3 ms·

Ask HN: How can one safely delete an SSD disk?

3 points by quijoteuniv 5y ago

db48x 5y ago
Same as erasing any other type of disk. Why do you think its any different?
- fsflover 5y ago
  Because you need to trust its firmware that the data is actually gone. Unless it's free firmware, I wouldn't trust that.
  - db48x 5y ago
    Like I said, no different from any other disk.
- quijoteuniv 5y ago
  It seems that SSD info can be recovered. https://itigic.com/safely-erase-an-ssd-before-selling-or-throwing-it-away/ https://itigic.com/safely-erase-an-ssd-before-selling-or-thr... https://www.zdnet.com/article/how-to-securely-erase-hard-drives-hdds-and-solid-state-drives-ssds/ https://www.zdnet.com/article/how-to-securely-erase-hard-dri... This company claims is not possible unless you use their software, DBAN will not work. https://www.blancco.com/ https://www.blancco.com/ I am trying to recycle unused computers from companies, and install Linux in them and there is a bit of vacuum in terms of how to erase/comply... som services use Blancco, some companies remove the hardrives before disposing of the computers, making recycling more expensive, need to buy a new hardrive and fix them.
  - db48x 5y ago
    The classic Linux shred command will work just fine, same as on any type of disk. But what you should actually do use use the drive’s built–in instance secure erase feature. This changes the encryption key to a new one, so all existing data is rendered permanently unavailable. Not all drives have disk encryption, but when they do it works the same way whether it’s an SSD or spinning rust. Use hdparm’s --sanitize-crypto-scramble command–line option to do this. Some drives only have an older feature that does a secure erase that overwrites every block in the device. This is much slower, so use it only if your drive doesn’t support anything better. Use hdparm’s --sanitize-block-erase command–line option. These options exist for all ATA, SATA, SAS, SCSI, and NVMe drives (though I don’t believe that hdparm knows anything about NVMe, so you probably have to use the nvme command instead).
    - quijoteuniv 5y ago
      :)
RGamma 5y ago
https://wiki.archlinux.org/title/Securely_wipe_disk https://wiki.archlinux.org/title/Securely_wipe_disk https://wiki.archlinux.org/title/Solid_state_drive/Memory_cell_clearing https://wiki.archlinux.org/title/Solid_state_drive/Memory_ce... I'd probably do cat /dev/urandom > /dev/sdX (use pv for progress indicator)
- quijoteuniv 5y ago
  Some good info here, did not now you can use ATA Secure erase from "linux" i thought you had to use the manufacturer proprietary software for that. I am not sure what you mean with "I'd probably do cat /dev/urandom > /dev/sdX then partition," Care to elaborate?
  - RGamma 5y ago
    On Linux that command overwrites every single (accessible) byte of the SATA device at /dev/sdX (where X is the letter of the drive, e.g X=c) with pseudorandom data. If you have special compliance needs I'm not sure whether that constitutes "safe deletion" though.
LinuxBender 5y ago
Don gloves and eye protection prior to dropping the drives into the shredder if your shredder is missing the cover. [1] Ideally buy a shredder that has a protective cover and a slot for hard drives. Use a shop vac with a hepa air filter to get any pieces that don't make it into the bin. There are shredding services that you can safely shred the drive for you for a small fee. [1] - https://www.youtube.com/watch?v=wb3Xa1h_RqM https://www.youtube.com/watch?v=wb3Xa1h_RqM
- quijoteuniv 5y ago
  ah... should have written How can one safely delete (and not destroy) an SSD disk? :)
  - LinuxBender 5y ago
    I was just taking you literally (delete the disk and not the data) since this is a common pattern in the financial sector. Dell and HP have an optional and more expensive "keep your disk" policy so that you can have companies like Iron Mountain show up, scan the barcodes on the bad disks and shred them on site. You get a certificate (receipt really) that has the serial numbers of the drives you shredded. I was at a company that had this policy for over 50k servers. Not cheap, but totally worth it when you can assure your customers all data is destroyed regardless of encryption methods. Another reason I listed this option is a response to debates you will see online about data wiping, reserved blocks, spare blocks, vendor low level formatting tools, vendor encryption tools, etc... Physically destroying the disk answers those concerns and may be a viable option for someone if the data they wish to remove could harm themselves or their business if the data is leaked or otherwise mismanaged. If a drive is let's say $1200, but leaking data could cost you a percentage of $120 billion in stock / market cap, then shredding the disk is simple and obvious choice.

3 points by quijoteuniv 5y ago

db48x 5y ago

Same as erasing any other type of disk. Why do you think its any different?

fsflover 5y ago
Because you need to trust its firmware that the data is actually gone. Unless it's free firmware, I wouldn't trust that.
- db48x 5y ago
  Like I said, no different from any other disk.
quijoteuniv 5y ago
It seems that SSD info can be recovered. https://itigic.com/safely-erase-an-ssd-before-selling-or-throwing-it-away/ https://itigic.com/safely-erase-an-ssd-before-selling-or-thr... https://www.zdnet.com/article/how-to-securely-erase-hard-drives-hdds-and-solid-state-drives-ssds/ https://www.zdnet.com/article/how-to-securely-erase-hard-dri... This company claims is not possible unless you use their software, DBAN will not work. https://www.blancco.com/ https://www.blancco.com/ I am trying to recycle unused computers from companies, and install Linux in them and there is a bit of vacuum in terms of how to erase/comply... som services use Blancco, some companies remove the hardrives before disposing of the computers, making recycling more expensive, need to buy a new hardrive and fix them.
- db48x 5y ago
  The classic Linux shred command will work just fine, same as on any type of disk. But what you should actually do use use the drive’s built–in instance secure erase feature. This changes the encryption key to a new one, so all existing data is rendered permanently unavailable. Not all drives have disk encryption, but when they do it works the same way whether it’s an SSD or spinning rust. Use hdparm’s --sanitize-crypto-scramble command–line option to do this. Some drives only have an older feature that does a secure erase that overwrites every block in the device. This is much slower, so use it only if your drive doesn’t support anything better. Use hdparm’s --sanitize-block-erase command–line option. These options exist for all ATA, SATA, SAS, SCSI, and NVMe drives (though I don’t believe that hdparm knows anything about NVMe, so you probably have to use the nvme command instead).
  - quijoteuniv 5y ago
    :)

RGamma 5y ago

https://wiki.archlinux.org/title/Securely_wipe_disk https://wiki.archlinux.org/title/Securely_wipe_disk https://wiki.archlinux.org/title/Solid_state_drive/Memory_cell_clearing https://wiki.archlinux.org/title/Solid_state_drive/Memory_ce... I'd probably do cat /dev/urandom > /dev/sdX (use pv for progress indicator)

quijoteuniv 5y ago
Some good info here, did not now you can use ATA Secure erase from "linux" i thought you had to use the manufacturer proprietary software for that. I am not sure what you mean with "I'd probably do cat /dev/urandom > /dev/sdX then partition," Care to elaborate?
- RGamma 5y ago
  On Linux that command overwrites every single (accessible) byte of the SATA device at /dev/sdX (where X is the letter of the drive, e.g X=c) with pseudorandom data. If you have special compliance needs I'm not sure whether that constitutes "safe deletion" though.

LinuxBender 5y ago

Don gloves and eye protection prior to dropping the drives into the shredder if your shredder is missing the cover. [1] Ideally buy a shredder that has a protective cover and a slot for hard drives. Use a shop vac with a hepa air filter to get any pieces that don't make it into the bin. There are shredding services that you can safely shred the drive for you for a small fee. [1] - https://www.youtube.com/watch?v=wb3Xa1h_RqM https://www.youtube.com/watch?v=wb3Xa1h_RqM

quijoteuniv 5y ago
ah... should have written How can one safely delete (and not destroy) an SSD disk? :)
- LinuxBender 5y ago
  I was just taking you literally (delete the disk and not the data) since this is a common pattern in the financial sector. Dell and HP have an optional and more expensive "keep your disk" policy so that you can have companies like Iron Mountain show up, scan the barcodes on the bad disks and shred them on site. You get a certificate (receipt really) that has the serial numbers of the drives you shredded. I was at a company that had this policy for over 50k servers. Not cheap, but totally worth it when you can assure your customers all data is destroyed regardless of encryption methods. Another reason I listed this option is a response to debates you will see online about data wiping, reserved blocks, spare blocks, vendor low level formatting tools, vendor encryption tools, etc... Physically destroying the disk answers those concerns and may be a viable option for someone if the data they wish to remove could harm themselves or their business if the data is leaked or otherwise mismanaged. If a drive is let's say $1200, but leaking data could cost you a percentage of $120 billion in stock / market cap, then shredding the disk is simple and obvious choice.