::
You can sanitize the firmware by doing a wipe event from the bootloader (technical, requires TrezorCTL). But sanitizing the hardware may be a bit more difficult. It is VERY difficult to create tampered HW that the stock FW will run on, so sanitizing FW is likely far enough. But if your hyper-paranoid, all I can recommend is:
1. [Inspect the HW](https://wiki.trezor.io/Security:Hardware)
2. Weigh the HW to see if it matches specifications
3. Measure the HW to see if it matches specifications
You can also test feature additions in FW and ensure that the HW reacts properly. Load the OLDEST FW possible, then slowly flash newer and newer editions while testing that the new op_codes are only in the new FW.
You can also load a test seed and compare it to a BIP39 software wallet like on Ian’s site. But all of this is just theater. Very unlikely you have a super-stealth HW hacked Trezor from Amazon. If you just read the manual cover-to-cover and follow those recommendations, you’ll be fine.
Good luck.