lundi 12 janvier 2015

How to securely erase an arbitrary SATA drive, utilizing the drive firmware to do so?


The problem with using Disk Utility or dd if=/dev/zero to erase a disk is that:




  1. It applies unnecessary wear to SSD drives.




  2. It sends the drive's capacity worth of zeroes over the drive's interface. If you're on an older Mac that has a poorly performing USB 2 ports, it'll take much longer than necesary. It'll also tax your CPU and USB subsystem with sending all those zeroes around.




  3. The firmware-based secure delete can be much faster than sending zeroes to the drive, even on spinning platter drives. For drives with encryption support, it'll be almost instantaneous, as all the drive needs to do is to overwrite the encryption keys and the data becomes useless. On those drives, and on SSDs, a secure erase should take 1-4 minutes (!).




All modern drives support ATA Secure Erase commands. These commands have the drive's firmware perform the erasure of the data.


On Linux, the hdparm utility exposes this functionality to the user - see hdparm --security-help for details.


Unforunately, there's no hdparm for OS X, since OS X doesn't provide any way for userland to send arbitrary SATA commands to the drive :(


Is there an easy workaround?





Aucun commentaire:

Enregistrer un commentaire