Open almost any disk utility, ask it to erase a drive, and it will offer you a menu of thoroughness. One pass of zeros. Three passes. Seven passes, usually labelled "DoD 5220.22-M". Thirty-five passes, labelled "Gutmann". The implication is that the higher numbers are for people who are serious.
The seven-pass option is named after a requirement that the US Department of Defense removed in 2006. It has been a menu item for twenty years longer than it has been a rule.
What the standard actually said
The document that replaced the DoD matrix is NIST Special Publication 800-88, "Guidelines for Media Sanitization". Revision 1, published December 2014, is unambiguous about magnetic disks:
"For storage devices containing magnetic media, a single overwrite pass with a fixed pattern such as binary zeros typically hinders recovery of data even if state of the art laboratory techniques are applied to attempt to retrieve the data."
Its per-media tables say the same thing operationally. For ATA hard drives the Clear procedure is "at least a single write pass with a fixed data value, such as all zeros", with the note that "multiple write passes or more complex values may optionally be used". For the stronger Purge level using the drive's own overwrite command, "a single write pass should suffice to Purge the media".
⚠️ Read "at least" carefully. NIST permits extra passes; it simply stops treating them as necessary. Nothing in the document says a seven-pass wipe is harmful or wrong, which is worth saying plainly because the opposite claim circulates too.
Where the seven passes went
The number came from a sanitization matrix in the National Industrial Security Program Operating Manual, the DoD manual numbered 5220.22-M. That matrix is gone, and NIST records when:
"The U.S. Department of Defense (DoD) Manual 5220.22, or National Industrial Security Program Operating Manual (NISPOM), is now Part 117 of Title 32, Code of Federal Regulations. In 2006, DoD removed overwriting specifications from NISPOM."
The manual later became federal regulation outright, published at 85 FR 83312 on 21 December 2020. That rule is 395 kilobytes of text about industrial security, and it contains no overwrite count at all: searching it for "overwrit" in any form returns nothing, and so does searching for "800-88".
⚠️ One trap for anyone repeating this. The string "5220.22" does appear in the current regulation, five times — but every occurrence refers to DoD Instruction 5220.22, the instruction that establishes the security program, not to the manual's deleted wipe table. "5220.22 appears nowhere" would be false. The overwrite specification is what is absent.
The version everyone cites was itself withdrawn
There is a second layer to this, and it is more recent than most of the advice quoting it.
NIST SP 800-88 Revision 1 — the source of the single-pass sentence above, and the document nearly every vendor page cites — was withdrawn on 26 September 2025. The PDF at its own canonical address now opens with a withdrawal notice saying it is "withdrawn and superseded in its entirety" by Revision 2.
Revision 2 drops the per-media appendix tables and defers to IEEE 2883 and to NSA policy for the device-level detail. The sentence quoted at the top of this piece does not appear in it; the phrase "single overwrite pass" occurs zero times. What Revision 2 does carry is a change log entry stating the position directly:
"The 'clear' method was clarified such that multi-pass overwrite is not needed. This counters the obsolete DoD 5220.22-M language that mandates a certain number of overwrite passes and patterns."
So the honest citation is a pair. Revision 1 section 2.4 is where the single-pass finding was stated for magnetic media, as the 2014 position. Revision 2's change log is where the same conclusion stands today, in the current document.
What the author of the 35-pass method says about it
The thirty-five-pass option comes from a 1996 paper by Peter Gutmann on recovering data from magnetic media. He later added an epilogue to it, and he is blunt: the method has been adopted as "a kind of voodoo incantation to banish evil spirits" rather than as the technical analysis it was.
His argument is that the 35 passes were never meant to be run together. They are the union of the patterns needed for every encoding scheme in use at the time, back to drives thirty years older than the paper. A drive using one encoding needs only the passes for that encoding, never all of them — and the drives the paper described no longer exist.
⚠️ He does not endorse the single pass either. His position is that a few passes of random data is the most that can be usefully done on a modern drive, which supports "35 is pointless" rather than "one is enough". Conscripting him into the single-pass case misrepresents him.
Where this stops being true
Everything above is scoped to magnetic media, and the scoping is explicit in the source — the NIST sentence begins "for storage devices containing magnetic media". On flash it does not carry over.
A solid-state drive decides for itself which physical cells a logical block lives in. Wear levelling spreads writes across the device and over-provisioning holds capacity the operating system cannot address at all, so an overwrite aimed at a logical block may leave the previous physical copy intact and unreachable by the same interface that wrote it. Revision 2 warns that users who carried overwrite habits forward as media changed can be "exposing their data to increased risk of unintentional disclosure".
The replacement on flash is not more passes. It is the drive's own sanitize command, or cryptographic erase — destroying the key that the drive encrypts everything with, which renders the ciphertext unrecoverable in one operation regardless of where the cells physically are.
⚠️ Cryptographic erase is where the phrase "three passes" genuinely does appear in Revision 1, once, and it is worth naming because it is quotable out of context: "Key Sanitization Technique: Three passes with a pattern that is inverted between passes." That is about overwriting the media encryption key, a few hundred bits, not about user data.
What this does not mean
It does not mean a seven-pass wipe fails. It takes seven times as long as the evidence supports and destroys the data either way.
Nor does it mean overwriting is the right answer for classified material, or for a drive that is already failing. If a drive cannot reliably accept writes, an overwrite cannot be verified as having happened, and verification is a requirement in its own right in both revisions. Physical destruction exists for the cases where nothing else can be confirmed.
What to do with it
For a magnetic hard drive being sold, donated or returned, one overwrite pass is the supported answer, followed by a check that the pass actually completed.
For an SSD or any flash storage — which now means most laptops, every phone, every memory card — the question is different rather than easier. Use the manufacturer's secure-erase or sanitize function, or a factory reset on a device that encrypts by default, and treat the number of passes as irrelevant, because the interface you would be passing over is not addressing the cells you are trying to clear.
If a utility offers you "DoD 5220.22-M (7 passes)", that label is describing a document that stopped specifying passes before the utility was written.
Where this comes from
The quoted magnetic-media sentence is NIST SP 800-88 Revision 1, section 2.4, December 2014, with the procedural wording from its Appendix A tables for ATA hard drives. The withdrawal notice, the change-log line and the flash warning are from NIST SP 800-88 Revision 2, published 26 September 2025. The regulation searched is Title 32 CFR Part 117, source note 85 FR 83312, 21 December 2020, retrieved as its full published text. The Gutmann quotations are from the epilogue to "Secure Deletion of Data from Magnetic and Solid-State Memory", originally presented at the Sixth USENIX Security Symposium in 1996.
⚠️ The counts are from those same files rather than from a search engine. "Areal density" occurs zero times in either NIST revision — which matters, because the density argument is frequently attributed to NIST and it is Gutmann's, not theirs. Controls on the same documents: "sanitization" 389 times in Revision 1 and 401 in Revision 2, "Clear" 106, "Purge" 92. In the regulation, "overwrit" zero against "contractor" 814 and "classified" 862. The documents were searched, not merely unreachable.
View author profile → · Editorial policy
