Can you really wipe an SSD?
Yes — but not the way you'd wipe a hard drive. Here's why overwriting falls short on flash, what actually works, and when the right answer is a shredder.
Why overwriting isn't enough on flash
A hard drive writes data to a specific spot on a platter, so overwriting that spot replaces it. SSDs don't work that way. To spread wear evenly, the drive's controller constantly moves data between flash cells, and it keeps a reserve of over-provisioned space the operating system never sees. When you “overwrite” a file, the controller may simply write the new data somewhere else — leaving the old data sitting in a cell your software can't reach.
Deleting and formatting don't help
Deleting a file or running a quick format mostly removes the pointers to data, not the data itself. On SSDs, a feature called TRIM may eventually clear some of those blocks — but “eventually” and “some” aren't words you want in a disposal record.
What actually works
- Sanitize commands. Modern SATA and NVMe drives support built-in commands (Block Erase, Crypto Erase) that tell the controller itself to wipe every cell, including the hidden ones.
- Cryptographic erase. Self-encrypting drives store data encrypted. Destroying the encryption key makes everything on the drive unreadable at once.
- Verification. After sanitizing, the drive is read back to confirm what's left is empty. No verification, no certificate.
- Physical destruction. If a drive doesn't support sanitize properly, has failed, or can't be verified, it gets shredded. Flash chips are small, so the shred size matters.
Firmware support varies by manufacturer and model. A trustworthy process checks the result instead of assuming the command worked.
What we do
At EndByte, SSDs are sanitized with the drive's own firmware commands where supported, then verified. Any SSD we can't verify is physically destroyed and certified as destroyed — never returned as “probably fine.” Every drive, either way, gets its own certificate. Here's how this maps to NIST 800-88.