8

I just got one of the new 12-inch MacBooks and would like to wipe the storage drive. With a conventional SATA drive I'd use the "ATA Secure Erase" command which can be sent from a Linux environment using the hdparm utility.

With the new NVME drive this does not work. I found a Linux utility called nvme-cli but even with its format option it fails with an error INVALID_OPCODE(1) (looks like the NVME controller rejects the command).

I've tried multiple permutations of the command and options, including targeting the raw NVME controller /dev/nvme0 or one of its namespaces instead /dev/nvme0n1, different parameters to the -s option, etc. I also bought Parted Magic which claims to be able to secure-erase NVME drives and unfortunately that fails as well.

I'm currently just doing it the old-school way with shred which writes random data to the drive but obviously this isn't ideal as it's slow and shortens the live of the drive, so I'd love to know the proper method to use in the future.

Regards.

Improve this question

1 Answer 1

Reset to default
3

The proper / official / thorough way to sanitize an Apple SSD is to enable FileVault before you copy any data to it. When you shred the encryption keys - the data is cryptographically erased instantly.

Note: With a solid-state drive (SSD), secure erase options are not available in Disk Utility. For more security, consider turning on FileVault encryption when you start using your SSD drive.

Apple’s terse recommendation requires you to read between the lines or know about cryptographic sanitization of data and read up on FIPS / etc...

That being said, I would just install a new OS and then enable FileVault which will then encrypt each block on the drive with the new keys - a one time erase pass.

Then you can decide if you want to put it back in service or destroy those keys without decrypting the contents of the drive.

Improve this answer
5
  • This isn't as much about protection of new data, but for getting random machines off eBay and ensuring they are clean before resale. ATA Secure Erase was my initial routine which would make sure there's no malware/screwed up partition table/questionable content from the previous owner. As far as I know using Disk Utility's erase feature still keeps the existing partition table, and possibly even leaves the EFI partition untouched.
    – André Borie
    Nov 26, 2017 at 16:59
  • You can’t securely erase data that’s held in reserve on SSD. You would need to destroy the device or have the OEM vendor let you overwrite all the memory cells - not just the majority fraction that are in use now. @AndréBorie sorry to be the bearer of bad news.
    – bmike ♦
    Nov 26, 2017 at 17:01
  • Sorry but that's incorrect - the secure erase feature is designed exactly for this and works fine (well assuming you trust the SSD firmware to do its job right). There is such a feature in NVME as well but for some reason the Apple SSD has problems with it - maybe there's a special set of commands to send first.
    – André Borie
    Nov 26, 2017 at 17:02
  • 2
    I said OEM vendor as Apple doesn’t provide this - i get it’s theoretically possible and being programmed into future / current storage standards.
    – bmike ♦
    Nov 26, 2017 at 17:04
  • Not being a protectionist ... Create a file. Fill to you run out of space. Erase. Repeat fill process. Erase. This should hit all blocks since the hidden block should be used in the second fill process. Note: this will reduce the life of the drive. There are no guarantees this will meet government specs. The only thing to do is to destroy the drive for the truly worried individual user.
    – historystamp
    Sep 4, 2019 at 3:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .