the engineering platform as the controller and firmware plan matures, with the process itself being finalised in the same phase.