SSD - What is the difference between Sanitize & Secure Erase?

Question

When I use Parted Magic to secure erase an SSD I get two options.

1. Secure Erase ATA Device
2. Sanitize

While I have searched the net, I still do not understand the exact technical different between the two as a layman.

This is extract from say Sandisk KB.

Secure Erase is different from Sanitize because it only deletes the mapping table but will not erase all blocks that have been written to. Sanitize will delete the mapping table and will erase all blocks that have been written to. Therefore, Secure Erase is faster to complete than Sanitize. After you erase the drive using Secure Erase or Sanitize, all user data will be permanently destroyed on the selected drive. This data cannot be recovered.

I don't have clarity what a mapping table is, and hence it's not clear.

Questions that I have are

1. Different between the two in simple terms
2. Is one better than other and if so in what way, which one is preferred if any?
3. In what way deleting only mapping table and table + blocks affect the performance if any, does it improve the I/O?
4. If all I need is make data recoverable, is any one of the treatment enough?

I hope this question is on topic and all my sub-queries are related to each other.

Solution 1

Secure: erases the mapping table (MFT in Windows) which is how the OS finds the location of the file on the disk, but files are still there and can be recovered by a skilled person.

Note: The command is old, and manufacturers don't always implement it properly, some don't even erase any data after a successful "secure erase"

See this paper on the issue

Sanitized: erases All data on the disk and files are unrecoverable by any means.

Sanitized is preferred for obvious reasons. Does not affect performance

(MFT= Master File Table)

Solution 2

Generally speaking, there are a few common ways to erase a storage device:

1. By overwriting storage blocks containing data with a bit pattern. This is the most common method for standard spinning hard drives.
2. On NAND flash devices, by performing a block erase operation that physically destroys data from memory cells.
3. On storage devices that keep track of used/free storage blocks (e.g. SSDs) by deleting the mapping between logical block address and the corresponding physical block, leaving the data on said block intact (and therefore recoverable).
4. On self-encrypting drives, by destroying the encryption key stored on the drive, rendering the data unreadable. This is often combined with destroying all block mappings on the drive.

Each storage protocol (ATA, SCSI, NVMe) has its own set of commands for sanitizing a storage disk.

• The ATA protocol specifies the SECURITY ERASE UNIT command with two modes, normal mode and enhanced erase mode: normal mode specifies overwrite with zeroes; enhanced erase specifies a "predetermined data pattern" and additionally targets "sectors that are no longer in use due to reallocation". New ATA drives might also support the new SANITIZE command with three modes: crypto scramble, block erase and overwrite.
• The SCSI protocol defines a SANITIZE command with three modes: overwrite, block erase and cryptographic erase (where the encryption key is deleted from the drive).
• The NVMe specification defines two commands: Format (for a NVMe namespace) and Sanitize (for the whole device). The Format command itself has three modes: no secure erase, user data erase and cryptographic erase. The Sanitize command also has three modes: block erase, crypto erase and overwrite.

Since the implementation of ATA SECURITY ERASE UNIT is manufacturer-dependent, I can only guess that calling this command on Sandisk drives will not completely erase your data; another drive manufacturer might use a different and more secure method altogether. Regardless, it is almost always preferable to use the SANITIZE command when available, or even combine multiple SANITIZE commands; Micron actually recommends a SANITIZE CRYPTO SCRAMBLE followed by a SANITIZE BLOCK ERASE on their SATA SSDs.

Comments

[Moab]

Secure erases the mapping table which is how the os finds the location of the file on the disk, but files are still there. Sanitized erases All data on the disk.

[Daniel B]

The mapping table this refers to is the flash device’s internal mapping table. It is not at all comparable to the MFT or whatever because it cannot be accessed by the host system.

[Anon]

Similar question was asked over on security.stackexchange.com/questions/62253/…

[Tu Dinh]

ATA Secure Erase is a disk-level command and doesn't only erase the Windows MFT. It involves writing zeroes to data areas on the disk, completely destroying its contents.

[Moab]

Any documentation? Thanks.

[Tu Dinh]

See the ATA ACS command set section 7.43 SECURITY ERASE UNIT.

[Moab]

So what is the difference between Secure erase and sanitize then?

[Tu Dinh]

The ATA SECURITY ERASE UNIT command is old, and manufacturers don't always implement it properly (some don't even erase any data after a successful "secure erase", see this paper). ATA SANITIZE is a newer command that's explicit about what is erased, and hopefully more reliable at removing data.

[Moab]

@TuDinh Thank you!..

[Community]

Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center.