The term “Secure Erase” commonly refers to sanitizing data in a way that it cannot be reconstructed through advanced forensic techniques. However, Secure Erase is a firmware-based command defined by the drive’s manufacturer. Its exact behavior depends on the storage technology and the manufacturer’s implementation. As storage architecture has evolved, the erase mechanism has also changed across ATA-based drives such as SATA HDDs, SATA SSDs, and NVMe drives. ATA and NVMe storage devices may support firmware-based sanitization operations, which include:
- ATA Security Erase Prepare
- ATA Security Erase Unit
- NVMe Sanitize and
- NVMe Format
Global data destruction standards, including the older version of NIST SP 800-88 R1 and modern IEEE 2883:2022, explain Secure Erase under the “purge” category for ATA-attached drives. On the other hand, IEEE 2883:2022 further defines Cryptographic Erase as a purge technique for encrypted storage media. Together, these standards outline how organizations must permanently sanitize data without the need for physical hardware destruction.
The Secure Erase command comes in two forms: Normal Erase and Enhanced Erase.
Normal Erase targets all data within the user-addressable storage range, covering from LBA (Logical Block Addressing) 0 through to the maximum addressable sector as defined by READ NATIVE MAX or READ NATIVE MAX EXT. It replaces existing contents with zeros or ones.
Enhanced Erase takes things a step further. It covers all previously written user data, including areas that are no longer in use due to sector reallocation, spare areas, and vendor-specific cache or buffer regions. However, its exact behavior varies by vendor and the specific drive model, due to which the level of sanitization is not always consistent across different devices.
Note: Secure Erase (SECURITY ERASE UNIT) is an ATA-specific command and does not apply to SCSI or SAS drives. The SCSI standard provides native alternatives such as the SANITIZE command (supporting Overwrite, Block Erase, and Crypto Erase modes and FORMAT UNIT with security options.
How Does Secure Erase Work Across Different Types of Storage Media?
Secure Erase is a set of firmware-level commands that do not function in the same way across every type of storage media. The underlying technology of each drive determines how the command is executed and how effective it is.
For HDDs, Secure Erase is an ATA-firmware command in which the drive writes a pattern (typically zeros) over each logical sector on the media. SSDs and other NAND-based devices are more complex. ATA Secure Erase is categorically different from a Purge-level erase for SSDs, as wear-leveling, remapping, and over-provisioned spare blocks cannot ensure that all physical NAND cells have been erased; it is normally considered a Clear-level erase.
eMMC devices use vendor-specific software and internal Block Management to execute commands such as Secure Erase and Secure Trim. While similar to ATA, their effectiveness depends heavily on how the vendor has implemented the firmware and how internal block management is handled. For NVMe, there are device-level sanitization commands specific to the NVMe architecture, such as NVMe Sanitize, NVMe Block Erase and NVMe Cryptographic Erase, that typically provide more reliable sanitization at the device level.
Hard Disk Drives
Secure Erase commands are used as a data sanitization method to overwrite magnetic data on SATA and PATA hard drives completely. On HDDs, Secure Erase works through ATA-level firmware commands issued directly to the drive controller. These commands instruct the controller to overwrite every magnetic sector with a fixed data value, typically zeros. The key ATA commands are:
- Security Erase Prepare: This command checks the security status of the drive and unlocks the drive for the erase command. This command can only be used after a user password is set on the drive.
- Security Erase Unit: This is the execution command that runs after the Prepare command. It works at the firmware level to overwrite all sectors with zeros. The standard version, known as Normal Erase, only covers user-addressable LBAs and leaves reallocated sectors and hidden areas like the HPA and DCO untouched.
It is the Enhanced Secure Erase variant that extends coverage to reallocated sectors and additional reserved areas, though HPA and DCO removal typically require separate commands (READ NATIVE MAX / DCO RESTORE).
Note: Most modern drives support the Enhanced Secure Erase command, which delivers a more thorough level of sanitization than the standard Secure Erase.
Solid-State Drives
For flash-based storage like SSDs, ATA Secure Erase is considered only a Clear mechanism. This is due to variability in implementation across manufacturers and the possibility that sensitive data may remain in areas such as spare cells and wear-leveling regions that have been rotated out of active use.
For SSDs, NIST & IEEE 2883 recommends Cryptographic Erase or the ATA Sanitize command as the preferred Purge-level sanitization methods. SSDs handle Secure Erase differently from HDDs, and that difference comes down to how NAND flash memory works. The drive controller does not magnetically overwrite data on the drive but instead resets the logical state of LBAs on the drive and lets the drive's internal firmware and garbage collection mechanisms handle the rest.
- ATA Secure Erase: ATA Secure Erase is the same ‘ATA firmware command’ implemented as a feature of HDDs, but behaves differently on SSDs due to the nature of NAND flash architecture. That tells the drive's firmware to remove all user-visible data. But the way SSDs manage "spare blocks" and "wear-leveling", there’s no assurance of complete erasure of all physical NAND cells.
- ATA Sanitize: ATA Sanitize is a more comprehensive and contemporary command designed to perform data sanitization on block-storage media, such as NAND flash. Unlike ATA Secure Erase, it goes beyond user-visible LBAs and supports three sanitization options: “Overwrite”, “Block Erase”, and “Crypto Scramble”.
Non-Volatile Memory Express Drives
NVMe drives introduce their own firmware‑level sanitization commands, including ‘NVMe Sanitize’, ‘NVMe Format’, and ‘Crypto Erase’. These commands instruct the NVMe controller to erase all user data at the hardware-level without any dependence on the operating system.
NVMe Sanitize Command
NVMe has a similar command built in, but instead, it instructs the controller to remove the user data directly from the hardware-level Sanitize command. There are three sanitize actions: Overwrite, Crypto Erase, and Block Erase. The method of erasure depends on the sanitize action chosen. Each one uses a different mechanism to make user data inaccessible.
- Block Erase: Block Erase sanitize command alters user data with a low-level block erase method that is specific to the media across all locations where user data may reside. This operation uses the NAND/flash native erase mechanism (erase blocks) to remove stored charge and typically results in the physical erasure of the data on the media. It is hardware‑level, does not rely on the host OS, and is useful when the drive does not rely solely on encryption for data protection.
- Crypto Erase (Cryptographic Erase): CE alters user data by changing or deleting the media encryption keys used to protect stored data. Because all user data on the device is stored in an encrypted manner, discarding or replacing the key renders the ciphertext irrecoverable, making the data unreadable immediately. Crypto Erase is only effective if the drive uses hardware‑based encryption.
- Overwrite: As per IEEE 2883:2022, Overwrite is a sanitization action that writes a fixed pattern across all user data locations on the drive, including over-provisioned areas. If the Overwrite technique is not completed successfully, then, as per IEEE, retry or use another Purge method.
NVMe Format Command
The NVMe Format (nvme format) command reinitializes the namespace layout, covering things like sector size and metadata. Depending on the device firmware, it may trigger a media-level erase, but this is not guaranteed. It cannot be relied upon as a Purge-level sanitization method on its own.
When a User Data Erase is explicitly requested (e.g., nvme format -s 1 /dev/nvme0n1), the firmware may perform a low-level erase of the namespace, but even then, it does not guarantee erasure of all physical NAND locations, including over-provisioned areas.
eMMC Storage (Mobile Devices & Embedded Systems)
Embedded MultiMediaCard (eMMC) storage is the standard storage type used in smartphones, tablets, and other embedded devices, unlike conventional SATA or NVMe drives. eMMC devices do not support ATA-level commands, so the sanitization cannot be done the same way as conventional drives. Erasure is carried out through firmware-based commands that operate directly within the eMMC controller.
IEEE 2883:2022 mentions guidelines for wiping eMMC storage under section 8.8, embedded flash on boards & storage devices. If supported, a Clear operation may be performed by resetting the device to its factory settings. Purge does not apply to embedded flash; hence, a stronger sanitization is required, like Destruct.
Secure Erase vs. Traditional Data Wiping Methods
Many organizations rely on unstructured data wiping methods, such as formatting, factory reset, and data deletion, to permanently remove sensitive data from storage media. But, these methods are highly unreliable as data recovery software can easily recover data from formatted drives, making the format largely ineffective.
A factory reset brings a device back to its original state, as it was when first purchased. User data, downloaded applications, and personal settings all disappear at the operating system level. However, that's only one side of the story. The residual data has never actually gone away from the drive and can be retrieved long after the reset.
This is why media sanitization standards such as NIST SP 800-88 R2 and IEEE 2883:2022 recommend firmware-level commands like ‘Secure Erase’ as the preferred Purge-level sanitization method over traditional wiping methods. Executing these commands across different drive types, each with its own architecture and firmware mechanism, requires an expert level of technical knowledge that may not always be available within an organization.
Dedicated data erasure software solutions, like BitRaser, bridge that gap by automating drive-specific sanitization commands without requiring deep technical expertise. BitRaser aligns with NIST 800-88, US DoD, IEEE 2883:2022 Clear & Purge, and 26 other internationally recognized erasure standards, and supports all major storage types, including HDDs, SSDs, SEDs, NVMe drives, Macs (Apple Silicon and Intel-based), Chromebooks, and servers.
