I bought a SanDisk Extreme Pro 2TB Portable SSD and, after reading about the failures, I will be returning it. I was asked by amazon to mail it back and pay a restock fee. I tried to explain that I shouldn’t have to mail it back because my personal information is on the disk. I was told I couldn’t get a refund otherwise.
To clear my personal information and found L1T video below about KillDisk. KillDisk has a free version that only does One Pass Zeros. Is there still a chance someone can recover the data with only the One Pass Zeros?
I would use DBAN if it had a similar desktop version where its simpler to select the external drive. I don’t want to accidentally nuke the SSD in my laptop. if anyone has used DBAN to nuke an external SSD using a laptop, how did you do it?
Also, if you bought a SanDisk Extreme Pro SSD yourself, what have you been doing? if you’ve patched the 4TB version, did it work? if you received 2 - 2TB drives in exchange, did they eventually fail?
I mean, a return does involve… returning the drive, yes? They plan to resell it as open box, which is why they can afford to refund you. It’s a pretty important part of the process.
I wouldn’t worry too much about someone nefariously recovering your personal data off a SSD, given how hard it is to recover data from it at all. See: Wendel recovering data from a Sun Oracle F80. Bad wear leveling is already why those drives fail, so doing more than a once-over zeroing the drive is pretty savage and cruel to the next person to own it.
You usually need some specialized software and tools and a lot of time and patience to get anything usable from it, even without erasing the entire drive.
In theory, you should just be deleting everything and then running a trim command, and letting it unprogram everything that way. If you’re not storing some very high value data, it’s not really worth the time for someone to try to pull it back out.
If you’re worried about nuking your internal drive, there’s two ways to solve that.
Be really careful and point it to the right drive for sure.
Unplug the internal drive, and boot off a linux liveimage where it’s not a big deal if you accidently nuke it.
Is the data you placed on the external drive really that personal/unsafe? If it’s really that critical, you might consider using it as a worm(write once, read many) drive for audio or something instead of returning it.
Just a reminder that you dont need to do anything if you had full disk encryption prior to writing anything in the first place.
If you value privacy more, you should probably do a DBAN wipe prior to returning it but it wont “clean” the SSD parts that has already been marked as a bad sector/block.
This will f*ck up the next customer of course, who will buy your used SSD. Personally I’d still DBAN it. The ethical and moral thing to do would be to buy a new one from a different vendor instead.
You mean you want your money back and keep the drive?
PS
Parted Magic
PS2
Of course, people have different opinions on whether in the case of ssd you should write every sector or just ATA Secure Erase command and force state on the disk.
Yes there is still a chance that your data could be recovered and overwriting it multiple times won’t change that. You can’t overwrite a SSD like you could a hard drive. I don’t know any tools on Windows but on Linux you can use hdparm to securely erase SATA SSDs and nvme-cli to securely erase NVME SSDs.
SSD controllers try very hard to not erase blocks (because it is slow and wears the NAND cells), and writing zeros to a SSD is the absolute best workload for a controller to NOT overwrite the data, and simply mark it as zero’ed in the FTL (or compress the data so that many sectors of zeros can fit in one sector instead).
It’d still take bypassing the controller to recover the data, or a firmware backdoor/test mode, or directly reading the NAND flash chips from another device.
Better to boot a Linux live USB and dd /dev/urandom to it, but not for the same reason that is recommended for spinning rust, but for the fact it is not compressible by the controller/FTL. Even that is not guaranteed to overwrite everything, because there is always spare/over-provisioned storage for various performance/reliability tasks.
In future, use OS-managed (not device-managed) full-disk encryption.
Don’t know why people still suggest an external overwrite. Because of the controllers internal logic it is not guaranteed that every part that has data stored will be overwritten even if you fill a drive to the brim with random data.
With hdparm and nvme-cli you can let the controller know that it is supposed to erase all data and in most cases the controller will adhere to these commands. After that the entire SSD is empty. There is no other safe way to clean a drive other then to instruct the controller to do so.
Example for SATA:
sudo hdparm --user-master u --security-set-pass password /dev/sdx
sudo hdparm --user-master u --security-erase password /dev/sdx
sudo blkdiscard -f /dev/sda or whatever it’s device name is.
Unless you’re some kind of cartel guy the government is hunting down nobody is going to try and recover the allocation tables from a wiped controller. Anyone who actually wants your data would just break in during the night, boot a Linux flash drive, and clone your drive to a usb drive they brought.
I mean in a sense you can’t and have to trust the controllers implementation of the command, since the controller has the ability to not comply, but in the real world you can use a tool like hexdump to show the contents of the drive before erasure and then issue the same command after and see that it reports on zeros for the contents of the entire drive. But once again hexdump can also only see what the controller wants to show you. The command implementation could in theory be faulty and still leave data behind, but it has been a pretty standard feature on most SSDs for quite some time and all the big manufacturers support it.
