Securely wiping HDDs and SSDs

Secure erase HDD with dd

Use /dev/urandom if you plan to encrypt the drive, so that used encrypted space is indistinguishable from unused drive space. Otherwise, /dev/zero would be fine.

sudo dd if=/dev/urandom of=/dev/sdX bs=1M status=progress

Secure erase SSD with hdparm

• archive.kernel.org ATA Secure Erase

# verify drive is not frozen
sudo hdparm -I /dev/sdX
# should say "not frozen" under Security header
 
# set user password (necessary to perform erase, will be unset after erase)
sudo hdparm --user-master u --security-set-pass Password /dev/sdX
 
# verify user password was set
sudo hdparm -I /dev/sdX
# should say "enabled" under Security header
 
# actual secure erase command
time sudo hdparm --user-master u --security-erase Password /dev/sdX
 
# verify security is now disabled
sudo hdparm -I /dev/sdX
# should say "not enabled" under Security header

Secure erase nvme SSD with nvme-cli

• ubuntu manpages nvme-format

Ensure nvme-cli is installed. I was able to do this using a Fedora live USB.

This also doesn’t work via my nvme to USB adapter, as the disk shows up as a normal /dev/sdX disk instead of a /dev/nvme0nX disk (I’m sure that’s a symptom of the problem rather than the problem itself, but my point stands). I had to use a PC with an nvme slot directly on the motherboard and boot from the aforementioned Fedora live USB.

sudo nvme format -s 1 /dev/nvme0nX

Verified with sudo fdisk /dev/nvme0nX, then p to print the partition table.

EOF