How Particle Size Affects Physical Media Destruction

For enterprise buyers, the decision is not “smaller is always compliant.” The correct questions are:

• Which media are being destroyed?
• Where is the target data physically stored?
• Which sanitization method is required?
• Which current authority or contract controls the output?
• Is the equipment approved for that media type?
• How will remnants be inspected and rejected results reprocessed?
• What documentation will connect the media to the destruction event?

NIST Special Publication 800-88 Revision 2 does not publish one universal particle-size table for HDDs, SSDs, optical media, tape, and paper. It defines Destroy as an outcome, warns that data density and hard component materials can make destructive techniques ineffective, and directs organizations to current technology-specific standards. Organizations handling classified media may also need to follow the current NSA/CSS Policy Manual 9-12 and applicable Evaluated Products Lists.

Teams planning an enterprise destruction project can use hard drive shredding services or SSD shredding services only after the media and output requirement are defined.

Why Does Particle Size Matter in Physical Media Destruction?

Smaller fragments reduce the amount of intact data-bearing material available for analysis, reconstruction, or component reuse. Fragment size matters because storage media record data on different physical structures, including magnetic platter surfaces, NAND flash packages, optical layers, magnetic tape, and printed fibers.

The security value of a fragment depends on more than its longest edge. Relevant factors include:

• Whether the fragment contains data-bearing material
• Whether the storage layer remains intact
• Data density on the remaining surface or chip
• Shape and thickness of the fragment
• Whether fragments from one asset remain together
• Whether encryption protected the data before destruction
• Whether the attacker knows the media format and target data
• Laboratory equipment and skill available to the attacker
• The number of fragments that must be located and reconstructed
• Whether the approved authority sets an equipment or output requirement

A small piece of drive housing may contain no data. A similar-sized piece of NAND flash can contain part of a memory die. Particle size must therefore be connected to the media’s data-bearing component.

Does NIST SP 800-88 Rev. 2 Specify a Required Shred Size?

NIST SP 800-88 Rev. 2 does not prescribe one universal shred size for all information storage media. It defines Clear, Purge, and Destroy, describes destructive techniques, requires verification and validation, and directs organizations to current technology-specific standards such as the IEEE 2883 series.

The current NIST publication, issued in September 2025, supersedes Revision 1. NIST defines Destroy as a method that makes target data recovery infeasible against advanced laboratory capabilities and leaves the media unable to store data.

NIST identifies several destructive techniques:

• Disintegration: Separates media into component parts or particles.
• Pulverization: Reduces media to powder or dust through crushing, grinding, or another mechanical process.
• Shredding: Cuts or tears media into small particles.
• Incineration: Burns media to ash.
• Melting: Liquefies media through heat.

NIST also warns that bending, cutting, drilling, shooting, or other partial damage can leave accessible portions. As data density and material hardness increase, a destructive technique that worked for older media may not satisfy a current requirement.

NIST focuses on outcomes and assurance

The NIST SP 800-88 Rev. 2 PDF requires organizations to verify whether a technique completed and validate whether the target data was effectively sanitized.

For destructive methods, verification includes:

• Inspecting the remnants
• Identifying the equipment used
• Comparing output with the approved requirement
• Identifying errors or anomalies
• Reprocessing or escalating when the result is rejected

A vendor statement such as “NIST-sized particles” is incomplete unless the vendor identifies the exact source, media type, required outcome, equipment, and verification criteria.

How Does the Current NSA/CSS Policy Affect Particle-Size Decisions?

NSA/CSS Policy Manual 9-12 applies to NSA/CSS elements, contractors, personnel, and storage devices within its scope. It provides media-specific procedures and points users to current NSA/CSS Evaluated Products Lists for approved equipment.

The current NSA/CSS Policy Manual 9-12 was issued on February 19, 2026. It replaced older versions and reflects changes in magnetic HDDs, hybrid drives, heat-assisted magnetic recording drives, and solid-state devices.

Magnetic HDDs do not use one general particle-size rule

For magnetic HDDs within the NSA/CSS policy scope, the current manual allows defined procedures that include:

• Degaussing with listed equipment followed by physical platter deformation
• Disintegration using equipment approved for HDDs
• Incineration at the specified temperature
• Other methods identified in the applicable Evaluated Products List

The manual does not establish a general commercial rule that every magnetic HDD must be shredded to 2 mm. It emphasizes correct drive identification, listed equipment, degaussing where applicable, platter deformation, and approved procedures.

Hybrid HDDs require separate treatment of magnetic and solid-state components

A hybrid drive can contain magnetic platters and solid-state memory. The current policy requires procedures that address both storage technologies. Degaussing the magnetic component does not sanitize flash memory on the circuit board.

An organization must identify hybrid drives before selecting a particle-size or destruction process. Treating every 2.5-inch or 3.5-inch drive as a standard magnetic HDD can produce a method mismatch.

Solid-state devices rely on approved disintegration equipment

For solid-state devices within NSA/CSS scope, the current manual requires an approved solid-state sanitization device or another listed procedure. It does not support a general rule that any shredder producing a nominal marketing size is acceptable.

The governing issue is whether the listed equipment and approved procedure address the media type. A commercial statement about 2 mm output should be checked against the current policy, applicable Evaluated Products List, device category, and contract.

HAMR drives require special identification

The 2026 manual states that heat-assisted magnetic recording HDDs may require a different sanitization method. For the current policy scope, incineration is identified for HAMR drives unless an applicable Evaluated Products List provides another approved method.

This is a material procurement issue. Drive labels, model data, purchase dates, and manufacturer information may be necessary before an organization approves shredding or degaussing.

How Does Particle Size Affect Magnetic Hard Drive Destruction?

Magnetic HDD risk depends on how much platter surface remains intact, not the size of housing fragments. Hard drives store data in magnetic patterns on one or more rigid platters. A destruction process must address those platter surfaces.

An industrial shredder can produce a mixed output containing:

• Chassis metal
• Circuit-board fragments
• Motor components
• Read/write head assemblies
• Spindle parts
• Platter fragments
• Fasteners and other non-data-bearing pieces

A provider that measures only the largest piece in the output can miss the more relevant question: what happened to the data-bearing platters?

Platter material changes the destruction result

HDD platters may use aluminum, glass, or other substrates with magnetic coatings. These materials break differently:

• Aluminum platters may bend, tear, or shear.
• Glass platters may fracture into irregular pieces.
• Coatings can remain on intact areas even when the drive no longer operates.
• A puncture can damage one region while leaving other platter areas intact.

For this reason, a specification should address the media and not only the drive enclosure.

Smaller fragments can raise recovery cost without proving compliance

Reducing platter size generally decreases intact area and increases the difficulty of locating, orienting, reading, and reconstructing relevant fragments. That does not mean a vendor can convert any measured particle size into a universal recovery guarantee.

Recovery feasibility also depends on:

• Areal density
• Track and sector geometry
• Fragment contamination
• Surface scoring
• Heat or magnetic damage
• File-system distribution
• Encryption
• Whether the attacker seeks one record or a complete volume
• Laboratory capability

Enterprise policy should define an accepted outcome and authority rather than claim that one arbitrary size makes recovery impossible under every condition.

Organizations deciding between methods can compare hard drive shredding, degaussing, and crushing before approving an HDD destruction specification.

How Does Particle Size Affect SSD and Flash Destruction?

SSD destruction requires attention to NAND packages, memory dies, controllers, and other components that can retain data. Flash storage does not use magnetic platters, so degaussing has no sanitization effect.

An SSD enclosure can be reduced to small pieces while one or more NAND packages remain largely intact. A standard HDD shredder may deform the board without reducing every memory package to the required output.

SSDs store data across several physical and logical layers

SSD recovery risk involves:

• NAND flash packages
• Memory dies inside each package
• Controller behavior
• Wear leveling
• Overprovisioned areas
• Spare blocks
• Error-correction data
• Encryption keys and controller metadata

Particle size should therefore be connected to chip and die destruction, not only to the dimensions of the complete device.

Mixed HDD and SSD loads create process risk

A destruction project that mixes HDDs and SSDs can fail if the equipment is approved only for one media type. Common control failures include:

• SSDs pass through gaps designed for larger HDD components.
• Memory packages detach without being reduced.
• Hybrid drives are treated as magnetic-only devices.
• Asset records identify the enclosure but not the storage technology.
• Operators assume a completed shred cycle sanitizes every item in the batch.

A project should separate magnetic HDDs, SSDs, hybrid drives, tapes, optical media, and complete devices before processing. Buyers can review SSD shredding and chip-level destruction when defining a flash-media process.

How Does Particle Size Affect Tape, Optical Media, and Paper?

Tape, optical media, and paper use different recording surfaces and require different output rules. A specification written for an HDD should not be copied into a tape, disc, or paper contract.

Magnetic tape

Magnetic tape stores data along a flexible magnetic coating. Destruction must address the tape itself, not only the cartridge. A cartridge can be broken while long sections of tape remain readable with suitable equipment.

For classified magnetic tape within NSA/CSS scope, the current Policy Manual 9-12 identifies approved methods, including listed degaussing, disintegration to the stated nominal output, or incineration. Other organizations should use the authority and policy that governs their tape inventory.

Optical media

CDs, DVDs, and Blu-ray discs store data in optical layers. Degaussing has no effect. Breaking a disc into several large pieces can leave sections of the recording layer intact. The approved procedure must address the optical layer and use equipment suited to that media.

Paper and printed records

Paper particle requirements concern readable text and document reconstruction rather than electronic recovery. Government programs may specify cross-cut dimensions or disintegrator screens for paper. Those requirements must not be presented as HDD or SSD specifications.

The particle-size number has meaning only when it is connected to the correct media and authority.

Is Smaller Particle Size Always Better?

Smaller output can reduce intact data-bearing area, but it also affects processing time, equipment wear, energy use, safety, throughput, downstream sorting, and cost. An organization should select the smallest output required by its policy and authority, not an unsupported number chosen for marketing.

Security benefit

A smaller fragment can:

• Reduce intact recording area
• Increase the number of fragments required for reconstruction
• Increase mixing and orientation difficulty
• Damage more of the storage layer
• Reduce the chance that a complete component survives

Operating cost

Finer destruction can also:

• Reduce throughput
• Increase equipment maintenance
• Require several processing stages
• Increase dust and containment needs
• Increase noise, heat, and power demand
• Require different downstream recovery equipment
• Increase service time and project cost

Environmental effect

Physical destruction prevents device reuse. Finer output may also make material separation more difficult. An organization should consider whether a validated Clear or Purge method can preserve reuse when policy permits it.

NIST SP 800-88 Rev. 2 directs organizations to consider confidentiality risk together with cost, environmental impact, available tools, personnel, and time. Destroy should not be selected only because it is visible.

How Should an Organization Specify Particle Size in an RFP?

An RFP should connect output requirements to media, authority, equipment, verification, and evidence. A line stating “shred all drives to small particles” does not define an auditable result.

Define the media inventory

Require the bidder to identify:

• Magnetic HDDs
• Hybrid HDDs
• HAMR drives
• SSDs and NVMe drives
• USB devices and memory cards
• Magnetic tape
• Optical media
• Complete devices with embedded storage

Model-level identification may be required when technology affects the approved method.

Name the controlling authority

State whether the project follows:

• NIST SP 800-88 Rev. 2
• A current IEEE 2883-series standard
• NSA/CSS Policy Manual 9-12
• An NSA/CSS Evaluated Products List
• Agency policy
• A customer contract
• An internal media-sanitization standard

Do not combine these authorities into an invented phrase such as “NIST and NSA particle standard.”

Define the output

A usable specification can identify:

• Maximum nominal edge length
• Screen size
• Platter deformation requirement
• Chip or package reduction requirement
• Disintegration or pulverization method
• Permitted tolerance
• Sampling method
• Reprocessing threshold
• Treatment of oversize fragments

The organization should use measurements provided by the controlling authority. It should not invent precision where the authority requires approved equipment rather than a general size.

Require equipment evidence

Request:

• Equipment make and model
• Media types approved for the machine
• Applicable listing or evaluation
• Maintenance record
• Calibration or operating checks
• Screen or cutter configuration
• Throughput range
• Operator procedure
• Safety and containment controls

Define verification

The contract should state:

• Who inspects the remnants
• How samples are selected
• Which measuring tool is used
• How irregular fragments are measured
• What counts as an oversize result
• Whether platter, chip, and housing fragments are evaluated separately
• When a batch must be reprocessed
• How failed results are recorded

Define documentation

The Certificate of Destruction and project record can include media type, method, technique, equipment, date, location, verification result, operator, witness, and exception status. A chain-of-custody record should account for assets before destruction.

How Should Particle Size Be Verified?

Particle-size verification should follow a written sampling and acceptance method that reflects the media and governing requirement. Visual inspection alone may not detect intact NAND packages, large platter areas, or tape segments hidden in mixed debris.

A verification procedure can include:

1. Confirm the equipment and configuration before processing.
2. Separate test media or collect a defined sample from the output.
3. Identify data-bearing fragments within the sample.
4. Measure each applicable dimension using the approved method.
5. Record oversize fragments and equipment anomalies.
6. Reprocess rejected output.
7. Validate the final result against the confidentiality requirement.
8. Record the decision and responsible personnel.

Nominal size is not the same as every-particle size

Equipment may be described by cutter width, screen size, nominal output, or maximum edge length. These terms are not interchangeable. A nominal value describes an expected range, while a maximum value sets an acceptance boundary.

Procurement teams should ask the vendor to define what its stated particle size means and how it is measured.

Batch verification must address mixed media

A sample that contains mostly chassis metal does not prove that every NAND package or platter fragment met the requirement. Verification must focus on data-bearing components.

What Common Particle-Size Claims Should Buyers Reject?

Buyers should reject claims that use a particle-size number without naming the media, authority, equipment, and verification method. These claims create apparent precision without proving the required outcome.

Question statements such as:

• “NIST requires all drives to be 2 mm.”
• “Any 6 mm shred is NSA approved.”
• “One-inch HDD pieces cannot contain recoverable data.”
• “The shredder destroys HDDs and SSDs the same way.”
• “A completed machine cycle proves every drive was sanitized.”
• “Smaller particles automatically make the provider compliant.”
• “Particle size alone replaces chain of custody.”

A defensible claim states the media, applicable authority, approved equipment, output, inspection, and validation decision.

Which Particle Size Should Your Organization Require?

Require the output specified by the current authority, contract, approved equipment listing, and internal risk decision for the exact media in scope. Do not apply one number across magnetic HDDs, hybrid drives, SSDs, tape, optical media, and paper.

Use this decision sequence:

1. Identify the storage technology.
2. Identify the data-bearing component.
3. Assign the required sanitization method.
4. Identify the current controlling authority.
5. Select equipment approved for the media.
6. Define the required output or approved procedure.
7. Define sampling, measurement, rejection, and reprocessing.
8. Document the equipment, result, validation, and custody.
9. Recheck the authority when equipment or storage technology changes.

Data Destruction Inc. provides hard drive shredding, SSD shredding, and media shredding services for approved enterprise projects. The project scope defines the media, equipment, output, witnessing, verification, and evidence before processing begins.

Frequently Asked Questions

Request a Media and Output Assessment

Provide the media types, quantities, data classification, service location, required authority, witnessing needs, and evidence requirements. Data Destruction Inc. will review the scope and identify suitable service options.

Request a Data Destruction Quote

Call: (866) 850-7977

Sources

1. National Institute of Standards and Technology, NIST Special Publication 800-88 Revision 2, Guidelines for Media Sanitization, September 2025.
2. National Institute of Standards and Technology, NIST SP 800-88 Rev. 2 PDF, Sections 3.1, 4.5, 4.6, and Appendix A.
3. National Security Agency and Central Security Service, NSA/CSS Policy Manual 9-12, Storage Device Sanitization Manual, February 19, 2026.
4. National Security Agency, Media Destruction Guidance and Evaluated Products Lists.