How to securely erase any drive: NVMe, SSD, HDD & SAS
There's no single "wipe" command that's right for every drive. The correct method depends on what the drive is — and each type erases differently.
The golden rule of data erasure is simple: let the drive's own controller do the work when it can. Firmware-level commands reach parts of the media that software alone can't — reserved sectors, reallocated blocks, and the over-provisioned area on an SSD.
In this series:
- How to wipe an NVMe SSD
- How to securely erase a SATA SSD
- How to wipe a hard drive
- How to erase SAS & SCSI drives
- PSID revert for self-encrypting drives
- Block SID lockdown explained
NVMe SSDs
NVMe drives support the Sanitize command, which is the strongest erasure available. There are three modes:
- Cryptographic erase — the drive's encryption key is destroyed, so all stored data becomes unreadable instantly.
- Block erase — every block is physically erased at the hardware level.
- Overwrite — the drive overwrites all user data (slower, but supported where the others aren't).
Where Sanitize isn't supported, NVMe drives can also be formatted with the Format NVM command, which clears the logical namespace.
SATA SSDs
SATA SSDs use the ATA command set. Their best erasure is ATA Secure Erase (or the stronger Enhanced Secure Erase), which tells the SSD controller to erase all stored cells, including areas not visible to the operating system. This is dramatically faster and more complete than writing zeros from software.
Hard disk drives
Spinning drives also speak ATA, so ATA Secure Erase and Enhanced Secure Erase apply here too — the drive's own controller overwrites every sector, including reallocated and bad sectors that software can't reach. When a drive doesn't support firmware erasure, a software overwrite is the fallback.
SAS & SCSI drives
Enterprise SAS drives use the SCSI command set. Many support SCSI SANITIZE directly; where they don't, a software overwrite (tScrub uses nwipe for this fallback) is the standard approach. SAS drives are common in decommissioned servers, so this path matters in data-centre work.
Self-encrypting drives (SED / OPAL)
Self-encrypting drives hold their own encryption key. Two things come up:
- PSID revert — resets a locked SED back to factory state using the physical security ID printed on the label. This is the standard unlock for drives you've inherited without a password.
- Block SID lockdown — some BIOSes (common on Lenovo) lock the drive against commands like Sanitize and Format. This shows up as an "access denied" status and usually means the drive must be physically destroyed.
Frozen, blocked, and locked drives
Drives can arrive frozen (the BIOS has issued a security-freeze lock, which blocks erasure until a power cycle), locked (an unknown ATA password is set), or blocked (Block SID lockdown). tScrub detects each case, attempts the appropriate unlock or power-cycle sequence, and — where erasure still isn't possible — flags the drive for physical destruction rather than silently pretending it was wiped.
Which method does tScrub choose?
| Drive | Best method | Fallback | NIST 800-88 |
|---|---|---|---|
| NVMe SSD | Sanitize (crypto / block / overwrite) | Format NVM | Purge / Clear |
| SATA SSD | Enhanced Secure Erase | Secure Erase | Purge / Clear |
| HDD | Enhanced Secure Erase | Secure Erase, overwrite | Purge / Clear |
| SAS / SCSI | SCSI Sanitize | Software overwrite | Purge / Clear |
| Locked SED | PSID revert, then erase | — | Purge |
| Frozen / blocked | Power-cycle & retry | Physical destruction | Destroy |
FAQ
Why not just use dd to zero the drive?
dd only touches what the OS can see. It misses reallocated sectors, the SSD over-provisioned area, and is far slower. Use it only when the drive supports nothing better.
Does wiping wear out an SSD?
A single Secure Erase or Sanitize is a normal, supported operation and doesn't meaningfully shorten drive life. Repeated full overwrites, by contrast, write the entire drive many times over and are harder on the flash.