SSD Shredding and Chip-Level Destruction

Unlike a magnetic hard drive, an SSD has no platter. Its data can reside across several NAND packages and memory dies managed by a controller. An HDD crusher or coarse shredder can make an SSD unusable while leaving data-bearing packages intact.

Enterprise buyers should define:

• SSD and flash-media types in scope
• Required Clear, Purge, or Destroy outcome
• Current controlling standard or contract
• Approved equipment
• Required output or approved procedure
• NAND-package and die acceptance criteria
• Sampling and measurement
• Reprocessing rules
• Chain of custody
• Witnessing
• Certificate fields
• Downstream handling

Organizations assigning Destroy to solid-state media can use SSD shredding services after these requirements are approved.

What Is Chip-Level SSD Destruction?

Chip-level destruction means that the process addresses the NAND flash packages and memory dies that contain data, rather than treating the complete drive as one object. It is an outcome and inspection focus, not a claim that operators manually remove every chip.

An SSD can contain:

• NAND packages
• Multiple silicon dies inside each package
• Controller
• DRAM or other cache
• Power-loss protection components
• Firmware storage
• Printed circuit board
• Enclosure or carrier

The NAND packages are the primary persistent user-data components. Controller and other nonvolatile memory may also contain metadata, keys, or configuration information relevant to the process.

Package, die, and cell are different layers

• Package: The visible component attached to the board.
• Die: A silicon piece inside the package.
• Cell: A microscopic transistor structure within the die that stores an electrical state.

Breaking the enclosure is not chip destruction. Detaching a package is not die destruction. An output specification should identify which layer the governing requirement intends to address.

Why Is SSD Destruction Different From HDD Destruction?

SSDs store data in small semiconductor components; HDDs store data across magnetic platter surfaces. Their destruction risks are different.

A mixed drive program should sort by storage technology. Form factor alone is not enough because a 2.5-inch SATA SSD can resemble a laptop HDD.

How Does SSD Data Distribution Affect Destruction?

An SSD controller distributes logical data across NAND locations and changes those locations over time. The organization usually cannot map one file to one visible chip.

SSD management features include:

• Wear leveling
• Overprovisioning
• Spare blocks
• Bad-block replacement
• Garbage collection
• Error correction
• Logical-to-physical translation
• Data striping across channels and packages

These features create two consequences:

1. Ordinary host overwriting may not reach every location that held target data.
2. Physical destruction cannot assume that breaking one package removes one file.

The process must address all data-bearing components in the device or use a validated logical technique that covers the required storage scope.

What Does NIST SP 800-88 Rev. 2 Require?

NIST SP 800-88 Rev. 2 defines Destroy by the recovery-resistant outcome and loss of media usability, not by a universal SSD particle size. It requires technology-appropriate techniques, verification, validation, and documentation.

The current NIST publication, issued in September 2025, supersedes Revision 1. NIST identifies physical destructive techniques including disintegration, pulverization, shredding, melting, and incineration.

The NIST SP 800-88 Rev. 2 PDF also warns that:

• Partial damage can leave accessible portions.
• Increasing data density and hard component materials can make destructive techniques ineffective.
• Technology-specific standards must remain current.
• Destruction verification includes inspecting remnants and identifying equipment.
• Validation must consider errors, anomalies, output, and target-data sensitivity.

NIST does not support the claim that every SSD shredder or every small-looking fragment automatically satisfies Destroy.

Does NIST Set a Universal SSD Particle Size?

No. NIST SP 800-88 Rev. 2 does not publish one particle-size requirement for every commercial SSD destruction project. The required output comes from the current technology-specific standard, agency policy, contract, equipment approval, or organizational standard.

A vendor claim such as “NIST requires 2 mm for all SSDs” confuses NIST’s outcome-based guidance with a requirement that may come from another authority.

The article How Particle Size Affects Physical Media Destruction explains how media type, authority, equipment, and measurement interact.

What Does Current NSA/CSS Guidance Say About Solid-State Media?

NSA/CSS Policy Manual 9-12 and the current Solid State Sanitization Devices Evaluated Products List apply to media and organizations within their scope. They should not be converted into a universal claim for every commercial project.

The current NSA/CSS Policy Manual 9-12, issued February 19, 2026, identifies approved solid-state sanitization procedures, including disintegration with equipment on the applicable Evaluated Products List or other listed methods.

The NSA/CSS Evaluated Products Lists are updated as needed. The applicable list and equipment model must be checked at project time.

NSA/CSS requirements for evaluated solid-state disintegrators have used a maximum edge-size performance requirement. Organizations subject to those requirements must use the current policy, list, product scope, and contract rather than a secondhand number.

Equipment listing is media-specific

A machine listed for magnetic HDD deformation is not automatically listed for solid-state sanitization. A provider should identify the exact list, machine model, supported devices, and any limitations.

“NSA certified vendor” is not the same as listed equipment

NSA/CSS evaluates products for defined purposes. Buyers should avoid converting an equipment listing into a general provider certification or universal service endorsement.

What Can Go Wrong During SSD Shredding?

The main failure is output that appears destroyed while data-bearing components remain insufficiently reduced. This can occur through equipment mismatch, sorting errors, worn components, or weak inspection.

Intact NAND packages pass through

A shredder may tear the board around a package and release it largely intact.

Packages break but dies remain intact

The external package can crack while an internal silicon die retains significant data-bearing area.

SSDs are processed as HDDs

A crusher can puncture the SSD enclosure without addressing every package.

Hybrid drives are misclassified

The magnetic portion may be degaussed or deformed while solid-state cache remains.

Small modules escape the feed path

M.2 drives, USB devices, memory cards, and embedded modules can pass through gaps or avoid cutting zones designed for larger drives.

Mixed debris hides rejected output

Chassis metal and board fragments can obscure intact memory components during visual inspection.

Equipment condition changes output

Worn cutters, damaged screens, jams, high feed rates, and incorrect configuration can affect fragment dimensions and component breakage.

Is Shredding the Same as Disintegration or Pulverization?

No. The terms describe different mechanical actions and may produce different outputs. Contracts should use the term that matches the approved technique.

• Shredding: Cuts or tears media into particles.
• Disintegration: Breaks or separates media into parts or small particles so little remains recognizable.
• Pulverization: Reduces media to powder or dust through crushing, grinding, or another mechanical process.
• Crushing: Applies force to deform or fracture media; the result can vary widely.

A provider should not relabel crushing as pulverization or use “microshredding” without defining the measured output.

Can SSD Data Be Recovered From an Intact NAND Package?

An intact or partly intact NAND package can retain data even when the original SSD no longer works. Specialized laboratories may remove packages, access dies, read raw memory, and attempt reconstruction.

Chip-level recovery can involve:

• Package removal
• Pinout or interface analysis
• Direct NAND reading
• Controller and firmware analysis
• Error-correction reconstruction
• Data scrambling reversal
• Logical translation reconstruction
• Encryption assessment

Recovery is not guaranteed. Modern controllers, encryption, error correction, proprietary layouts, missing metadata, and distributed data can make reconstruction difficult. The risk decision should not assume that an inoperable drive equals inaccessible data.

Targeted recovery and full-drive reconstruction differ

Recovering a complete SSD volume can be much harder than seeking one known record, key, or file fragment. High-value targets may justify focused effort.

Physical destruction should be validated against the recovery capability the organization is required to resist.

How Does Encryption Affect SSD Destruction?

Encryption can reduce the usefulness of recovered NAND data when the implementation is sound and every relevant key remains unavailable. It does not replace Destroy when policy assigns physical destruction.

Evaluate:

• Was encryption active before sensitive data was written?
• Did it cover all target data?
• Were keys generated and protected correctly?
• Do recovery or escrow keys exist?
• Can keys exist in another device, management platform, backup, or record?
• Was cryptographic erase completed and validated?
• Does the governing policy permit reliance on encryption?

An organization may use encryption as defense in depth while still shredding the SSD.

How Should SSD Shred Output Be Specified?

Specify SSD output by connecting the media, controlling authority, equipment, data-bearing components, measurement, and rejection criteria. “Shred into small pieces” is not auditable.

An RFP can define:

• SSD form factors in scope
• NAND, controller, and embedded-memory treatment
• Applicable policy or standard
• Approved machine model
• Maximum edge length or other output requirement where applicable
• Whether the value is nominal or maximum
• Measurement tool and method
• Sample size or full inspection requirement
• Treatment of irregular fragments
• Oversize threshold
• Reprocessing procedure
• Batch-isolation rule
• Evidence to retain

Do not copy an HDD platter requirement into an SSD specification.

How Is Chip-Level Destruction Verified?

Verification must inspect the data-bearing fragments and confirm the equipment used. Looking only at enclosure metal does not establish NAND destruction.

A verification procedure can include:

1. Confirm machine identity and configuration.
2. Confirm the input is solid-state media supported by the machine.
3. Process a controlled test item when required.
4. Collect output according to the approved sampling method.
5. Identify NAND-package, die, board, and controller-related fragments.
6. Measure applicable dimensions.
7. Record intact or oversize components.
8. Isolate the affected batch.
9. Reprocess rejected material.
10. Validate the final result.

Nominal and maximum output are different

A nominal figure describes expected output. A maximum requirement sets an acceptance boundary. The contract should state which applies.

Sampling must focus on data-bearing material

A sample dominated by steel and aluminum can pass while intact NAND remains elsewhere. The method should deliberately look for semiconductor components.

What Does Validation Add?

Validation decides whether the verified output adequately protects the target data. It should consider more than fragment measurement.

Inputs include:

• Data classification
• Required method
• SSD technology and form factor
• Equipment approval
• Output measurements
• Intact packages or dies
• Errors, jams, and anomalies
• Encryption and key status
• Custody events
• Intended downstream destination

If the result is rejected, the organization can:

• Reprocess the output
• Change equipment
• Change technique
• Escalate to another approved destruction method
• Investigate a larger batch

A rejected result should never be released for recycling based on schedule pressure.

How Should Mixed Solid-State Media Be Handled?

Sort devices by physical format and storage architecture before processing. A machine that accepts a 2.5-inch SSD may not accept every M.2 module, phone, SIM, USB drive, memory card, or enterprise carrier.

Create separate routes for:

• 2.5-inch SATA SSDs
• U.2 and U.3 enterprise SSDs
• M.2 SATA and NVMe modules
• PCIe add-in cards
• SAS SSDs
• USB flash drives
• SD and microSD cards
• Embedded eMMC and UFS
• Mobile devices
• Circuit boards with soldered flash
• Hybrid drives

Whole-device processing must account for batteries, displays, capacitors, and other safety hazards. Some products require disassembly before the storage component enters approved equipment.

Should SSDs Be Shredded On-Site or Off-Site?

Use on-site SSD shredding when unsanitized flash media cannot leave the client site and suitable solid-state equipment can be deployed there. Use off-site processing when an approved facility provides the required equipment and custody controls.

On-site factors include:

• Mobile-equipment capability
• Power and space
• Noise and dust
• Battery and device preparation
• Witnessing
• Output inspection
• Reprocessing capability

Off-site factors include:

• Sealed transport
• Receiving reconciliation
• Secure storage before processing
• Facility equipment
• Witness access
• Exception retention
• Downstream processing

The location comparison On-Site vs. Off-Site Data Destruction provides a custody-based framework.

What Chain-of-Custody Controls Are Required?

Control SSDs from disposition release through validated destruction and remnant transfer. Small flash devices are easy to conceal, misplace, or miscount.

Controls can include:

• Serial-number and asset-tag capture
• Model and form-factor identification
• Locked containers
• Tamper-evident seals
• Container-level counts
• Restricted staging
• Dual-person transfers
• Tracked transport
• Receiving reconciliation
• Processing-zone access logs
• Exception isolation
• Final batch reconciliation

A chain-of-custody process records possession. It does not replace destruction verification.

What Should the Certificate Record?

The certificate should state the actual solid-state technique, equipment, result, and disposition. A generic “hard drive destroyed” line can conceal an HDD-versus-SSD method error.

The Certificate of Destruction or supporting report can include:

• Client and project
• Asset and serial number
• Manufacturer and model
• SSD form factor
• Source system
• Data classification
• Destroy method
• Shred, disintegrate, pulverize, or other technique
• Equipment make and model
• Output requirement
• Verification method and status
• Validation decision
• Operator, witness, date, and location
• Exceptions and reprocessing
• Final handling of remnants

For classified or contract-controlled work, add the fields required by the applicable program.

How Should Procurement Evaluate an SSD Destruction Provider?

Evaluate media identification, machine capability, output evidence, custody, exception handling, and downstream control. A provider that owns an HDD shredder may not be equipped for SSDs.

Ask:

1. Which SSD and flash form factors are accepted?
2. How are HDDs, SSDs, and hybrids separated?
3. Which equipment processes each format?
4. What current authority supports the equipment and output?
5. How are NAND packages and dies addressed?
6. What does the stated particle size mean?
7. How is output measured?
8. What sampling plan is used?
9. What happens to intact or oversize components?
10. How are jams and equipment changes recorded?
11. Can destruction be witnessed?
12. Which asset-level fields appear in reports?
13. How are mixed devices and batteries handled?
14. Where do remnants go after validation?
15. Which downstream processors receive material?

Request a sample report and a demonstration using representative media before contract approval.

Which SSDs May Be Better Candidates for Logical Sanitization?

Operational SSDs intended for approved reuse may be candidates for a supported device sanitize command or cryptographic erase. Physical destruction eliminates reuse value.

A logical route requires:

• Known SSD model and firmware
• Supported command
• Defined storage scope
• Tool compatibility
• Successful completion
• Error and anomaly review
• Validation
• Approved release destination

Simple overwriting may not address every prior NAND location. Degaussing has no effect. The guide Why Degaussing Does Not Work on SSDs explains the method mismatch.

Failed, unsupported, unknown, or Destroy-assigned SSDs should follow the approved physical route.

SSD Shredding and Chip-Level Destruction: Decision Framework

Use a chip-focused destruction process when the assigned outcome is Destroy. The process must address NAND and other persistent memory, not only device usability.

Apply this sequence:

1. Confirm ownership, retention, and legal-hold release.
2. Identify SSD model, form factor, and embedded storage.
3. Assign Clear, Purge, or Destroy.
4. Decide whether reuse is permitted.
5. Identify the current controlling standard or contract.
6. Select solid-state equipment approved by the organization.
7. Define component and output requirements.
8. Establish chain of custody.
9. Process SSDs separately from magnetic HDDs.
10. Inspect data-bearing fragments.
11. Isolate and reprocess rejected output.
12. Validate against target-data sensitivity.
13. Reconcile assets.
14. Complete the certificate and exception record.
15. Control remnants through downstream recovery or disposal.

Data Destruction Inc. provides SSD shredding, on-site data destruction, and witnessed destruction for approved enterprise projects. The scope defines SSD formats, equipment, output, observation, verification, evidence, and downstream handling before processing begins.

Frequently Asked Questions

Request an SSD Destruction Assessment

Provide SSD formats, models, quantities, condition, data classification, service location, governing requirement, witnessing needs, and evidence fields. Data Destruction Inc. will review the scope and identify suitable destruction options.

Request an SSD Shredding Quote

Call: (866) 850-7977

Sources

1. National Institute of Standards and Technology, NIST Special Publication 800-88 Revision 2, Guidelines for Media Sanitization, September 2025.
2. National Institute of Standards and Technology, NIST SP 800-88 Rev. 2 PDF, Sections 3.1.3, 4.5, and Appendices A and B.
3. National Security Agency and Central Security Service, NSA/CSS Policy Manual 9-12, Storage Device Sanitization Manual, February 19, 2026.
4. National Security Agency, NSA/CSS Evaluated Products Lists, current lists accessed July 17, 2026.
5. National Security Agency and Central Security Service, Requirements for Solid State Disintegrators, May 2021.