I am giving away a shitty 128GB SSD, which was used with LUKS 2 for most of it’s lifetime. As far as I know, it’s good practice to secure-erase it, but I’m too lazy to reinstall the OS on it (I already did it once). Is it really needed?
I am giving away a shitty 128GB SSD, which was used with LUKS 2 for most of it’s lifetime. As far as I know, it’s good practice to secure-erase it, but I’m too lazy to reinstall the OS on it (I already did it once). Is it really needed?
Secure erase just drops the ssd controllers table of where logical blocks are in the physical memory and trims the disk. Which is good and you should do.
That means a person would have to address the memory directly with flying leads or a bed of nails or something. Or have special software that makes the controller tell them what’s on each physical block and then put that data together into a bunch of files.
If that worries you, do dd if=/dev/urandom of=/dev/<disk> before you secure erase.
Then everything on the drive will be random static before the secure erase drops the block table and trims, so even if someone uses magic power to read the block contents directly they just get to see static.
That has the benefit of speeding up the drive by resetting read fatigue at the expense of one layer of writes which is always worth it.
Ah, fun fact, dd won’t actually cover all the blocks since SSDs have reserve blocks and IIRC they do rotate which ones are in use vs which are not, to even out wear
Yes of course this will only rewrite some number of blocks that total the disks reported capacity. In the case that a person is worried about hidden blocks being preserved by a wear leveling algorithm they could just run the same command again and that would get em all.
Useless use of dd. cat or cp are better suited in this case.
That’s only true for some environments.
E: this is the first time I’ve read that blog post since it was published (or at least a long time ago) and there’s now a comment specifically referencing the actual behavior I observed in the wild when I tried to sub other things in for “normal” uses of dd:
While that comment was written seventy years ago, in this age of people with questionable intent, capability and integrity rewriting system tools in rust there’s no better time to linger thoughtfully over cp or cat or any number of other commands that begin with the letter “c” before grabbing the ol’ reliable footgun whose fifty years of script backwards compatibility ensure that no one can get their dd replacement accepted in normal use until it behaves as expected.