Why is a secure erase 'not necessary' for SSD's?

Question

I'm about to trade in a 2010 MacBook Pro with an SSD. However, I'm unable to do a Secure Erase from the recovery disk (as I used to do with mechanical hard drives before selling or giving away a computer) since the "Security Options" button is grayed out.

Based on an article in Apple's knowledge base, the button is intentionally disabled for SSD's because:

Note: With an SSD drive, Secure Erase and Erasing Free Space are not available in Disk Utility. These options are not needed for an SSD drive because a standard erase makes it difficult to recover data from an SSD.

This sounds good to me, and this view was confirmed both at the Genius Bar and by calling Apple.

The problem is that almost every article I can find on this subject contradicts Apple's optimistic view about erasing an SSD. Because SSD's dynamically remap blocks on write and because they have large chunks of free space inaccessible to the OS, it's impossible to overwrite the entire drive.

The single explanation that could reconcile these two perspectives is that MacBook SSD's are "self-encrypting", i.e. they generate a random key and store it in the disk's metadata and encrypt all data stored to the drive with that key (additional explanation here). When I use Disk Utility's Erase button on an SSD, the Mac clears out that key, so even though the data hasn't been overwritten, it's all inaccessible ciphertext now that the key is gone, and is as good as zeroed-out.

The problem is that all I can find to back this view up is a post by a knowledgeable member of the Apple Support Forums. Does anyone know if this is really true? Could you point me to something verifying that Apple's SSD's do this?

Answer 1

The problem that I see with "almost every article" is that they're 3-4 years old. Some of them even mention attempting degaussing the drives as a means of clearing out data. That implies a lack of understanding of how Flash storage works in the first place. Seriously. Degaussing?

"ATA Secure Erase" is a means of telling the drive to zero out all the blocks. As well, simply mounting an SSD and deleting all the files with TRIM enabled will cause all the pages to be zeroed on any block that contained data. Of course, that assumes that TRIM has been correctly implemented. Usually, TRIM erase commands are completed by an SSD controller in a few minutes.

http://en.wikipedia.org/wiki/Write_amplification

http://en.wikipedia.org/wiki/Data_remanence#Data_on_solid-state_drives

It's worth noting that this business of recovering data from erased SSDs is not possible by your garden-variety hackers. The techniques the white papers generally describe involve disemboweling the drives and examining individual memory components.

From a consumer-grade perspective, it should be more than sufficient to boot to your recovery partition, delete the primary data partition, repartition the volume and format. It's hard to imagine anybody buying a used MacBook and hunting for data. If you really want to go the distance, you can encrypt your drive with FileVault prior to removing the partitions. At that point, even if a would-be cracker were to hack apart the drive to hunt for data, anything they found would be encrypted anyway.

I just don't consider that to be likely. If you really cannot take the chance, then purchase a replacement HDD and trade it in keeping the SSD.

I also agree with njboot: Linc knows his stuff.