Erasing SSD's and NVME's

[bigvictorio]

Hello,

I was wondering which method Shredos uses, especially for Sata/M2 SSDs and NVME SSD.
In the documentation, there was a planned feature of adding ATA SECURE ERASE method, or nvme-cli library for NVME disks.

Is Sherdos just filling all the blocks on the disks, so Shredos doesn't recognize the difference between disks? Or my understanding is incorrect.
If there is someone who could maybe explain to me how does deletion of NVMe or SATA SSDs work in this software, or provide more detailed information? I would be very thankful

Thanks :)

[PartialVolume]

ATA secure erase is scheduled for release 0.35 or 0.36. So at the moment it simply treats a SSD or NVME as if they were an ordinary spinning disc, ie just filling all the blocks. You can do a ATA secure erase using hdparm or nvme-cli by running the commands in the ALT F2 virtual terminal in ShredOS.

In the 0.35/0.36 release there will be a new method 'ATA Secure erase (HDD/SSD/NvMe)' built into the nwipe GUI that issues the ATA secure erase command and lets drive do the wipe. nwipe will estimate the progress on screen so it will look similar to wiping a HDD.

[uiob]

Is this still being worked on? Can we expect it in future releases?

[PartialVolume]

That's the plan. Unfortunately I'm really busy on things unrelated to ShredOS/Nwipe at the moment, so no timeline.

[SantosSi]

Can we expect this feature in the version after 0.38?

[bigvictorio]

Hello,

thanks for the response. Is there any expected release date for 0.35/0.36 or for nvme-cli/hdparm (or maybe month, year, etc)? Or it is just planned for the future?

[PartialVolume]

I'm currently finishing off the PDF report and will more than likely do a 0.35 release next week or the week after. I will then do a full release of ShredOS based on the 0.35 version of ShredOS, that will be the week after. ATA secure erase will be done immediately after that. I've given myself a couple of months, but may do it quicker.. but as soon as ATA secure erase is complete I would release as 0.36. So probably two months between the two releases. So i guess I'm looking at sometime in September .. fingers crossed for ATA secure erase... famous last words :-)

[PartialVolume]

Sorry October, not September. :-)

[bigvictorio]

Okay thanks, that's a pity but I will be looking forward to it ⏩

In the 0.35/0.36 release there will be a new method 'ATA Secure erase (HDD/SSD/NvMe)' built into the nwipe GUI that issues the ATA secure erase command and lets drive do the wipe.

Are you thinking, that it will be just an option in GUI to select the deletion method? Or some automation, because it would be beautiful to just connect all disks to the computer running shredos, the system will recognize them and delete them accordingly by their type. (HDD, SATA SSD, NVME)

I'm thinking something like this script for Parted can maybe be an inspiration: https://github.com/tslight/disknukem

[PartialVolume]

the system will recognize them and delete them accordingly by their type. (HDD, SATA SSD, NVME).

Yes, that's certainly a possibility, i.e in config there could be an option Always wipe SSD/NvMe with ATA secure erase If that is set then only connected HDD's will be wiped with the selected method, while the SSD/NvMe drives will be wiped with secure erase.

[PartialVolume]

I'm thinking something like this script for Parted can maybe be an inspiration: https://github.com/tslight/disknukem

Thanks for that link. It's always useful to see how others do it. I could always include those scripts in shredos if anybody is interested.

[bigvictorio]

I could always include those scripts in ShredOs if anybody is interested.

Maybe this could serve as a temporary solution until you develop something robust and you will be satisfied with it.
It's also better for people who would like to properly and more securely erase their disks.
And with the ISC license assigned to Disknukem, I don't think there should be some problem.
Maybe some bugs I found:

• disknukem is not "deleting" disk simultaneously (I mean at least in the GUI")
• there are some old libraries that at least Parted stopped using. (I think, to make that script work I had to replace D3udd with dd)
• there is only one iteration

But it would be very useful

[henk717]

Did this get added? I can't find it in the UI
Also worth pointing out, drives can lack this feature or block it. In those cases a drive wide TRIM is helpful and often good enough / quick.

[PartialVolume]

Did this get added? I can't find it in the UI.

No it's not been added yet. There has been too many other things going on in my life. However it's still on my list, but I can't give a timeline as I just don't know at the moment. I'm focused on fixing some issues in nwipe, which I've done then I'm releasing a new release of nwipe and an updated ShredOS with the latest kernel & drivers. Then back to adding more features to nwipe.

[Darth-NullVortex]

I truly appreciate your dedication to this project. It's brilliant! I understand the challenges of balancing priorities and time constraints. Your plan to integrate NVMe and SATA erase commands into the UI sounds excellent. This addition would be incredibly valuable, especially with the PDF report. Whenever you're able to implement it, I'm sure it'll be worth the wait. Thank you for considering users' needs and continuously improving the software. Keep up the great work! I'm curious, is there any way for non-developers like myself to support this effort?

[brazier]

I came here looking for this, but the method of using ALT+F2 did the job. could it be an idea to add the hdparm and nvme method to the wiki for now, and/or add a shell script so that for now you could do something like erase-nvme/erase-ssd /dev/device. (i can help out with both if needed)

[Firminator]

u the man! Important contribution. Sorry for missing the correlation.

[Darth-NullVortex]

@PartialVolume Hi, I just wanted to share an important observation that might be useful for your implementation of the secure erase feature. It may be necessary to wipe the partition table and metadata at the beginning of the drive, as I recently noticed that an older SSD I wiped using hdparm still retained its partition table. Since the sanitize function is not supported for this drive, a wipe remains necessary. Additionally, even when sanitize is supported, it does not necessarily remove the partition table. I hope this information helps with your development process.

[PartialVolume]

Thanks for the info. Can you name and shame the make and model of the drive that failed to wipe itself using it's own firmware?

That looks like a good example of where a secure sanitize (using the drives firmware) should be followed by a standard traditional prng wipe, followed by a prng verification rolled into a single method within nwipe which would have resulted in wiping the drive fully and verifying it was correctly wiped, or at least as far as it's possible with an SSD. [Edited]

[Darth-NullVortex]

Certainly! It’s the Samsung SSD 860 EVO 250GB with firmware RVT03B6Q. The drive appears to have been replaced, as these laptops typically house older models as well as completely different ones, so I am rather surprised to find it’s not actually that outdated.

[Firminator]

There might be a slight chance that Samsung fixed the drive's firmware Secure Erase/Sanitize implementation in their latest update @ https://semiconductor.samsung.com/resources/software-resources/Samsung_SSD_860_EVO_RVT0**4B**6Q_Win.iso
Your drive is one version behind. But without a changelog this is like shooting in the dark and just hoping that they fixed it. Might be worth a try though.

[dmf-hd]

New to the subject I have a couple questions using shredos‘ secure erase/sanitize functions for ATA M.2 SSDs and NVME M.2s SSDs.

I am working in a hospital/university environment where the aspect of wiping data completely is crucial. We are planning to replace older laptops that are still good and give them to employees and their families. To meet the wiping criteria of the German Agency for Information Security we need to make sure no data from former use can be recovered. The older laptops do not have the secure erase function in their bios. So I used a newer laptop and put the SSDs of the older laptops in there and erased them with that bios secure erase function. To cross check if the erase procedure was 100% successful (it was per the report) I put the SSDs in an external housing and connected it to a PC thru USB. I then used Disk Drills Deep Scan function to check if there was anything on that disk that could be recovered. When the scan was over Disk Drill had found a system volume information folder with around 80 kb of data that could be recovered.
Now my question is if that is data that was not wiped from the SSD in the first place or that the data was written on the disk as a consequence of connecting the SSD to the PC thru USB?
And would the precence of that data be negligible in the context of that wiping process? What say you?

Now this is where ShreOs comes in. There is still no way to use wiping processes for SSDs thru the GUI but thru commands in the terminal. So if the SSDs would be placed in their respective laptops and wiped in that fashion would they now be completely empty? And what would happen if I took them out and connected them to a PC again to run a Data Recovery Scan. Would it be empty or would I find the system volume information folder again because it’s applied thru the Windows routine when connecting thru USB?

Another question, what is your recommended (most secure) way of erasing data from HDDs using ShredOs. Time is not so much a criteria. But it should avoid unnecessary action and on the other hand should not stress the hard drive more than needed.
Thank you for answering.