Ubuntu – How to securely wipe files from SSD drive

hard drivesecure-eraseshreddingssd

When trying to securely wipe SSDs, we have several problems:

  • SSDs wear out after a limited amount of erase cycles
  • SSDs have a controller that dynamically maps LBAs (logical block addresses used by the system to access the disk) to NVRAM cells (the actual flash memory cells) to balance the wear, which means telling the disk to overwrite the blocks that formerly stored a specific file may result in overwriting any other spare blocks.
  • SSDs have a notable percentage of reserve capacity that is used to compensate dying storage cells and reduce wearing. They are not visible to the system and might hold old data fragments.

Now what options do we have from inside Ubuntu to securely wipe SSDs?

I've heard that some newer SSDs should be able to securely wipe themselves, but how do I find out whether my SSD is capable of this and how would I trigger it?
There should also be an ATA secure erase command, how do I find out if that is supported and how would I trigger that?

Are there also ways to securely wipe only a given file or only unused space?
I guess making a backup of all partitions, securely wiping the entire disk and then restoring the backup would be possible but sounds too complicated and would take too long to be practical. Are there other alternatives? If not, what tools can I use to backup partitions without also backing up already deleted files?

Of course the standard tools like shred or wipe are not usable here for the points described above. They simply overwrite a a file (by overwriting its file system clusters which are bound to LBAs which are not constantly pointing on the same flash cells due to the wear levelling controller).

Best Answer

Currently there's no way to securely erase files on SSD without erasing the content of the whole drive or access to the firmware of the SSD.

  • It's impossible to know where the SSD may store previous copies of a logical block.

  • To make matters worse, due to journalling and copy-on-write mechanisms of the file system it may be impossible to know which logical blocks may hold a previous copy of a particular file.

The only way to prevent the leakage of deleted files to someone with direct access to the drive is to encrypt them in the first place and keep the encryption key safe from prying eyes.

Addendum:

I did some research and found out that you can sort-of erase all previously deleted files if you manage to learn all the unoccupied sectors of a file system, which is generally possible and offered by some file system tools (e. g. for the ext* family), and then discard them (e. g. with blkdiscard(8) as outlined in this answer to the linked question), which returns the blocks for garbage collection until they're used again and overwritten in the process.

This is secure against everyone who cannot access the flash cells directly, so everyone who

  • doesn't have a suitable flash cell reading device and
  • cannot talk the drive firmware into revealing the content of unassigned blocks (which would require a meaningful modification of the firmware in most cases and custom ATA commands since there's no standardised way).
Related Question