Flash Foundations companion · Simulator
Secure Erase Lab
Deleting a file on an SSD does not remove it from the chips. Write a secret, try delete, format, TRIM and overwrite, and count how much of it someone could still read off the NAND. Then see what the drive's own erase commands reach.
The walkthrough
Six tests, one drive
Every test below has already run and shows its result. The left grid is what the computer can read, and the right grid is every flash page. A menu under each title picks another case.
- A piece of the secret
- A stale copy of the secret
- Other data
- Other stale data
- Empty page
- A piece in a retired block
- Unreadable without the old key
- SLC cache block (dashed frame)
- Retired block (red frame)
- Host reads zeros
- Host: never written
Test 1
Delete and format only change bookkeeping
Deleting a file or quick-formatting changes the file table and little else. The host may read zeros, yet the pieces stay on the chips until garbage collection erases their blocks.
The host reads data at 12 addresses and zeros at 0. The chips still hold 12 of 12 pieces of the secret.
| Where on the chips | Before | After |
|---|---|---|
| Main area | 0 | 0 |
| Spare area | 0 | 0 |
| SLC cache | 12 | 12 |
| Retired blocks | 0 | 0 |
Test 2
Overwriting writes somewhere else
NAND cannot change a page in place, so each overwrite goes to a fresh page and the old page goes stale. More passes cost more writes and leave the old copies where they were.
The host reads data at 12 addresses and zeros at 0. The chips still hold 12 of 12 pieces of the secret.
| Where on the chips | Before | After |
|---|---|---|
| Main area | 0 | 0 |
| Spare area | 0 | 0 |
| SLC cache | 12 | 12 |
| Retired blocks | 0 | 0 |
Test 4
Commands the drive runs itself
These commands run inside the drive, so they reach flash the computer cannot address. Retired blocks are the hard case, because only some commands are certain to reach them.
What the drive said: success. The host reads data at 0 addresses and zeros at 160. The chips still hold 6 of 12 pieces of the secret.
| Where on the chips | Before | After |
|---|---|---|
| Main area | 0 | 0 |
| Spare area | 6 | 0 |
| SLC cache | 12 | 0 |
| Retired blocks | 6 | 6 |
Test 5
Trust, then verify
A drive can report success and change nothing. On the correct drive the report and the chips agree, and on the buggy drive only the chips tell the truth.
What the drive said: success. The host reads data at 0 addresses and zeros at 160. The chips still hold 0 of 12 pieces of the secret.
| Where on the chips | Before | After |
|---|---|---|
| Main area | 0 | 0 |
| Spare area | 12 | 0 |
| SLC cache | 12 | 0 |
| Retired blocks | 0 | 0 |
Test 6
Myths, tested
Many erase habits come from hard drives. Pick one and the same drive shows what it does, and the full list with sources is under How it works.
The myth: Emptying the Recycle Bin erases the file. No. The file is gone from the file table and 12 of 12 pieces of the secret are still on the chips.
| Where on the chips | Before | After |
|---|---|---|
| Main area | 0 | 0 |
| Spare area | 0 | 0 |
| SLC cache | 12 | 12 |
| Retired blocks | 0 | 0 |
The sandbox
Try every action
Illustrative model, not vendor data. Trends are real, numbers are not.
Now
- Host writes
- 0
- NAND writes
- 0
- GC copies
- 0
- Block erases
- 0
- Write amplification
- none yet
The same drive, two views
The left grid is every address the host can read. The right grid is every flash page, drawn with the legend above the walkthrough. Hover a page for its detail.
| Where on the chips | Pieces of the secret | Other data |
|---|
What you have done
The newest action is first.
Nothing yet. Press an action. The tests above show what each one is for.
On your drive
Build the commands for a real drive
Pick your drive and your setup. The page lists the commands to run, one at a time. Nothing here reads or writes your drive, and nothing is copied until you press Copy on a step.
Erasing is permanent. Every command below uses a placeholder, never your real device. Work out which device is which first, and never erase the drive your system is running from. These steps come from the man pages, the hdparm and nvme-cli source and the NVMe and ATA specifications, not from your drive, so read each one before you run it.
NVMe drives and SATA drives are erased by different commands, so the choice changes the steps.
How it works
The drive has 4 dies of 8 blocks of 8 pages: 256 pages. Each address (LBA) is one page. The host can address 160 of them by default, and the rest is overprovisioning. A flat file table sits on top, enough to tell deleting a file from erasing the drive.
Writes are striped across the dies in turn. A write goes to a new page and the old page becomes stale. When free blocks run low, garbage collection copies the valid pages out of the fullest stale block and erases it. When the drive is idle, it folds the SLC cache into the main blocks, and when the cache is full, writes go straight to the main blocks. It also reclaims blocks that are at least half stale. Every one of these rules is a teaching value. The sources and method say where each comes from.
Chip-off here means reading every flash page, plus the drive's key store. On a self-encrypting drive, a page written under a key the drive has since replaced counts as unreadable.
In the model every method reaches the main area, the spare area and the SLC cache, though a few of those cells are assumed. Retired blocks are the gap: only ATA Enhanced Secure Erase and the crypto erases are certain to reach them. The full table, each cell with its source, is on the sources and method page.
Terms
LBA, File table, Chip-off, TRIM, Garbage collection, Out-of-place write, Stale page, Write amplification, Overprovisioning, SLC cache, Retired block, ATA Secure Erase, Format NVM, Sanitize, Namespace, Media encryption key, Crypto erase, Sanitize Status log, Clear, Purge and Destroy. The sources and method page defines each one.
Ten myths, checked
Seven run in test 6. The sources and method page gives the reasoning for each.
- Emptying the Recycle Bin erases the file. No.
- A quick format wipes the drive. No.
- TRIM is a secure erase. No.
- A 3-pass or 7-pass overwrite is safer on an SSD. No.
- diskpart clean all or writing zeros with dd purges an SSD. Not by itself.
- An erase command always works. No.
- Crypto erase is too fast to be real. Real, with a condition.
- Removing BitLocker protectors erases the drive. No.
- A drilled hole destroys the drive. Not reliably.
- Pulling the power stops a sanitize. No.
What it leaves out
- One secret of 12 pieces and a handful of other files. There is no compression, no deduplication, no ECC and no wear leveling beyond taking turns between dies.
- Real drives hide their layout. The size of the spare area, the cache policy and the garbage collection rules differ from drive to drive, and nobody outside can see them.
- The SLC cache is two blocks. It folds when the drive is idle, and writes go straight to the main blocks when it is full, as one published study of SLC-TLC storage describes. Real caches differ in size and policy.
- A trimmed address reads zeros in the model, as some drives do. Not every drive does.
- ACS-3 says the normal ATA erase leaves reallocated data alone, a later ATA draft (ACS-4) says it may write it, and the enhanced erase writes it, so the normal erase is not guaranteed to reach it. NVMe says retired media cannot be sanitized and does not promise to erase it, so the model leaves it alone for Format and Sanitize, and only crypto erase reaches it, through the key. Real drives may clean some of it.
- Crypto erase takes no time in the model because it erases no block. The model has no clock.
- The failures modeled are two: a drive that skips the spare area, and a drive that reports success and does nothing. Wei et al. found the second kind in one of the drives they tested.
- Chip-off assumes the reader can get the drive's key store as well as the pages.
- The commands on this page are the ones whose options could be checked against a man page, the hdparm or nvme-cli source, or the NVMe and ATA specifications. The lab shows the ATA Sanitize commands but does not simulate them, and it does not cover vendor tools.