1. Home
  2. Security
  3. Securely Erase Data
  1. Home
  2. Servers and Data
  3. Securely Erase Data
  1. Home
  2. For IT Professionals
  3. Securely Erase Data

Securely Erase Data

Computing systems (including desktops and laptops, networking equipment, and other mobile devices) store data on a wide variety of storage media (e.g., hard drives, USB flash drives, floppy disks, CD-ROM’s, tapes, memory).

This data must be securely erased or destroyed prior to surplus disposing of the equipment. When a device has had its data securely erased or destroyed, a clean media label should be affixed to the device, signaling that it is ready for disposal.

The following options are available to securely erase/destroy data:

Method Description Drive Type
Physical Drive Destruction Computer hard drives and storage media can be brought to the Computer Clinic and submitted for destruction. Hard drives will be removed from computers and destroyed. The computer will be returned to you and will require a Surplus Pickup Request to dispose of the electronic waste properly. Any storage media (Recommended)
Securely erasing an Encrypted Volume Volumes encrypted with FileVault 2 or BitLocker can be securely erased without the need to write zeros throughout the entire disk. Solid State and spindle disk drives
(Recommended)
ATA Secure Erase command Software used to securely erase data. Solid State and most modern spindle disk drives
SSD Manufacturer utilities Use software provided by the manufacturer of the drive to erase an SSD. Many manufacturers offer software that allows for securely erasing the drive. Solid State Disks
Disk Zero-ing software Software used to write zeros bit for bit across an entire drive, securely erasing all data on the disk. Traditional magnetic spindle disk hard drives

If you do not feel completely comfortable securely erasing your data, please bring your storage media or equipment to the Computer Clinic, located in i-117 Ira Allen Chapel.

The guides below all involve DATA DESTRUCTIVE processes. To prevent accidental DATA loss, disconnect any disk drives that are not targeted for secure erasure!

Physical Drive Destruction

Computer hard drives and storage media can be brought to the Computer Clinic and submitted for destruction. Hard drives will be removed from computers and physically destroyed.

Computers will be returned to you (with the hard drive removed) and will require a Surplus Pickup Request to dispose of the electronic waste properly.

If your computer does have have removable storage media (NVMe soldered to the system board) the guides below may required to securely erase your data.

This service is provided by Enterprise Technology Services at no cost to departments.

Securely erase a BitLocker encrypted volume

BitLocker encrypted disks enable you to quickly sanitize the device by deleting the encryption key, which renders the data on the drive irretrievable. To sanitize the contents of a BitLocker encrypted disk, follow the steps outlined below.

  • This guide assumes that you are not booted to the disk that you’re attempting to securely erase. You must connect the target disk to another machine via USB dock, or opt to boot to LiteTouch, or Windows Recovery media.
  1. Connect the target disk to the computer.
  2. Press the on your keyboard, search for the Disk Management program.
  3. Verify that the target disk is BitLocker Encrypted. In this example, D: is the target disk.
  4. Right-click on the target volume, from the menu that appears select Delete Volume.
    • If your disk has more than one partition, repeat this step until the disk is completely unallocated space.

Securely erase a FileVault 2 encrypted volume

FileVault encrypted disks enable you to quickly sanitize the device by deleting the encryption key, which renders the data on the drive irretrievable. To sanitize the contents of a FileVault encrypted disk, follow the steps outlined below.

Requirements:

  • macOS 10.12 or higher is required for Disk Utility to see APFS formatted volumes.
  • This guide assumes that you are not booted to the disk that you’re attempting to securely erase. You must connect the target disk to another machine via target disk mode, USB dock, or opt to use Internet Recovery to perform the following steps.

  1. APFS and HFS+ encrypted volumes are housed within a logical “container” disk within the physical disk’s available space. By default, Disk Utility only displays available volumes. To display physical disks and containers, click the “Sidebar” menu and select “Show All Devices“.
  2. Verify that the target volume is encrypted with FileVault by selecting the volume from the Sidebar and viewing its details. If you find that the volume is not encrypted, you may want to use one of the “Alternative Methods” for securely erasing data below. If the machine does not have a removable hard drive, ETS recommends encrypting the disk first, and then proceeding with this guide.
  3. After confirming the disk is encrypted, the disk can be reformatted. It is important to understand that simply reformatting the encrypted Volume is not enough.
    • Seagate Expansion Media = Physical disk
    • Container disk3 = Logical container disk
    • Macintosh HD = Logical Volume
  4. To securely sanitize data on the disk, the entire container must be deleted. To delete the container, select the Physical disk from the Sidebar. In this particular example, the Physical disk is “Seagate Expansion Media”. When the physical disk has been selected, click the “Erase” button.
  5. The default options should work, click the “Erase” button to wipe the container and securely sanitize the disk.

Alternative Methods

ATA Secure Erase command

One of the most efficient ways to securely erase a disk is to issue an ATA Secure Erase command. When a Secure Erase is issued against an SSD all of its cells will be marked as “empty”, restoring it to a factory default state. Most modern magnetic spindle disk drives also support the command.

Requirements:

  • USB bootable SystemRescueCD
  • This guide assumes an IDE, SATA, or PCIe connected disk. In testing, disks connected via a USB dock have also worked.
  • SSD or modern Spindle Disk drives.

  1. Boot to SystemRescueCD on the machine you’d like to securely erase.
    • On Dell systems, you may need to temporarily disable “Secure Boot”.To disable Secure Boot, tap F12 at boot, then select the “Change Boot Mode Setting”. From the options that appear, select “UEFI with Secure Boot disabled”.
  2. SystemRescueCD will boot to a shell prompt.
  3.  SSD drives are locked down with a “security freeze” set by BIOS at boot. To “un-freeze” a disk we can simply put the computer to sleep for a moment with the following command. After the command has been issued, tap the power button to wake your computer and continue to the next step.
    echo -n mem > /sys/power/state
  4. List all connected disks with the following command:
    lshw -class disk

    This will display details of all connected disks, including the “logical name” of each disk. Locate the “logical name” of the target disk and replace /dev/sdX in the commands below with that name.

  5.  Set a security password that will be used to erase the disk. In this case, the password is set to NULL.
    hdparm --user-master u --security-set-pass NULL /dev/sdX
  6. To securely erase the disk run the following command:
    hdparm --user-master u --security-erase NULL /dev/sdX
  7. In testing, the average time for SECURITY ERASE completion was less than two minutes for a 256GB SSD. Note that spindle disk drives will take considerably longer (hours) to complete.
  8. When the command completes, verify the disk has been wiped.

Manufacturer-provided Utilities for SSDs

To securely erase data, hard disk drives fill the occupied space on the drive with a file consisting of zeroes or execute multiple writes of different characters. However, solid-state drives use wear-leveling algorithms that evenly distribute data among SSD blocks, which means that data is constantly moved around on the drive so the blocks will be worn at an equal rate. Standard secure deletion tools damage SSDs by performing an unnecessary number of additional writes without being able to tell where the data is written.

To securely erase data from a solid-state drive, use one of the following methods:

  • Manufacturer-specific software if possible, use software provided by the manufacturer of the drive to erase an SSD. Many manufacturers offer software that allows for securely erasing the drive, as well as other functions such as updating firmware or checking the health of the drive. Use the instructions provided by the manufacturer to erase the SSD. The following manufacturers provide software to securely erase an SSD:

    If you cannot locate the manufacturer of your SSD, or if the manufacturer does not provide software for securely erasing the drive, you can try using a generic utility, or submit the drive for physical destruction at the Computer Clinic.

Data Duplicator (dd) command

Requirements: 

  • USB bootable SystemRescueCD
  • This guide assumes you’re zeroing a magnetic spindle disk drive.
  • If you are looking to securely erase data stored on a Solid State Disk, please see the “Secure erase a BitLocker encrypted volume“, “Secure erase a FileVault2 encrypted volume“, or “ATA Secure Erase” guides above.

  1. Boot to SystemRescueCD on the machine you’d like to securely erase.
    • On Dell systems, you may need to temporarily disable “Secure Boot”.To disable Secure Boot, tap F12 at boot, then select the “Change Boot Mode Setting”. From the options that appear, select “UEFI with Secure Boot disabled”.
  2. SystemRescueCD will boot to a shell prompt.
  3. List all connected disks with the following command:
    lshw -class disk

    This will display details of all connected disks, including the “logical name” of each disk. Locate the “logical name” of the target disk and replace /dev/sdX in the commands below with that name.

  4. To write zeros to the target disk and display it’s progress, use the command below:
    dd if=/dev/zero | pv | dd of=/dev/sdX
  5. When the dd command completes, verify the disk has been wiped.

macOS Disk Utility for Spindle Disk drives

Due to the prevalence of solid-state drives (SSDs), Apple has removed many of the tools previously provided to securely erase data from hard disk drives (HDDs). If you’re looking to securely erase data from an SSD, please use a different guide.

Mac OS X has retained the following built-in options for securely removing data:

  • For whole file systems, use the Disk Utility app, which can be found in any of the following places:
    • In the Applications/Utilities/ folder on your hard drive.
    • Booting to Internet Recovery (Command+Option+R or Command+R)

    In Disk Utility, choose the file system you want to wipe, and then select the Erase tab. If you have a hard disk drive, select Security Options to choose the security level of the erasure.

    If a solid-state drive is detected, Security Options may not be available for selection.

Updated on July 31, 2019

Was this article helpful?

Related Articles

Not the solution you were looking for?
Don’t worry we’re here to help!
Submit a Help Ticket