I understand traditional methods don’t work with modern SSD, anyone knows any good way to do it?
Physical damage is the most reliable. Drill through the flash chips, chuck the whole thing into an old microwave, then throw it all in a fire.
If you want to resell the SSD, use secure erase. If that doesn’t work (some broken firmware doesn’t erase on secure erase, you’ll know when you reboot and the data is still there), you can try overwriting all storage as a last resort.
If the drive was encrypted, either with a hardware backed key or a very secure password, throw out the encryption key and delete the backup key. That should suffice, unless a powerful country with access to advanced quantum computers will be targeting you in the next ten or twenty years.
Overwriting storage is rarely good enough to wipe all files, but there’s a good chance most of the files you want deleted will be gone. If all files on the drive are sensitive, you should’ve probably encrypted the drive (lesson for next time!) and shouldn’t rely on overwriting to actually erase the data you’re trying to destroy.
Physical destruction. It’s the only way to be 100% sure.
deleted by creator
No. Most SSDs actually contain far more storage internally than the SSD controller exposes. They then even out the wear and tear of the flash memory “packages” by cycling through the various packages and, given there being more packages than actually exposed for use, this offers a level of redundancy so the device lasts longer.
Because of this, wiping the logical device (e.g. zero filling or writing random data multiple times) doesn’t actually guarantee every storage package is written to / overwritten. Thus data may still reside even after wiping (that can be accessed by reading the packages directly and skipping the controller which abstracts these packages into a virtual block device).
Some SSDs offer a secure wipe tool that does a low level wipe of every page or wipes out an encryption key and generates a new one but not every SSD on the market offers that feature.
From the company my org has used to decommission old hardware; an industrial grinder is sadly the most assured way to guarantee no data can be recovered.
For secure data destruction, either pay for it to be done properly, or create your own way of doing it. A decent sized drill bit can do all the work for you, at the cost of a new drive of course.
Nuke it from orbit. Only way to be safe
A fellow Expeditionary Force enjoyer I see
⬆️➡️⬇️⬇️⬇️
A fellow enjoyer of democracy
*Presses b
Here is an alternative Piped link(s):
Piped is a privacy-respecting open-source alternative frontend to YouTube.
I’m open-source; check me out at GitHub.
Microwave
For all average user requirements that just involve backups, PII docs, your sex vids, etc (e.g. not someone who could be persecuted, prosecuted, or murdered for their data) your best bet (other than physical destruction) is to encrypt every usable bit in the drive.
- Download veracrypt
- Format the SSD as exFAT
- Create a new veracrypt volume on the mounted exFat partition that uses 100% of available space (any format).
- open up a notepad and type out a long random ass throwaway password e.g.
$-963,;@82??/@;!3?$.&$-,fysnvefeianbsTak62064$@/lsjgegelwidvwggagabanskhbwugVg, copy it, and close/delete without saving. - paste that password for the new veracrypt volume, and follow the prompts until it starts encrypting your SSD. It’ll take a while as it encrypts every available bit one-by-one.
Even if veracrypt hits a free space error at the end of the task, the job is done. Maybe not 100%, but 99.99+% of space on the SSD is overwritten with indecipherable gibberish. Maybe advanced forensics could recover some bits, but a) why the fuck would they go to that effort for a filthy commoner like yourself, and b) what are the chances that 0.01% of recoverable data contains anything useful!?! You don’t really need to bother destroying the header encryption key (as apple and android products do when you wipe a device) as you don’t know the password and there isn’t a chance in hell you or anyone else is gonna guess, nor brute force, it.
Because of wear management and the way flash storage works, overwriting disks is even more useless for wiping data than it was on hard drives. Even on spinning rust there were plenty of files in relocated sectors, but on SSDs you get relocation behaviour and copied files without any actual damage to the disk.
You can overwrite a file on your SSD with random numbers supposedly filling the entire file’s space, but under the hood the SSD could be like “erasing this block would wear down the disk too much, let’s just copy the block some place else and map the data offset to this new set of cells”. Modern SSDs also have extra storage capacity so that wear leveling can be done without reducing your storage space in the process, and cells the SSD deems to be too unstable will be copied and unmapped. Their data will still be there, but it won’t be accessible to the computer, even if you overwrite the entire drive.
If you want to erase data, physically destroy the disk. If you want to prevent having to erase data, encrypt it (it’s on by default in Windows, Mac, and most Linux distros) so you only need to destroy the encryption key to make the data unreadable.
a) why the fuck would they go to that effort for a filthy commoner like yourself, and b) what are the chances that 0.01% of recoverable data contains anything useful!?!
Nobody is gonna bother doing advanced forensics on 2nd hand storage, digging into megabytes of reallocated sectors on the off chance they to find something financially exploitable. That’s a level of paranoia no data supports.
My example applies to storage devices which don’t default to encryption (most non-OS external storage). It’s analogous to changing your existing encrypted disks password to a random-ass unrecoverable throwaway.
deleted by creator
If you want to keep/sell the drive…
- Fill up the rest of the usable space
- Encrypt the drive
- Throw away the encryption key/password
- Hard format (writing zeroes to every bit, sorry if that’s the wrong term
Is that the best strategy? Or is anything outside of 2 and 3 redundant?
deleted by creator
That makes sense. Thank you!
You can’t fill the drive. The drive decides when to use its buffered free storage blocks. It’s at the hardware level and only the Secure Erase command will clear it.
Right, I read some more of the comments and realized that’s what some of the “unreported space” is used for. Makes sense, thanks!
You fill up the usable space. Or the visible space. No one will disamble the device and read from the raw storage.
Then why do that when you can do a secure erase in seconds?
Encrypted volume and burn the encryption key
This is how storage services attest to a secure wipe.
But I wouldn’t trust anyone else with said encryption key who knows if its going straight to the CIA or not.
That’s better for prevention than after the fact for the wear leveling reasons others have mentioned.
3 pass random data erase. If you are not going to use it again, a nice hammer.
For an ssd you’ll have faster and better results with veracrypt, delete the key then call the drives secure erase.
5220 was for media that actually gave the user real access to block level read and write. Nowadays even spinning media presents you with an abstraction.
doesn’t just overwriting the data work?
No, “overwritten” data doesn’t actually get erased right away due to wear levelling. As SSDs get esoterically smart with how they prevent unnecessary erase operations, there’s no way to be sure without secure erase.
overwriting the whole drive would fix that
It actually doesn’t, because the drive won’t “let” you overwrite the reserve space. That’s why they introduced SSD secure erase, so the firmware knows that you mean to overwrite everything.
Alternatively you could just use full disk encryption and burn the key when you are done.
Page 36 of NIST 800-18r1
https://nvlpubs.nist.gov/nistpubs/specialpublications/nist.sp.800-88r1.pdf
No. Modern SSDs are quite sophisticated in how they handle wear leveling and are, for the most part, black boxes.
SSDs maintain a mapping of logical blocks (what your OS sees) to physical blocks (where the data is physically stored on the flash chips). For instance, when your computer writes to the logical block address 100, the SSD might map that to a physical block address of 200 (this is a very simplified). If you overwrite logical block address 100 again, the SSD might write to physical block address 300 and remap it, while not touching the data at physical block address 200. This let’s you avoid wearing out a particular part of the flash memory and instead spread the load out. It also means that someone could potentially rip the flash chips off the SSD, read them directly, and see data you thought was overwritten.
You can’t just overwrite the entire SSD either because most SSDs overprovision, e.g. physically have more storage than they report. This is for wear leveling and increased life span of the SSD. If you overwrite the entire SSD, there may be physical flash that was not being overwritten. You can try overwriting the drive multiple times, but because SSDs are black boxes, you can’t be 100% sure how it handles wear leveling and that all the data was actually overwritten.
This article covers several methods. Personally, I’d look for a BIOS based tool first, as that would be free and easiest. After that, the Diskpart Clean All command is probably fine for anything other than Top Secret data which a government based threat actor would be willing to put a lot of resources into recovering. If it’s just your tax documents and porn archive, no one is going to care enough to dig out anything which that command might have left behind.
deleted by creator
If running linux, what command should be run? Shred isn’t viable on a SSD, as it will only tear them down. Shred was designed with HDD in mind.
deleted by creator
if the value of the compromised data exceeds the value of the drive, destroy the drive.
Fill the drive 100% using data duplicator then delete everything on the drive. Repeat a few times to ensure you scrub all blocks. There is no need to physically destroy the drive.
edit: fair criticism of this approach in cases when the data is unencryptd and the hard drives has bad blocks. I just wanted to give a counter to the destroying hardware approach which isn’t necessary warranted
That doesn’t work with SSDs anymore. Their controllers map “bad” blocks which are put in an RO state and writes no longer go there but data still exists. There is usually a buffer of extra space so you do see the capacity loss, but if you bypass the controller you can still read the data there.
That’s fair, I can appreciate an attack vector in cases where there are bad blocks and the drive was unencrypted. Luckily bad blocks are less common with modern SSDs and assuming the disk was encrypted, a few bad blocks are unlikely to expose any contents. So knowing the number of bad blocks and what data was stored would inform if a fill and empty approach would be suitable to sanitize the drive.
Smash it to pieces, melt it down into a blob and drop it down a borehole at the nearest quarry
With fire
i know this isn’t what is being asked, but disk level encryption is cool
Does it have to be from orbit?
What if the drive is not on a planet?
Then you need to aim really well and time your orbit
Install all your steam library to full your SSD. Should do the job. Empty the disk, rinse and repeat a few times.
