How to wipe an NVMe SSD: Sanitize vs Format
NVMe drives can erase themselves at the controller level. The trick is knowing whether to reach for Sanitize or Format — and how to prove the result.
The golden rule with NVMe drives is the same as anywhere else: let the drive erase itself. Writing zeros from the host with dd is slow, incomplete, and misses the drive's internal structures. NVMe's own commands reach everything.
The NVMe Sanitize command
Sanitize is the strongest erasure an NVMe drive supports. It tells the controller to render all stored data unrecoverable, and it comes in three modes:
- Cryptographic erase — the drive destroys its internal encryption key, making every stored byte unreadable instantly. Fast, and maps to NIST 800-88 Purge.
- Block erase — the controller physically erases every flash block. Slower than crypto erase, but independent of the drive's encryption implementation. Also maps to Purge.
- Overwrite — the drive overwrites all user data. The slowest mode, but supported where the first two aren't. Maps to Clear.
If a drive offers Sanitize, it's almost always the right choice — particularly crypto erase, which completes in seconds.
The Format NVM command
Format NVM clears the drive's namespace — the logical structure the host sees. It's a step below Sanitize (it maps to NIST 800-88 Clear), but it's the fallback when a drive doesn't implement Sanitize, which is more common on older or budget NVMe drives.
Sanitize vs Format at a glance
| Sanitize | Format NVM | |
|---|---|---|
| Reaches | All user data + over-provisioning | Logical namespace |
| Speed | Seconds (crypto) to minutes | Fast |
| NIST 800-88 | Purge / Clear | Clear |
| Use when | Drive leaves your control | Reuse, or no Sanitize support |
Wiping an NVMe drive with tScrub
- Boot the tScrub appliance (USB or PXE) with the drive installed.
- tScrub discovers the drive and checks what it supports — Sanitize modes, Format, and the drive's capability strings.
- It runs the strongest supported method and watches the SSTAT sanitize-status register to confirm the operation actually completes.
- The report records the method, the final status, and pre/post-wipe SMART data for the drive.
Verifying the wipe actually worked
A wiped NVMe drive should show no partition table and no readable data. More importantly, tScrub confirms completion at the controller level — it reads back the sanitize status, so a drive that reports success but never finished doesn't get marked clean. That's the difference between a green checkbox and genuine proof of erasure.
FAQ
Can I just use nvme format from the command line?
You can, and it works — but it only Clears the namespace, and you'll be assembling the audit trail yourself. tScrub does the capability detection, status verification, and reporting in one pass.
Why does crypto erase complete in seconds?
Because the data was always stored encrypted with a key the drive holds. Destroying the key is enough — nothing needs to be overwritten, so the erase is instant.