Solid-state drives are now in most laptops, desktops and servers, and they behave very differently from the hard drives most wiping advice was written for. If you treat an SSD like a spinning disk, you can end up with data you thought was gone.
Why SSDs are different
A hard drive stores data in fixed magnetic locations, so overwriting those locations works. An SSD stores data in flash memory and its controller decides where each piece physically sits. Two features cause the trouble:
- Wear levelling spreads writes across cells so none wears out early, which means new data is often written somewhere other than where the old data sits.
- Over-provisioning reserves spare capacity that the operating system cannot see or address.
The result is that a normal overwrite from the operating system may never touch every cell that holds your data.
Why deleting, formatting and TRIM are not enough
Deleting files and quick formatting leave data in place. TRIM tells the drive which blocks are no longer in use, but it does not guarantee that the data is erased on any timetable. None of these is a secure erase.
The right methods for SSDs
Guidance such as NIST 800-88 points to methods that work at the drive’s own level:
- Firmware sanitize commands. NVMe Sanitize, or ATA Secure Erase on SATA drives, instruct the drive itself to clear all storage, including areas software cannot reach.
- Cryptographic erase. If the drive encrypts its data, destroying the encryption key makes the stored data unreadable. It is quick and widely used on self-encrypting and enterprise drives.
- Physical destruction. For failed, unresponsive or unsupported drives, shredding is the answer.
Do all SSDs support these commands?
No, and implementations vary between manufacturers. That is why verification matters. A good process runs the right command for the drive, checks the outcome and records it. If the drive does not support a trusted method, or the command fails, the drive should be destroyed.
Encrypt from day one
If you manage a fleet, turn on drive or full-disk encryption when devices are first deployed. It protects data during the device’s life and makes cryptographic erase a strong end-of-life option. Encryption is not a replacement for erasure, because keys and recovery data can linger, but it makes the later wipe more reliable.
Can you do it yourself?
For a single personal drive, vendor tools and standard commands can work if used carefully. Back up first, double-check the target drive and validate the result if you can. Free overwrite tools designed for hard drives are not reliable on SSDs. Our guide to free data wiping software covers what free tools can and cannot do.
For business equipment, the stakes are higher and the edge cases multiply, including NVMe, M.2, drives inside laptops and servers, and self-encrypting models. This is where a professional service is simpler and gives you proof.
Checklist for wiping SSDs
- Back up anything you still need, because erasure is permanent
- Identify the interface: SATA, NVMe or M.2
- Use a firmware sanitize or cryptographic erase method, not a plain overwrite
- Verify the result and record the serial number
- Destroy drives that fail or are unsupported
- Keep a certificate or report for your records
Frequently asked questions
Can an SSD be wiped securely? Yes, using flash-aware methods such as firmware sanitize commands or cryptographic erase, with verification.
Is overwriting an SSD enough? Not reliably. Wear levelling and over-provisioned space mean an overwrite may miss data.
What if an SSD cannot be wiped? It should go through certified data destruction, with proof provided.
Need SSDs wiped properly?
Our SSD data wiping service covers SATA, NVMe, M.2 and enterprise drives, with free UK collection and a certificate for every job. Get a free quote.
