What Is Secure Erase on an SSD?

Secure erase is a sanitisation command built into an SSD‘s firmware. When the host sends it, the drive’s own controller erases every flash block it manages, or destroys the key that encrypts them, and returns the drive to a factory-fresh state. Nothing is copied over the data from outside: the drive does the work internally, so it reaches places the operating system never sees.

That matters because an SSD does not store data where the computer thinks it does. The flash translation layer moves data around to spread wear, keeps a reserve of over-provisioned blocks and retires worn blocks that may still hold readable data. Deleting a file only removes its directory entry, and a quick format only rebuilds the file system tables. Even writing zeros across the whole drive covers only the addresses the host can see, while older copies can survive in spare and remapped blocks.

NIST Special Publication 800-88, the guidelines for media sanitisation used by many organisations, sorts methods into three levels: Clear protects against simple recovery tools, Purge against laboratory recovery, and Destroy leaves the media unusable. IEEE 2883 sets out the same levels for current interfaces.

The sanitize commands, added to the ATA and NVMe specifications after the original secure erase, are the more thorough choice: they cover every user data area, including caches, cannot be cancelled and carry on after a power cycle.

The command is the same everywhere, but the way to send it depends on the tools available. Back up anything you need first, and disconnect any drive you do not want erased.

Industrial computers change hands more often than people expect: returned for repair, moved between sites, sold on or retired. Each move is a point where recipes, recorded video, credentials or network maps can leave the organisation. A written sanitisation step, with the method and drive serial number logged, closes that gap.

Encryption makes the step faster. With a self-encrypting drive, or full-disk encryption whose key is sealed in a TPM, a cryptographic erase renders the data unreadable in seconds. Defence projects often go further: drives in military computers may be removable so they can be kept or destroyed on site, and some rugged SSDs add a hardware erase input that wipes the drive from a switch or signal. For a drive that leaves the organisation, policy often requires a purge followed by physical destruction.

A sanitisation process is only as good as its evidence. After the command completes, read a sample of sectors across the drive, or the whole drive, and confirm they return zeros, a fixed pattern or random-looking data rather than file contents. NVMe drives also keep a sanitize status log that reports whether the last operation finished, and many manufacturer tools produce a report with the drive model, serial number, method and result.

For audited processes, record that information in a certificate of sanitisation, as NIST SP 800-88 recommends, and keep it with the asset record. Where the firmware’s behaviour cannot be verified, for example on an unknown consumer drive, treat the erase as Clear rather than Purge and add physical destruction before the drive leaves your control.

We fit and image the SSDs in every system we build as standard, and can supply self-encrypting or removable drives where a project needs a documented sanitisation process at the end of its life.