20

Up to Yosemite I regularly used Disk Utility with Erase > Security Options... > writes a single pass of zeros over the entire disk... as a simple method to fully check that a disk is fully safe before installing a new system or backup on it.

For me it is a rule of thumb to fully verify a medium before starting production work on it.

Since El Capitan (and consequently on Sierra), this function isn't apparently accessible.

Is this function hidden somewhere else?

What are the other options to fully really erase a disk, whatever the technology used might be, the purpose being to verify that one can write everywhere on a disk without any bad surprise later?

22

Use diskutil from Terminal. The following command

diskutil secureErase 0 /dev/diskX

Will erase your disk, identified by X, with a single pass of zeros. You can get a list of the options available to you by issuing the command without any options:

$ diskutil secureErase

Usage:  diskutil secureErase [freespace] level MountPoint|DiskIdentifier|DeviceNode
Securely erases either a whole disk or a volume's freespace.
Level should be one of the following:
        0 - Single-pass zeros.
        1 - Single-pass random numbers.
        2 - US DoD 7-pass secure erase.
        3 - Gutmann algorithm 35-pass secure erase.
        4 - US DoE 3-pass secure erase.
Ownership of the affected disk is required.
Note: Level 2, 3, or 4 secure erases can take an extremely long time.


Secure Erase and SSDs

You don't need to do a secure erase of an SSD because a a standard erase is already more than enough to secure your data. The reason you needed multiple passes or even the DoD 7 pass secure erase was because with traditional hard drives (HDDs) the data was stored on magnetic platters which left a residual magnetic imprint even when wiped. This is how COTS (Commercial Off the Shelf) utilities like Disk Drill software is able to reconstruct a drive. This is not the case with an SSD; nothing is magnetized.

In fact, it is recommended (read that to mean highly advised) that you don't do a secure erase because you would be shortening the life expectancy of your SSD due to the increased write operations.

Per Apple:

Note: With an SSD drive, Secure Erase and Erasing Free Space are not available in Disk Utility. These options are not needed for an SSD drive because a standard erase makes it difficult to recover data from an SSD. For more security, consider turning on FileVault encryption when you start using your SSD drive.

Now, if TRIM is enabled (and it should be if your Mac came with an SSD from the factory), it will handle the task of freeing up the blocks of data no longer in use making them available for immediate writing.

Regular HDDs didn't do this. When you deleted a file, it only deleted the pointer to the data, not the data itself.

  • It looks like the correct command for my case is diskutil secureErase 0 /dev/diskX. – dan Oct 21 '16 at 15:36
  • True. I just used "2" as an example because the "0" could potentially get confusing. When I first used the utility, I thought "7" was for the seven pass DOD. – Allan Oct 21 '16 at 15:39
  • 1
    It's truly bizarre that these erase methods designed for 1980s and 1990s disks are still accessible, and that they're called "levels". – Michael Hampton Oct 21 '16 at 20:43
  • @MichaelHampton - I am not sure why Apple chose "level"; that's up the them. But SSD's which don't require secure erasing didn't become mainstream until a few years ago. Even today, we still have TSM or traditional spinning media so we still need the tools. – Allan Oct 21 '16 at 20:48
  • @Allan You're using ancient MFM or RLL drives in modern systems? That's the only thing you might possibly need a "US DOD 7-pass" or the other two for. And you don't use any of these for SSDs, unless you're trying to destroy it. – Michael Hampton Oct 21 '16 at 20:50
5

Both Allan and Klanomath provide accurate advice on how to do this via Terminal. However, if you're wanting to do this with a HDD (and not an SSD), the option is still there in Disk Utility, although it's changed.

Follow these steps:

  1. Select the volume (not the physical disk, and not an SSD) in the sidebar
  2. Click the Erase button
  3. Click on Security Options
  4. Select the level of secure erase in the next window by moving the slider. You'll find that there's an option to randomly write data followed by a single pass of zeros across the entire drive.

Hope this helps.

  • Thank you for this correct information. But like many users, I will forget it. This is the reason why I hate so much hidden functions. – dan Oct 21 '16 at 15:43
  • But I thought this option wasn't there in Sierra? Isnt that what OP and other answers say? @danielAzuelos – Revetahw says Reinstate Monica Oct 21 '16 at 19:48
  • @Fiksdal The option is only available if you select a HDD in the sidebar. Selecting anything else, such as a SSD, does not present the user this choice as there's no need to do a Secure Erase on SSDs. – Monomeeth Oct 21 '16 at 22:13
  • N.B. you need to select the hard drive's partition, not the hard drive itself. If it's unpartitioned, or in a format that OS X doesn't recognise, then you have to create a partition first, then proceed with the Erase. – Sparhawk May 29 '17 at 1:57
3

The unsecure/secure erase is only accessible via Terminal > diskutil zeroDisk|randomDisk|secureErase device.

man diskutil helps:

zeroDisk [force] device
            Erase a device, writing zeros to the media.  The device can be a whole-disk or a partition.  In either
            case, in order to be useful again, zero'd whole-disks will need to be (re)partitioned, or zero'd parti-
            tions will need to be (re)formatted with a file system, e.g. by using the partitionDisk, eraseDisk, or
            eraseVolume verbs.  If you desire a more sophisticated erase algorithm or if you need to erase only
            free space not in use for files, use the secureErase verb.  The force parameter causes best-effort,
            non-error-terminating, forced unmounts and shared-mode writes to be attempted; however, this is still
            no guarantee against drivers which claim the disk exclusively. In such cases, you may have to first
            unmount all overlying logical volumes (e.g. CoreStorage or AppleRAID), or, if a disk is partially dam-
            aged in just the wrong way, even un-install a kext or erase the disk elsewhere.  Ownership of the
            affected disk is required.

 randomDisk [times] device
            Erase a whole disk, writing random data to the media.  Times is the optional (defaults to 1) number of
            times to write random information.  The device can be a whole-disk or a partition.  In either case, in
            order to be useful again, randomized whole-disks will need to be (re)partitioned, or randomized parti-
            tions will need to be (re)formatted with a file system, e.g. by using the partitionDisk or eraseDisk
            verbs.  If you desire a more sophisticated erase algorithm or if you need to erase only free space not
            in use for files, use the secureErase verb.  Ownership of the affected disk is required.

 secureErase [freespace] level device
            Erase, using a secure method, either a whole-disk (including any and all partitions), or, only the free
            space (not in use for files) on a currently-mounted volume.  Erasing a whole-disk will leave it useless
            until it is partitioned again.  Erasing freespace on a volume will leave it exactly as it was from an
            end-user perspective, with the exception that it will not be possible to recover deleted files or data
            using utility software.  If you need to erase all contents of a partition but not its hosting whole-
            disk, use the zeroDisk or randomDisk verbs.  Ownership of the affected disk is required.

            Level should be one of the following:

                  o   0 - Single-pass zero-fill erase.

                  o   1 - Single-pass random-fill erase.

                  o   2 - US DoD 7-pass secure erase.

                  o   3 - Gutmann algorithm 35-pass secure erase.

                  o   4 - US DoE algorithm 3-pass secure erase.
  • I understand this choice: protect the innocents. – dan Oct 21 '16 at 15:28
  • I fell in love with the scrollbar! I will never miss the Disk Utility :). – dan Oct 21 '16 at 15:35
  • @danielAzuelos I tried to reveal some hidden feature in Disk Utility by using a lot of possible key-combos alt, cmd-alt + menubar item, starting DU with alt-key pressed but I couldn't find anything: I think secure erase was removed completely. – klanomath Oct 21 '16 at 15:41
  • 3
    @danielAzuelos Choose Allan's answer. He was the 1st one answering your question... And with your 10 points I earned the site analytics privilege - that's good enough... ;-) – klanomath Oct 21 '16 at 15:51
  • 1
    @danielAzuelos I would ask him to improve his answer a little bit (e.g hdd<->ssd ) ;-) and lure him with the 15 points – klanomath Oct 21 '16 at 15:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .