Securely erasing an SSD

What do you guys recommend for securely erasing an SSD? I've been using the hdparm command (https://grok.lsu.edu/Article.aspx?articleid=16716) to wipe ssd's off a fedora live usb but does anything else top that? Zeroing out is not an option since it harms the SSD. For file deletion I've been using the secure-erase command (thc.org), if you have file deletion recommendations I'd also appreciate that.

You should not write anything un-encrypted on flash memory if you want it to be securely deleted after. You should write boot partition with key on easily destructible external memory device. These software commands talk to controller, not memory blocks themselves, therefore any speculation on whether it works or not is pure demagogy unless you have proofs in form of firmware code and it's result read-outs on low level.

I'd wager your best bet is trying to delete everything with whatever tools available and then still not getting rid of it unless it's destroyed first. Non-volatile memory is too smart now for any other approach to be reasonable, and there's not much of a market for dumb non-volatile memory either, from what I know.

>>8586 Would running SSDs (or any drive) only as a RAID 5 or 6 config protect the data as you would need 2 or more drives to recover the data? Meaning when you "sell" the SSD it will have no usable data on it? - or would you still be able to access small slivers of random data? Not sure how recoverable data would be from a single drive in a RAID setup. But yes encryption is best - and remember SSDs have extra capacity that will lock down when bad blocks are encountered... i.e. some of your data will never be erased from SSDs locked in the now out of reach area of the storage.

>>8584 >What do you guys recommend for securely erasing an SSD? Bench grinder.

>>8584 SSD cells can only be written a limited number of times. Once a block of cells is marked bad, the firmware won't fuarrrk with it anymore. So data can be left behind no matter what you do at the host or firmware level. Weather your threat model includes an adversary who can take apart the device and read bad blocks is another issue. >>8586 This. Use encryption and stop worrying about the mechanics of the storage medium. If it's too late for that then option B is >>8624

>>8610 I can't answer your question but all users caring to answer one on security.stackexchange.com I can't find anymore seemed to hold the opinion that no raid 5 is not secure at all. They failed to demonstrate any attack though and I don't know how to find one. I was wondering if they could really restore it why would they have the other disk. Maybe some lain can answer you.

Doont SSD have a problem where they will auto delete data after a finite amount of write-rewrites because of the electronic architecture of the system itself?

ata secure erase granted your ssd is able to be used ( check and make sure otherwise you may brick it) otherwise open a container using cryptsetup and then wipe said container with zeroes encrypting before hand will allow you device encryption but also the ability to quickly erase file information by simply wiping encryption headers instead of entire volume

>>8586 seconded

>>8584 You can probably do a fine job with something like the software from your manufacturer, but if you need something to be wiped without the possibility of recovering it, then some tools like killdisk or dban.

>8584 On a software level, this should suffice as a quick reference: https://wiki.archlinux.org/index.php/Securely_wipe_disk Good old dd has always been reliable for me. Regarding files, shred -u.

Encrypt the SSD, or smash it. You can't easily get rid of data by overwriting single files due to the mechanisms they use to optimise space usage. It's entirely possible that the "secure delete" functionality implemented by the manufacturers isn't comprehensive, either. If you want to be able to securely remove your data, buy HDDs. You should still be encrypting everything anyway.

>>8584 >Zeroing out is not an option since it harms the SSD. See >>9125, you have no idea what the firmware is doing when you tell it to delete stuff. If it really matters it needs to be filled up with random data (not zeros) in addition to hdparm. >>8624 >Bench grinder. If it really, really matters

shred -v -n 3 -z /dev/sdc ; where "sdc" is the target disk

As op mentioned in original post ATA secure ease is the most secure way. It leaves no forensic traces behind and will make all data impossible to recover. It is really only way to wipe non hdd disks.

Some SSDs have proprietary secure erasure methods. You decide if you want to trust those (I wouldn't). If you didn't use FDE from the start, realistically the only sure-fire way would be to crack the SSD in half and shove in a fire.