Erasing

Erasing is found in the drive view under Erase drive. It is destructive and requires the serial number as confirmation.

When is erasing possible?

It is also allowed for drives that only hold old RAID/LVM/ZFS/LUKS signatures that nothing is currently using. Erasing is refused for:

• mounted drives or drives with mounted partitions,
• active md/dm devices,
• active swap (inactive swap partitions do not block a drive),
• the system drive (badge "System"),
• drives opened exclusively (e.g. an imported ZFS pool).

Before each step the service checks again that the same drive is still behind the path.

Methods

Method	When to use	Notes
Quick erase	The drive is reused or handed on, contents are not critical	wipefs on all partitions and the drive, zero the first and last 32 MiB, re-read the partition table. Takes seconds. Data remains forensically readable.
Overwrite with zeros / random	HDDs, general standard	One pass is enough (NIST 800-88 Clear). More passes do not help on today's HDDs. Not reliable on SSDs (wear leveling, spare blocks).
ATA Secure Erase / Enhanced	SATA SSDs and HDDs, if the firmware supports it	The firmware erases by itself (NIST 800-88 Purge). Cannot be aborted. The drive must not be "frozen"; usually unavailable through USB adapters.
NVMe Format / Sanitize	NVMe SSDs	Sanitize is the more thorough method (Purge). Both act on the whole controller: if there are several namespaces, the method is not offered because the other namespaces would be erased as well.
TRIM/Discard	Fast on SSDs, only with verification	Discard merely frees blocks; some devices keep returning old data afterwards. Verification is therefore mandatory here.

Secure erasing always starts with the quick erase (removing signatures) and then runs the chosen method. For zeros and random, 1 to 7 passes can be chosen; with random, a final zero pass is appended by default. The interface suggests a method depending on the drive: zeros for HDDs, preferably a firmware method for SSDs.

NIST 800-88

The methods follow NIST SP 800-88:

• Clear: Overwriting with standard write commands (zeros or random, one pass). Enough for HDDs that are reused or handed on.
• Purge: Erasing by the firmware (ATA Secure Erase, NVMe Sanitize). Also works on areas that cannot be reached by write access.

Notes for SSDs

• Overwriting is not reliable on SSDs because wear leveling and spare blocks can keep data in places that cannot be reached by write access. Better are ATA Secure Erase (Enhanced, if supported), NVMe Sanitize or NVMe Format.
• Through USB adapters ATA Secure Erase is usually unavailable. The interface names the reason in that case.
• If a drive is "frozen", the BIOS or kernel blocks the erase command. Then re-plug the drive while the system is running (hotplug) or put the machine into standby and wake it up again.
• TRIM/Discard is fast, but only meaningful with verification.

Verify

"Verify" reads the whole drive back and checks that everything is zeros. This works for zeros, for random with a final zero pass, and for discard/secure erase only if the drive returns zeros afterwards (Enhanced Erase writes a different pattern on some drives; the check then fails even though the data is gone). For random without a final zero pass, verification is not possible.

Before reading back, cached pages are dropped so that zeros the tool wrote itself do not hide what the drive really returns.

ATA password after an abort or crash

For Secure Erase the service briefly sets the ATA security password dtpass. On errors and abort it is removed again, and after a successful erase the drive clears it itself. But if the server is killed hard in the middle of the operation or the power fails, the drive can remain locked with this password (after a power cycle it is then unreadable). The tool then no longer offers Secure Erase and names the command. Unlock and remove the password:

hdparm --user-master u --security-disable dtpass /dev/sdX

If the drive shows as "locked" after a reboot, unlock it first with hdparm --user-master u --security-unlock dtpass /dev/sdX (re-plug the drive if necessary). Then look at hdparm -I /dev/sdX: "not enabled" means the password is gone.