Safe way to secure-wipe a RAID0 SSD?

[Cyber Akuma]

I currently have two Samsung 830 256GB SSDs in RAID0. I am running out of space and planning to upgrade them. The new drives will be pretty expensive though, so I plan the sell the old ones on ebay to make at least some money back.

Since these hold my OS, all my logins, my apps, games, etc. and I am going to be selling them to who knows, I am going to wipe them.

Problem is, most drive erasure tools are designed for a HDD and work by constantly overwriting the data repeatedly. I doubt the cells of a SSD need to be repeatedly overwritten to be properly erased, and repeated erase and re-writes can eventually damage a SSD.

What would be the best way to secure-erase a SSD safely? And would it be best to wipe them together in the RAID0 or separately?

(Hopefully I won't have any issues backing up and restoring a drive image to a SSD RAID)

 

[ilal2ielli]

http://www.cnet.com/how-to/how-to-securely-erase-an-ssd-drive/

Undo array first.

 

[skiddierow]

I would use hdparm in linux to issue a secure-erase command, though there might be bootable tools to accomplish it...

https://ata.wiki.kernel.org/index.php/ATA_Secure_Erase#Alternative_ATA_Secure_Erase_Tools

 

[evilsofa]

You are correct that older wipe utilities written for HDDs (particularly the popular DBAN) simply do not work properly on SSDs due to wear leveling algorithms.

As ilal2elli notes, you need to wipe them separately, not while they are in RAID.

Here's a walkthrough about how to do it with PartedMagic, hdparm, or Samsung Magician. Since you are wiping Samsung drives, Samsung Magician's Secure Delete is probably the easiest method. That walkthrough is good because it notes what to do about freeze locking.

Here's a brief talk about Samsung Magician's Secure Delete. It also talks about how to deal with freeze locking, and also says it's "easier to erase a drive with Intel's RAID setting over Intel's AHCI setting".

 

[ezno_matrix]

Any reason you do not use drive encryption in the first place?

 

[phis6]

You can try Active@ Kill Disk as it also supports SSD secure wiping.

 

[MrGuvernment]

Any reason you do not use drive encryption in the first place?

overhead
recovering data if you have issues
why bother with a home system

 

[ezno_matrix]

overhead

With modern hardware overhead is negligible.

recovering data if you have issues

Not an issue if the data is backed up properly. Considering the OP is running RAID0, it would be dumb not to have a good backup.

why bother with a home system

If that is the case, why bother wiping the drives? Since a home system does not need data protection, why not sell the drive as they are with all the logins, apps, games, etc?

 

[TCM2]

why bother with a home system

Just look at the thread you posted this in? That's why.

 

[devman]

Most drives that feature FDE are always encrypting regardless of whether the feature is "enabled". The drive firmware will simply load the key material automatically when the device is started (either because the key is stored unwrapped or wrapped with a default password). This is how some of the newer HDDs do a Secure Erase quickly, they simply forget the old key and generate a new one which renders all the data currently on the drive unreadable, no need to physically erase the sectors.

 

[MrGuvernment]

If that is the case, why bother wiping the drives? Since a home system does not need data protection, why not sell the drive as they are with all the logins, apps, games, etc?

encryption is one thing, formating / deleting data is another. Most people dont know how to recover a driver from a full format. and even then good luck pulling enough of anything to get passwords, unless you saved them all in a text file.

 

[PliotronX]

With modern hardware overhead is negligible.


Not an issue if the data is backed up properly. Considering the OP is running RAID0, it would be dumb not to have a good backup.


If that is the case, why bother wiping the drives? Since a home system does not need data protection, why not sell the drive as they are with all the logins, apps, games, etc?

Measurable or not, there is still overhead and in some cases it can be noticeable. FDE makes troubleshooting more difficult for example suddenly you need the BitLocker key to boot safe mode. I like the idea of storing data into containers a la BestCrypt Traveler. A lot less to worry about. FDE is for people who just cannot for the life of them secure sensitive data (most office workers whom I have to help troubleshoot).

 

[Cyber Akuma]

http://www.cnet.com/how-to/how-to-securely-erase-an-ssd-drive/

Undo array first.

I know to undo the array first now, since absolutely everybody is recommending that.

However, I saw that guide before, and I am not sure about that one. It's mentioning tools, some of which haven't been updated in years, that were meant to erase a HDD, they are just using them on a SSD.

You are correct that older wipe utilities written for HDDs (particularly the popular DBAN) simply do not work properly on SSDs due to wear leveling algorithms.

As ilal2elli notes, you need to wipe them separately, not while they are in RAID.

Here's a walkthrough about how to do it with PartedMagic, hdparm, or Samsung Magician. Since you are wiping Samsung drives, Samsung Magician's Secure Delete is probably the easiest method. That walkthrough is good because it notes what to do about freeze locking.

Here's a brief talk about Samsung Magician's Secure Delete. It also talks about how to deal with freeze locking, and also says it's "easier to erase a drive with Intel's RAID setting over Intel's AHCI setting".

VERY helpful, thanks a lot

Any reason you do not use drive encryption in the first place?

overhead
recovering data if you have issues
why bother with a home system

Pretty much, all this. I see zero reason to encrypt my personal desktop at home. The only way anybody will get at it is if they break into my house, bother to undo the million wires to steal my computer instead of just taking my TVs and other electronics, and then actually caring to break the Windows password and root through the data instead of just toss it on craigslist or whatever.

Not an issue if the data is backed up properly. Considering the OP is running RAID0, it would be dumb not to have a good backup.

The RAID0 array only contains my OS, apps, and games. Pretty much everything on it is not important and just re-installable, any important data I don't want to lose are on a different RAID5 array.

If that is the case, why bother wiping the drives? Since a home system does not need data protection, why not sell the drive as they are with all the logins, apps, games, etc?

That my friend, is a strawman argument. Not encrypting your personal computer at home is quite different from not even wiping a harddrive and then selling it to who knows who over the internet.

 

[Cyber Akuma]

Sorry, I figured since I had new questions to ask on top of all the replies it would probably be a lot cleaner to put my questions in a separate post.

Anyway, one issue did come up. The people over at Overclock.net said that the backup program I was planning to use, Acronis, apparently can't restore to a RAID0 SSD array.

That's..... not good, since using the Acronis Boot Disk is how I was planning to backup and restore the array. (And once I take apart the array and plug in the new disks in it's place and set them up as a new array, I am guessing I can't recover the old one?).

Any software you can recommend that can run off a bootdisk to do the backup and restore?

.... while I am at it, just want to make sure I won't run into any other nasty surprises. I am going to be putting two 1TB SSDs into a single 2TB RAID0 array. Since this will still be at or below 2TB, I shouldn't run into the MBR/GPT issue right? I heard it can be a pain getting some stuff to work right if the windows disk is GPT, I would prefer to keep it MBR. Also, my motherboard id a Z77 chipset, there should be no difference in maximum HDD and SSD capacities, right? If (a fairly modern motherboard) can support say, a 3TB HDD, then can it also support a 3TB SSD as well? Or are there differences in the way a motherboard handles a HDD and SSD (if any) that could make them have different capacity limits? Does the same apply to the max size of a RAID it can support?

Want to make sure I can just plug both the new SSDs in, restore my backup image, and be good to go.

 

[ilal2ielli]

I know to undo the array first now, since absolutely everybody is recommending that.

However, I saw that guide before, and I am not sure about that one. It's mentioning tools, some of which haven't been updated in years, that were meant to erase a HDD, they are just using them on a SSD.

This is only one guide and one I used when I secure erased my Crucial M4's before selling them.

The guide specifically mentions sending the secure erase command to the SSD's firmware/controller to zero out all the blocks. Notice it says that it will take approximately 2 minutes to do... no HDD can write zeroes to all blocks in two minutes.

Not to mention, the guide on overclock.net shows using Parted Magic also...

Anyway, one issue did come up. The people over at Overclock.net said that the backup program I was planning to use, Acronis, apparently can't restore to a RAID0 SSD array.

That's..... not good, since using the Acronis Boot Disk is how I was planning to backup and restore the array. (And once I take apart the array and plug in the new disks in it's place and set them up as a new array, I am guessing I can't recover the old one?).

Any software you can recommend that can run off a bootdisk to do the backup and restore?

I use Acronis all the time to backup and restore to my RAID 0 array for my Samsung 830's, been using Acronis since True Image 2011...

.... while I am at it, just want to make sure I won't run into any other nasty surprises. I am going to be putting two 1TB SSDs into a single 2TB RAID0 array. Since this will still be at or below 2TB, I shouldn't run into the MBR/GPT issue right? I heard it can be a pain getting some stuff to work right if the windows disk is GPT, I would prefer to keep it MBR. Also, my motherboard id a Z77 chipset, there should be no difference in maximum HDD and SSD capacities, right? If (a fairly modern motherboard) can support say, a 3TB HDD, then can it also support a 3TB SSD as well? Or are there differences in the way a motherboard handles a HDD and SSD (if any) that could make them have different capacity limits? Does the same apply to the max size of a RAID it can support?

Want to make sure I can just plug both the new SSDs in, restore my backup image, and be good to go.

My 2TB HDD's are MBR. My 3TB are GPT.

SSD and HDD will be no different to the motherboard.

Only issue you might run across is OS support of large drives, but any modern 64-bit OS should be able to handle large drive/array sizes.

 

[devman]

This is only one guide and one I used when I secure erased my Crucial M4's before selling them.

The guide specifically mentions sending the secure erase command to the SSD's firmware/controller to zero out all the blocks. Notice it says that it will take approximately 2 minutes to do... no HDD can write zeroes to all blocks in two minutes.

Indeed correct. Secure Erase in the ATA spec predates consumer SSD drives, but it works perfectly fine on them. The post condition for a Secure Erase is that the data should be unrecoverable, how that is accomplished is not specified. When issued a Secure Erase command most older HDDs will do overwrite passes, SSDs will reset flash cells, and drives with FDE will simply generate new key material. All three methods achieve the same result that data previously on the drive is no longer recoverable, the last two have the advantage of being very fast as well.

 

[MrCaffeineX]

I use Acronis all the time to backup and restore to my RAID 0 array for my Samsung 830's, been using Acronis since True Image 2011...

I'm pretty sure I've done this as well. I used to run two HDDs in RAID0 back in the days before SSDs were as cheap as they are now to speed things up a bit. I know I made a backup with Acronis and restored it once, but I can't remember for sure if it was to a new RAID0 array or just to a single disk...

 

[Cyber Akuma]

Indeed correct. Secure Erase in the ATA spec predates consumer SSD drives, but it works perfectly fine on them. The post condition for a Secure Erase is that the data should be unrecoverable, how that is accomplished is not specified. When issued a Secure Erase command most older HDDs will do overwrite passes, SSDs will reset flash cells, and drives with FDE will simply generate new key material. All three methods achieve the same result that data previously on the drive is no longer recoverable, the last two have the advantage of being very fast as well.

I wasn't aware there was a spec so drives can have a firmware level secure erase feature.

Would it work if my controller is set to RAID instead of ACHI (even in the drive isn't in a RAID) or over a USB enclosure though?

 

[fantabulous]

Any software you can recommend that can run off a bootdisk to do the backup and restore?

Some sort of Linux live distro would probably work for this, if the usual Windows focused solutions can't manage for some reason. You'd either "dd" to temporary storage and back, or setup a second RAID 0 array and dd from one to the other.

 

[cre3d]

I wasn't aware there was a spec so drives can have a firmware level secure erase feature.

Would it work if my controller is set to RAID instead of ACHI (even in the drive isn't in a RAID) or over a USB enclosure though?

In my experience it will not work in RAID mode or through USB (it is an ATA feature). In fact, this whole procedure is extremely picky and there have been a lot of motherboards that simply won't allow me to do a secure erase at all, no matter the sata mode. I keep an old eepc netbook around for exactly this reason, it allows me to use hdderase.exe on any drive i've plugged into it without fail.

 

[Wythix]

In my experience it will not work in RAID mode or through USB (it is an ATA feature). In fact, this whole procedure is extremely picky and there have been a lot of motherboards that simply won't allow me to do a secure erase at all, no matter the sata mode. I keep an old eepc netbook around for exactly this reason, it allows me to use hdderase.exe on any drive i've plugged into it without fail.

Not necessary. I've secure erased an Intel X25M through usb 2/3 via hdparm. NB : the usb3-sata bridge is a recent asmedia controller so not a unknown chinese controller and the kernel is quite recent (3.14).

There are mentions of bricking possibility but the fact is if you issue an hdparm -I (and smartctl -a) without strange logs, there should be no problem issuing the correct commands but again YMMV.

One big advantage to do it via usb is to bypass easily the frozen state.

 

[ilal2ielli]

I wasn't aware there was a spec so drives can have a firmware level secure erase feature.

Would it work if my controller is set to RAID instead of ACHI (even in the drive isn't in a RAID) or over a USB enclosure though?

Most motherboards pass through ATA commands even if RAID is selected in BIOS as long as you're not trying to do it to an array.

When I secure erased mine, all I did was undo the array.