How to wipe an SSD before selling or recycling it

Why formatting is not enough

A quick format only rewrites the file table: the data is still physically there. With hard drives, the workaround was to overwrite the whole disk. With an SSD, that method is not reliable.

An SSD controller spreads writes across all cells (wear levelling) and keeps a reserve of blocks hidden from the system (over-provisioning). Software that overwrites the drive therefore does not necessarily reach every cell, and multiple passes only wear the SSD out for nothing.

The right approach is to ask the controller itself to erase all the memory, or to make the data unreadable through encryption.

Method 1: the manufacturer's tool

This is the simplest method for individuals. Most manufacturers offer a free utility (Samsung Magician, Crucial Storage Executive, WD Dashboard, Kingston SSD Manager…) with a secure erase function, called Secure Erase, Sanitize or PSID Revert depending on the case.

The command runs inside the SSD: it erases every cell, reserve included, in a few seconds to a few minutes. Some tools require you to create a bootable USB stick, since you cannot erase the drive the system is running from.

Method 2: the computer's BIOS/UEFI

Many business laptops and recent motherboards include a drive erase function in their setup interface (often under a name such as "Secure Erase", "Data Wipe" or "Drive Erase"). It sends the SSD the same command as the manufacturers' tools, with nothing to install.

Method 3: Linux commands

For users comfortable with the command line, a Linux system booted from a USB stick can send erase commands directly. Check the drive name three times: a mistake erases the wrong drive, with no way back.

For a SATA SSD (the drive must not be in the "frozen" state, shown by the first command):

sudo hdparm -I /dev/sdX        # check for "not frozen" and erase support
sudo hdparm --user-master u --security-set-pass password /dev/sdX
sudo hdparm --user-master u --security-erase password /dev/sdX

Method 3b: NVMe SSDs under Linux

For an NVMe SSD, the nvme-cli tool offers a format command with erase and, on models that support it, a Sanitize command:

sudo nvme id-ctrl /dev/nvme0 -H | grep -i -E 'format|sanit'   # supported features
sudo nvme format /dev/nvme0n1 --ses=1          # user data erase
sudo nvme sanitize /dev/nvme0 --sanact=2       # block erase sanitize, if available

Method 4: encryption

If your SSD was encrypted from the start (BitLocker on Windows, FileVault on macOS, LUKS on Linux), the data can only be read with the key. Deleting the encrypted volume or resetting the system while erasing the drive then makes the content unusable.

On Windows, "Reset this PC" with "Remove everything" and drive cleaning is a good option for a computer sold complete. On recent Macs, whose internal SSD is always encrypted, "Erase All Content and Settings" does the job.

What if the SSD has failed?

An SSD that is no longer detected cannot receive any erase command. Two cases:

• The SSD was encrypted (BitLocker, FileVault, LUKS): without the key, its content is unreadable. The risk is very low.
• The SSD was not encrypted: without its controller, the content of the chips is generally hard to exploit, especially as many SSDs encrypt their data internally. The risk is not zero for highly sensitive data, though: in that case, hand the SSD to a provider that issues a certificate of processing, or physically destroy the chips.

What Recychips does with your SSDs

We never read, copy or attempt to recover any data on the media we receive. Each SSD is dismantled in our workshop: the chips are separated from the controller for industrial reuse as components, and the board goes to material recovery through an approved WEEE channel. No SSD is ever resold as is.

Wiping beforehand remains your responsibility, and we recommend doing it whenever possible. Businesses can request a certificate of processing. To find out what your drives are worth, read how much a dead SSD is worth or value your batch online.

For businesses

Companies managing large fleets generally rely on the NIST SP 800-88 guidelines, which define three levels: Clear (logical erasure), Purge (Secure Erase, Sanitize or cryptographic erase) and Destroy (physical destruction). Document the method used for each batch and keep the certificates of processing: that is what you will be asked for in a GDPR audit.

For server and storage array SSDs, see also sell SAS and U.2 enterprise SSDs.