How secure erase the SSD

I want to secure erase my drive.

Yes it's already encrypted but that's not good enough.

Apple's "sudo diskutil secureErase" on SSD's errors with "makes no sense" .

Physically evaporating/grinding the drive is one step too far for me. I understand the drive is soldered to the main board so this would destroy the whole machine.

I need something in between.


I already saw https://discussions.apple.com/thread/250795166 but it offers no solution.


May I propose this procedure. I would like to hear if this is working as expected

  1. trash all the files on "yourdrive"
  2. empty the trash
  3. execute this command: cp /dev/random /Volumes/"yourdrive"


The action will terminate automatically when your drive is filled with random data (with the message "No space left on device")

Maybe repeat this procedure a few times. But realize 2 things

  1. each step 'ages' your drive a bit
  2. I remember I read somewhere that specialists can recover data when it's overwritten a few times, but it apparently gets very difficult after about 8 passes (all from top of my head).


I assume this also works for current MacOS

Posted on Nov 30, 2021 11:44 AM

Reply
Question marked as Top-ranking reply

Posted on Nov 30, 2021 1:58 PM

You have already decided on the answer you want, and seem uninterested in technical details. So go do it.


If you want to understand a little more…


If the in-built data encryption is insufficient, shred the Mac. macOS uses your password to access a robust generated encryption password, and the storage-erasure procedure steps on the keybag. That makes the data inaccessible. Quickly.


Otherwise, format the volume and re-install macOS, as suggested by Apple. Or erase the volume using a new feature of Monterey, as suggested by Apple.


If the standard and fundamental behavior of an SSD—the integral erase-on-write behavior required for all flash storage—is insufficient, and/or if your data was somehow unencrypted, then you will want to physically shred the storage. Writes do not overwrite the same storage, the writes re-vector the write elsewhere. This for wear leveling, and for performance.


There is no storage-overwrite capability with SSDs, and the multiple-pass-overwrite I/O scheme dates back to external-servo hard disks and floppies from the 1980s; when head-tracking was sloppy, at best.


Here’s the Monterey feature, with links to other info:

Erase all content and settings on Mac - Apple Support


Info on keybags and how Apple storage encryption works:

Apple Platform Security - Apple Support

12 replies
Question marked as Top-ranking reply

Nov 30, 2021 1:58 PM in response to w.pasman

You have already decided on the answer you want, and seem uninterested in technical details. So go do it.


If you want to understand a little more…


If the in-built data encryption is insufficient, shred the Mac. macOS uses your password to access a robust generated encryption password, and the storage-erasure procedure steps on the keybag. That makes the data inaccessible. Quickly.


Otherwise, format the volume and re-install macOS, as suggested by Apple. Or erase the volume using a new feature of Monterey, as suggested by Apple.


If the standard and fundamental behavior of an SSD—the integral erase-on-write behavior required for all flash storage—is insufficient, and/or if your data was somehow unencrypted, then you will want to physically shred the storage. Writes do not overwrite the same storage, the writes re-vector the write elsewhere. This for wear leveling, and for performance.


There is no storage-overwrite capability with SSDs, and the multiple-pass-overwrite I/O scheme dates back to external-servo hard disks and floppies from the 1980s; when head-tracking was sloppy, at best.


Here’s the Monterey feature, with links to other info:

Erase all content and settings on Mac - Apple Support


Info on keybags and how Apple storage encryption works:

Apple Platform Security - Apple Support

Nov 30, 2021 12:55 PM in response to w.pasman

imho, you're going to an awful of of trouble for no good reason.

The nature of data storage on an SSD is pretty darn secure. If you simply erase or repartition the drive then the data is pretty much rendered unreadable.

Still, there's this light reading:

How to Securely Erase Your SSD Without Destroying It - makeuseof.com


"I remember I read somewhere that specialists can recover data when it's overwritten a few times, but it apparently gets very difficult after about 8 passes (all from top of my head). "

This is specific to magnetic media only, i.e. magnetic tape, floppy disks and hard disk drives. It doesn't pertain to SSD drives.

Dec 1, 2021 7:07 AM in response to w.pasman

IMHO - doing a Secure Erase of an SSD is basically a waste to time and increased the chances of Destroying the Drive.


Even if some data was left behind after a normal Erase and someone was able to get the drive to Professional Data Recovery Company - they will tell the person the chances of recovering any meaning Data is extremely low if not possible at all.

Nov 30, 2021 1:22 PM in response to D.I. Johnson

Thanks. Yes what I remembered seems for magnetic. Not sure how flash would compare.

But I have seen recommendations that you have to destroy flash memory physically to ensure safe erasure. That's not for nothing.


Thanks for the link, yes I saw that already. But section "Secure Erase Your SSD Using a Manufacturer Tool" does not give tools for "Apple SSD" which happens to be the brand of the SSD in my macbook. "Parted Magic" seems not to apply either, it's a USB tool if I understand correctly.

Dec 1, 2021 12:00 AM in response to MrHoffman

>You have already decided on the answer you want

I'm not. Why do you say so.


>If you want to understand a little more…

Thanks for the clarifications.


>Otherwise, format the volume and re-install macOS, as suggested by Apple. Or erase the volume using a new feature of Monterey, as suggested by Apple.


I'm on Catalina so I can't follow Monterey instructions.

I checked the Monterey option but it is erasing not the entire drive, only selections like Apple ID, Apple Wallet, Touch ID, Accesories. So it seems not what I need anyway.

And my mac is going out of my hands soon.


>If the standard and fundamental behavior of an SSD—the integral erase-on-write behavior required for all flash storage—is insufficient, and/or if your data was somehow unencrypted, then you will want to physically shred the storage


Which means, destroying the mac itself, which is not an option.


>There is no storage-overwrite capability with SSDs, and the multiple-pass-overwrite I/O scheme dates back to external-servo hard disks and floppies from the 1980s; when head-tracking was sloppy, at best.


What if I fill the ENTIRE DRIVE with random data? I would think that erases everything there was on it, even if it was somewhere else on that drive? Do I need multiple passes for SSD?



Dec 3, 2021 8:02 PM in response to w.pasman

If your data is encrypted as you say, then just destroying the encryption keys are enough to prevent access to the data since there is no way to decrypt the data without the encryption key. This is the whole point of encryption.


With an Apple SSD once you use Disk Utility on macOS to "erase" the SSD (simple erase) the TRIM support on the SSD will automatically clear out the NAND cells. I'm not sure what happens when using a third party SSD. You can check the contents of the SSD by running the following utility from the Terminal app although you will need to replace "diskX" with the proper drive identifier for the SSD):

xxd  /dev/diskX


I'm not sure if "xxd" is available while booted from a macOS installer since the installer is quite limited. You will see some data on the SSD for the partition layout and a few hidden macOS support files, but the majority of the data will show as zeroes and dots.


If you have a 2018+ USB-C Mac, then the SSD is hardware encrypted. If you "Restore" the T2 firmware, then I believe it creates a new set of encryption keys which effectively instantly destroys all data on the SSD since without the old encryption keys there is no way to recover any data from the SSD.

Revive or restore an Intel-based Mac using Apple Configurator 2 - Apple Support


Revive or restore a Mac with Apple silicon using Apple Configurator 2 - Apple Support


About encrypted storage on your new Mac - Apple Support


Depending on the exact model of the Mac and the SSD used, it may be possible the SSD has a built-in hardware secure erase feature, but this can only accessed from a bootable Linux USB drive and may require several command line commands to execute. Not all SSD's have this feature built into them. I have successfully performed this procedure on Apple 2.5" SSDs, and on many Apple blade SSDs from 2013 - 2015, and was only able to do this on a few of the 2016-2017 USB-C Macs.


No matter what option you choose, you still must trust that the SSD is doing as it has been told. Even using "xxd" to read the raw data from the drive can be misleading as some SSD's are programmed to show zeroes after a secure erase even if the data is not erased. I would expect the major SSD manufacturers to be the most trustworthy & reliable in this manner especially if their SSDs have been tested to comply with the hardware secure erase feature.


If your data was encrypted, then you have nothing to worry about once the encryption key has been destroyed.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

How secure erase the SSD

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.