Disk Wipe Methods: Secure Erase, Sanitize & Overwrite

"Wipe" isn't one operation — it's a family of techniques with very different levels of confidence. Here's how the main ones compare.

Every erasure method falls into one of two camps: firmware erasure, where the drive's own controller destroys the data, and software overwrite, where the host writes patterns over the drive. Firmware erasure is almost always the better choice.

In this series:

Firmware erasure vs software overwrite

Firmware methods — Secure Erase, Enhanced Secure Erase, Sanitize, Format NVM — are issued directly to the drive's controller. The controller knows where all its data lives: user sectors, reallocated sectors, and the over-provisioned space SSDs keep in reserve. Software overwrite, by contrast, can only write to sectors the operating system can see.

That's why a firmware command is both more complete and usually much faster — an SSD can cryptographically erase in seconds, while a full overwrite of the same drive might take hours.

ATA Secure Erase vs Enhanced Secure Erase

Both are ATA commands that tell the drive to erase itself. The difference:

Secure Erase — the standard erase. Maps to NIST 800-88 Clear.
Enhanced Secure Erase — additionally erases sectors that may have been written to and then reallocated (for example, areas a standard erase might skip). Maps to NIST 800-88 Purge.

If a drive supports Enhanced Secure Erase, that's the one to use when data is leaving your control.

NVMe Sanitize vs Format

NVMe drives offer two erasure primitives:

Sanitize — the strongest option. Three modes: crypto erase (destroy the encryption key), block erase (erase every block), and overwrite (overwrite all data). Crypto and block erase map to Purge.
Format NVM — clears the namespace. Maps to Clear; it's the fallback when Sanitize isn't supported.

Cryptographic erase vs block erase

Cryptographic erase is elegant: the drive has always stored data encrypted with an internal key. Destroying that key makes every stored byte unreadable, instantly and irreversibly. It's fast and complete — assuming the encryption was implemented correctly in the first place.

Block erase physically erases the flash cells. It's slower than crypto erase but doesn't depend on the drive's encryption implementation, which is why some auditors prefer it.

Software overwrite and its limits

Software overwrite — writing zeros or patterns from the host — is the fallback when a drive supports no firmware erasure (common on older SAS drives). Its limits:

It can't reach reallocated or hidden sectors.
On SSDs it's slower and causes more wear than a single firmware erase.
Multiple passes are unnecessary on modern drives — a single pass is sufficient, and the old "7-pass DoD" standard is obsolete.

Overwrite maps to NIST 800-88 Clear.

Verifying the erase, and hidden areas

Two things can quietly survive a wipe: sectors the controller keeps to itself (reallocated sectors, or HPA/DCO hidden areas), and a command that reports success without actually finishing. tScrub closes both.

Before erasing, tScrub resets HPA/DCO hidden areas to the native size, then writes a unique per-run sentinel pattern into fixed positions across the drive — first sector, 25%, 50%, 75%, last. After the erase reports success, it reads those positions back straight from the media. If the firmware claimed success but skipped a region, the sentinel survives and the drive is recorded FAILED, not completed. This has caught a real drive whose firmware reported a successful PSID revert without actually re-keying the media.

Bad sectors can't fake a pass. A sector that can't be read back is recorded UNREADABLE, never passed, and the report records the drive's reallocated-sector count before and after, so the evidence reflects the drive's real condition. Sentinels are written in bands of consecutive sectors, so a single silently remapped sector can't hide one. Firmware purges erase reallocated sectors too — that is part of what makes Enhanced Secure Erase a Purge.

For stronger evidence, a run can include a full read-back of every sector, or a sampled percentage after a software overwrite. Where a crypto erase makes a content read-back meaningless (the media key is destroyed), tScrub records that exemption rather than printing a pass that proves nothing. The result is recorded per drive in the report and certificate.

Degaussing and physical destruction

When erasure isn't possible — a drive has failed, is frozen, or is under Block SID lockdown — the last resort is destruction. Degaussing (a strong magnetic field) works on magnetic media but not SSDs. Physical destruction (shredding, disintegration) works on everything but is irreversible, so you lose the option to redeploy or resell the drive. The rule of thumb: erase where you can, destroy where you must.

Method → NIST 800-88 outcome

Method	Outcome	Best for
NVMe Sanitize (crypto / block)	Purge	NVMe SSDs leaving your control
ATA Enhanced Secure Erase	Purge	SATA SSDs & HDDs leaving your control
ATA Secure Erase	Clear	Drives being redeployed internally
NVMe Format NVM	Clear	NVMe drives without Sanitize
SCSI SANITIZE (overwrite)	Purge	SAS drives that support it
Software overwrite	Clear	SCSI/SAS fallback
Degaussing / shredding	Destroy	Failed or frozen drives

FAQ

How many overwrite passes do I need?

One. Multiple passes were a precaution for 1990s-era drives; on modern hardware they add time and wear without adding security. Firmware erasure is better still.

Is crypto erase as good as block erase?

It depends on the drive's encryption implementation. Both map to Purge, but if you need to be conservative about a particular drive model, block erase removes any doubt.

Disk wipe methods explained: Secure Erase, Sanitize & Overwrite