Erasing an SSD before reuse: secure erase, sanitize and crypto erase
Erasing an SSD before reuse requires more than deleting files. Secure erase uses the Format NVM command, sanitize uses the NVMe Sanitize command, and cryptographic erase changes the encryption key on self-encrypting drives. Each method has different speed, effectiveness, and hardware requirements.
Understanding SSD erasure methods
Media sanitization renders access to target data on the storage media infeasible for a given level of effort, according to the NIST SP 800-88 Rev. 2. For solid state drives, three principal methods exist: secure erase, sanitize, and cryptographic erase. Each method addresses different use cases and hardware capabilities.
The IEEE 2883-2022 standard specifies methods for sanitizing logical and physical storage and provides technology-specific requirements for eliminating recorded data. Organizations and system owners should select a method based on the sensitivity of the information and the drive's support for the command.
Standard deletion or formatting does not physically remove data from NAND flash memory. The operating system only marks the space as available. Erasure commands instruct the drive controller to overwrite or invalidate all stored data at the hardware level.
Secure erase and the Format NVM command
Secure erase traditionally refers to the ATA Secure Erase command or the NVMe Format NVM command. On NVMe drives, the Format NVM command (opcode 80h) is supported by the StorNVMe driver on Windows and can be issued via IOCTL_STORAGE_REINITIALIZE_MEDIA for crypto erase only. The command erases all user data and may also change the logical block size.
On Linux, the nvme-cli tool provides the `nvme format` command to perform a secure erase. This method overwrites all NAND pages and is effective for drives that do not support hardware encryption. However, the process can take a long time on high-capacity drives because the controller must write to every block.
Secure erase is a clear sanitization method as defined by NIST SP 800-88. It renders data unrecoverable by standard laboratory techniques but may not be sufficient for highly sensitive data if the drive has hidden areas or if the overwrite pattern is not thorough.
Sanitize command for thorough erasure
The NVMe Sanitize command (opcode 84h) is a more advanced erasure method defined in the NVM Express specification. It supports block erase, crypto erase, and overwrite operations. The StorNVMe driver supports the Sanitize command and it can be issued via IOCTL_STORAGE_PROTOCOL_COMMAND.
The Sanitize command is designed to purge data from the entire NAND media, including areas that are not normally accessible to the operating system. It is a purge method according to IEEE 2883 and is considered a more thorough sanitization than a simple format. The command runs asynchronously and the drive reports completion through a log page.
On Linux, the nvme-cli tool includes the `nvme sanitize` command. Users should verify that the drive supports the Sanitize command by checking the Command Supported and Effects log page. The sanitize operation cannot be interrupted once started, and the drive may be unavailable until it finishes.
Cryptographic erase for self-encrypting drives
Self-encrypting drives (SEDs) use hardware-based encryption to protect data at rest. A cryptographic erase changes the media encryption key, making all previously encrypted data permanently inaccessible. The Samsung Semiconductor FAQ describes the PSID Revert feature, which resets the encryption key and deletes all existing data.
Microsoft's encrypted hard drive documentation explains that encrypted hard drives for Windows must comply with TCG protocols and IEEE 1667. When the operating system activates the security mode, the drive controller generates a media key for each volume. A cryptographic erase simply discards that key and generates a new one, which is nearly instantaneous.
Apple's Erase All Content and Settings feature on Macs with Apple silicon or the T2 Security Chip performs a cryptographic erase. The feature quickly and securely erases all data, settings, and apps while maintaining the operating system. This method is fast because it does not require overwriting every byte of flash memory.
| Method | Speed | Effectiveness | Requirements |
|---|---|---|---|
| Secure erase (Format NVM) | Slow on large drives | Clears user data, may leave hidden areas | NVMe or ATA drive; OS support |
| Sanitize (NVMe command) | Moderate to slow | Purges entire media including hidden areas | NVMe drive with Sanitize support; recent OS |
| Cryptographic erase | Very fast (seconds) | Makes data inaccessible by key change | Self-encrypting drive; hardware encryption support |
Frequently asked questions
What is the difference between secure erase and sanitize?
Secure erase (Format NVM) clears user data but may not reach hidden areas. Sanitize (NVMe command) purges the entire media, including inaccessible areas, and is considered more thorough.
Can a standard SSD be crypto erased?
Only self-encrypting drives (SEDs) support cryptographic erase. Standard SSDs without hardware encryption require secure erase or sanitize commands.
Does erasing an SSD affect its lifespan?
Secure erase and sanitize involve writing to all NAND cells, which consumes program/erase cycles. Cryptographic erase does not write to cells, so it has no impact on lifespan.
How to check if an SSD supports the Sanitize command?
Use the NVMe Identify command to read the Command Supported and Effects log page. Tools like nvme-cli on Linux or vendor utilities can display this information.
