Secure file erase on SSD

Rewriting the entire disk is not recommended for an SSD, and is anyway not required, since most modern SSDs have the ability to secure erase the entire disk in one giant TRIM operation.

Toshiba does not furnish such a utility for your disk, so you need to use a third-party solution.

Here is one such free solution:

• Parted Magic in System Tools, Erase Disk

Generally speaking, there are a few common ways to erase a storage device:

1. By overwriting storage blocks containing data with a bit pattern. This is the most common method for standard spinning hard drives.
2. On NAND flash devices, by performing a block erase operation that physically destroys data from memory cells.
3. On storage devices that keep track of used/free storage blocks (e.g. SSDs) by deleting the mapping between logical block address and the corresponding physical block, leaving the data on said block intact (and therefore recoverable).
4. On self-encrypting drives, by destroying the encryption key stored on the drive, rendering the data unreadable. This is often combined with destroying all block mappings on the drive.

Each storage protocol (ATA, SCSI, NVMe) has its own set of commands for sanitizing a storage disk.

• The ATA protocol specifies the SECURITY ERASE UNIT command with two modes, normal mode and enhanced erase mode: normal mode specifies overwrite with zeroes; enhanced erase specifies a "predetermined data pattern" and additionally targets "sectors that are no longer in use due to reallocation". New ATA drives might also support the new SANITIZE command with three modes: crypto scramble, block erase and overwrite.
• The SCSI protocol defines a SANITIZE command with three modes: overwrite, block erase and cryptographic erase (where the encryption key is deleted from the drive).
• The NVMe specification defines two commands: Format (for a NVMe namespace) and Sanitize (for the whole device). The Format command itself has three modes: no secure erase, user data erase and cryptographic erase. The Sanitize command also has three modes: block erase, crypto erase and overwrite.

Since the implementation of ATA SECURITY ERASE UNIT is manufacturer-dependent, I can only guess that calling this command on Sandisk drives will not completely erase your data; another drive manufacturer might use a different and more secure method altogether. Regardless, it is almost always preferable to use the SANITIZE command when available, or even combine multiple SANITIZE commands; Micron actually recommends a SANITIZE CRYPTO SCRAMBLE followed by a SANITIZE BLOCK ERASE on their SATA SSDs.