I'm planning on selling a USB external hard drive that currently contains an old Ubuntu installation with stored passwords and banking information.

How can I securely erase the drive before selling it?

  • 4
    Also, have a look at this EFF page for a comprehensive explanation covering multiple OS's. Commented Apr 5, 2012 at 11:13
  • @Lekensteyn 'Remove the keyslots'? Just searched AU and got nothing but this partially related Q&A. Should I ask this as a new question or is it covered here? Commented Apr 5, 2012 at 17:33
  • If you've a secure passphrase, the world is not lost when you lose your drive. However, it's recommended to clear the keyslots as described in 5.3 of code.google.com/p/cryptsetup/wiki/…. Go ahead and ask about erasing encrypted disks.
    – Lekensteyn
    Commented Apr 5, 2012 at 17:38
  • @TomBrossman The link you posted is now broken, so I'm just posting an archive link here.
    – AJM
    Commented May 24, 2023 at 13:39

18 Answers 18


Securely erasing a storage device

There's a command-line utility called shred, which overwrites data in a file or a whole device with random bits, making it nearly impossible to recover.

First of all, you need to identify the name of the device.

This might be something like /dev/sdb or /dev/hdb (but not like /dev/sdb1, that's a partition). You can use sudo fdisk -l to list all connected storage devices, and find your external hard drive there.

N.B. Make sure it is the correct device, picking the wrong device will wipe it.

Unmount all currently mounted partitions on that device, if any. Then run the following, replacing /dev/sdX with the name of your device:

sudo shred -v /dev/sdX

This will overwrite all the blocks on the device with random data three times, the -v flag is for verbose and will print the current progress.

You can add the option -nN to only do this N times, to save time on large capacity devices. This might take a while, depending on the size of your external hard drive (I think it takes twenty minutes or so for my 4 GB flash drive).

You can also set all bits to zero after the last iteration by adding the option -z, I prefer to do this.

sudo shred -v -n1 -z /dev/sdX

After this, you would have to repartition the device. The easiest way is to install GParted and use it:

sudo apt-get install gparted
gksu gparted

Choose your device in the upper-right corner list. Then select Device -> Create partition table to create a partition table on the device.

Then add a single partition that uses all of the unallocated space on the device, choosing fat32 as the file system. Apply the changes by click the Apply button (the green checkmark) in the toolbar.


  • Read the manpage for shred online or by typing man shred in the terminal.
  • Beware that some parts of your disk will not be erased - use the drive firmware "SECURE ERASE" command, such as via hdparm, to properly clean off a disk.
  • 42
    Best practice here: disconnect all of your hard drives, plug in the external drive and then do the above off of a live CD to prevent even the possibility of fragging anything that matters. Commented Dec 15, 2010 at 23:09
  • 45
    Note that this answer has been deprecated by the SECURE ERASE method of requesting the drive to erase itself. This should take care of all possible data, and won't unnecessarily tax your system. You can perform a secure erase, where the drive erases itself, using the hdparm utility. This method tries to erase the entire drive, including bad sectors. Furthermore it is much faster than overwriting the normal way. It is also the recommended methods for SSD drives, where shred is an extremely bad idea. Commented Mar 23, 2013 at 23:24
  • 9
    @owlstead: Could you elaborate? What is SECURE ERASE, and how does one use it? It's appreciated if you make a separate answer if you have a better one. Commented Oct 24, 2014 at 16:36
  • 22
    The comment about using ATA Secure Erase command is misleading. There are serious problems with using SE (regarding the lack of consistent support from vendors and the lack of transparency on the process). Related: security.stackexchange.com/questions/62253
    – MV.
    Commented Jan 26, 2015 at 2:39
  • 3
    @Fiksdal I don't know, it's been five years since I wrote this answer and I don't remember my motivations for phrasing it that way. That said, I think I meant it along the lines of "practically impossible today but plausably possible in the future with enough technological improvement".
    – Frxstrem
    Commented Mar 25, 2016 at 12:21

Just 'zero' it using the dd tool:

  1. Start the Disk Utility via System > Administration > Disk Utility
  2. Find your disk in the left panel, select it, and on the right find the device path (eg. /dev/sdX )
  3. Run the following command from a terminal (Applications > Accessories > Terminal):

    sudo dd if=/dev/zero of=/dev/sdX bs=1M

    Make sure you use the right device path and not just copy this line!

This will overwrite the whole disk with zeros and is considerably faster than generating gigabytes of random data. Like all the other tools this won't take care of blocks that were mapped out for whatever reason (write errors, reserved, etc.), but it's highly unlikely your buyer will have the tools and the knowledge to recover anything from those blocks.

PS: Before you Bruce Schneier fanboys downvote me: I want proof that it's possible to recover data from a non-ancient rotational hard drive that has been overwritten with zeros. Don't even think about commenting otherwise! :P

  • 11
    +1 for Bruce Schneier (and DD which really is an excellent tool)
    – n3rd
    Commented Aug 1, 2011 at 12:22
  • 7
    Not saying this is the strongest "proof" but the Gutmann method exists for a reason. As far as I know, modern hard drives are still theoretically susceptible to having their data recovered if it's been overwritten by zeros. Whether or not that still holds, hopefully you can admit it's not going to hurt by overwriting using /dev/random or a specific algorithm for that purpose.
    – Cerin
    Commented Feb 12, 2012 at 14:21
  • 18
    No, it won't hurt, it just will take a lot of time (especially if you use /dev/random :P) with questionable benefit. The last paper on that topic I read (sorry, no details, I think it was from 2008) suggested - based on data from tests with real hardware - that the chance to recover a single bit is <50% → means you get a lower error rate when "recovering" each bit using a coin toss. So, unless there's proof that zero-ing isn't enough (it's no "maybe" right now, rather a "no friggin' way"), this is the method of choice for me.
    – htorque
    Commented Feb 13, 2012 at 5:37
  • 15
    @Cerin My understanding is that there has never been any proof that these paranoid data recovery fantasies are even possible. As pointed out in the "Criticism" section of the article you linked, Guttman himself is critical of how his algorithm has been used "more as a kind of voodoo incantation to banish evil spirits than the result of a technical analysis of drive encoding techniques". The only reasons to do more than zero-wipe a drive are emotional ... i.e. it makes you feel better ... not technical. Commented May 3, 2012 at 18:22
  • 6
    Nice, but could you kindly explain me why did you put the bs=1M parameter? I can read the man, and IIUC you are just limiting the buffer to 1 megabyte; why is doing so desirable?
    – gaazkam
    Commented Sep 9, 2015 at 7:34

I generally use a destructive read-write test using badblocks -w. The two major advantages are:

  • it's part of the base system and almost every rescue system, so it is available e.g. from the rescue shell of the Ubuntu installer
  • you get a report at the end whether there are bad blocks on the disk

Note that if the report indicates a problem, I'd no longer sell the disk as it is likely to fail soon.

Also Note: The -w does a 4-pass destructive write test by default.

Use write-mode test. With this option, badblocks scans for bad blocks by writing some patterns (0xaa, 0x55, 0xff, 0x00) on every block of the device, reading every block and comparing the contents.

Usage example (if your disk is sdd):

sudo badblocks -wsv /dev/sdd

(added sv for progress bar + verbose)

For a much faster wipe, add the -t option and do a single pass of zeros like so:

sudo badblocks -wsv -t 0x00 /dev/sdd

Best is to use the secure erase function of ATA drives. Secure erase erases the drive at firmware level. Can't get more secure.

First check if secure erase is supported:

sudo hdparm -I /dev/sdX | grep -i security

(replace sdX with sda/sdb/sdc, whatever your disk is).

If you see no output, just use dd:

sudo dd if=/dev/zero of=/dev/sdX bs=1M

If you see output, check if the device is not frozen:

sudo hdparm -I /dev/sdX | grep -i frozen

If it is frozen, see How to unfreeze drive in Linux? Otherwise if you see not frozen, set password to "Eins":

sudo hdparm --user-master u --security-set-pass Eins /dev/sdX

Optional: you might want to know how how long this will take:

sudo hdparm -I /dev/sdX | awk '/for SECURITY ERASE UNIT/'

Then execute the erase:

sudo hdparm --user-master u --security-erase Eins /dev/sdX

Then wait. Apparently for a 1TB disk this might take 3 hours or more.

There's a nice script which automated these steps.

  • From Wikipedia - Gutmann method: However, a 2011 research found that 4 out of 8 manufacturers did not implement ATA Secure Erase correctly. Commented Jul 12, 2022 at 17:03
  • 3
    Why not --security-erase-enhanced? Commented Jul 12, 2022 at 17:12

Now, Disks (gnome-disks) tool has ATA Secure Erase. You may use it to erase your hard drive. Same option explained in this answer using the command-line tool hdparm.


Please, review disclaimer and warning notes at https://ata.wiki.kernel.org/index.php/ATA_Secure_Erase (Thanks to @colan to bring this up)

Also comments below. Some hardware may break.

  1. Open Disks tool → Choose the target disk
  2. From menu: Format Disk...
  3. Select from drop box, Erase: ATA Enhanced Secure Erase ( if offered for the drive you selected ). Alternatively you can select Write zeros (slow) which can reasonably be considered to be secure.
  4. Format

ATA Enhanced Secure Erase 1

ATA Enhanced Secure Erase 2

  • 3
    While this is the best option generally, it does not apply over USB (as asked in the above question). There are warnings and disclaimers about that at ata.wiki.kernel.org/index.php/ATA_Secure_Erase. Nevertheless, I asked about it in the Gnome issue.
    – colan
    Commented Apr 8, 2019 at 19:06
  • 1
    @colan As I understand that depends on the feature support in the full stack (Disks - Kernel - Driver - Controller - Drive). While my case was ok for two HDD's (WD USB3 HDD & WD w/ SATA-USB3 active adapter), I confirm it is not for all cases, I have seen some SATA-USB3 adapters with hard-coded block alignment (reading with 512b & 4k block does not create identical images), some doesn't support SMART which has some long exec commands too, Some USB Drives has a non-standardized/twisted implementation for password-protected/encrypted partition (Using it through another USB adapter will break it)
    – user.dz
    Commented May 12, 2019 at 3:40
  • @colan if the USB interface thinks the drive has fallen asleep during ATA Secure Erase, the write zeros alternative on the same menu is useful. Writing zeros keeps the USB interface looking alive.
    – H2ONaCl
    Commented Sep 5, 2022 at 19:57
  • 1
    The same menu that offers ATA Secure Erase (if and when available) also offers to write zeros (slow) or to mark deletion (fast but not secure). The zeroing can reasonably be considered secure so this answer should be generalized to recommend that option. As a GUI solution it might reasonably be considered to be superior to the command line shred solution. The much up-voted dd solution is flawed and I posted a comment to document why it is so.
    – H2ONaCl
    Commented Sep 12, 2022 at 2:52

Have a look at this definitive question on Security Stack Exchange

How can I reliably erase all information on a hard drive

This discusses various secure deletion options, along with physical destruction and wiping so you can decide which option may be your best bet.

Remember though that the current recovery status for different storage is as follows:

  • Very old hard drives: there were gaps between tracks so you could potentially pick up bleed into these gaps (if you had a scanning electron microscope handy). Overwriting multiple times was potentially useful.
  • New hard drives: no technology currently exists that can read after even one overwrite.
  • Solid state hard drives: wear levelling means you cannot overwrite securely. Instead you either encrypt the entire volume and dispose of the key to wipe, or you destroy the device.
  • What is the definition of very old e.g. 30 years ago?
    – Motivated
    Commented Dec 31, 2018 at 22:05
  • 10Mb MFM drives from around 20-25 years ago, yes
    – Rory Alsop
    Commented Jan 1, 2019 at 14:58
  • How does this relate to drives in devices such as mobile phones and tablets?
    – Motivated
    Commented Jan 1, 2019 at 19:55
  • @Motivated Given that phones and tablets use flash memory, it's probably the same answer as for SSD's, but I'm not sure. You could ask on Super User for better info.
    – wjandrea
    Commented Jan 25, 2019 at 23:44
  • Since you mentioned SSD (apart from HDD), the answer you linked, links to an SSD specific question which says that in order to be secure the encryption is to happen before the information hits the SSD. Encrypting the drive afterwards does not protect the information that was already there. In other words, encrypting afterwards is not equivalent to erasure.
    – H2ONaCl
    Commented Sep 4, 2022 at 18:26
  • You need to create a loopback device which runs /dev/random over the entire contents of the drive.
  • That'll fill the entire drive with almost completely random data.Then you can set all bits back to 0 with dd.

  • Actually, dd should be able to randomize all of the information.

  • You said that you have stored banking information on your harddisk.So i would suggest you to run any one of the following command from a live cd (where hdX is your harddrive).

    dd if=/dev/zero of=/dev/hdX

    dd if=/dev/random of=/dev/hdX

    dd if=/dev/urandom of=/dev/hdX

  • How ever it will take a very long time based on your harddisk size.

For your information:

See the following links,


  • Random uses random bits and zero uses 0 bits.
  • Urandom is a semi-random version of random.
  • Is random really necessary? Would it not be sufficient to replace all bits with 1 and then with 0?
    – Buck
    Commented Aug 14, 2015 at 14:55
  • 1
    Never use /dev/random for such operations. /dev/random generates random data using an entropy pool and blocks the operation if this entropy pool is empty. So if you don't do anything with your computer to generate new randomness, the operation will take forever. Use /dev/urandom instead. Also see man random Commented Jun 15, 2022 at 15:32

you can use wipe


sudo apt-get install wipe

You can use that software or use the following command:

shred -vfz -n ? (drive)

Were the "?" is, put the number of times you wan to shred the drive, then for were "(drive)" is, put the drive that you want to shred. Once your done, do whatever you want with it. I think that this method is more effective since you can control what is done to your drive and have immediate results.


  1. http://wipe.sourceforge.net/
  2. http://www.howtogeek.com/howto/15037/use-an-ubuntu-live-cd-to-securely-wipe-your-pcs-hard-drive/
  3. http://ubuntuforums.org/showthread.php?t=817882
  • 10
    Why use one over the other, wipe vs shred? Commented Oct 24, 2014 at 16:33

One more advantage of shred over dd in this scenario: I have a faulty disk that I need to return to the vendor for an exchange.

dd halts at the first bad block, and fails to clobber the rest (unless I painfully use skip=... to jump ahead each time it stops).

shred ignores write errors and happily continues in this case.


You can use DBAN. Wikipedia:

Darik's Boot and Nuke (commonly known as DBAN) [...] is designed to securely erase a hard disk until data is permanently removed and no longer recoverable, which is achieved by overwriting the data with random numbers generated by Mersenne twister or ISAAC (a PRNG). The Gutmann method, Quick Erase, DoD Short (3 passes), and DOD 5220.22-M (7 passes) are also included as options to handle Data remanence.

DBAN can be booted from a floppy disk, CD, DVD, or USB flash drive and it is based on Linux. It supports PATA (IDE), SCSI and SATA hard drives. DBAN can be configured to automatically wipe every hard disk that it sees on a system, making it very useful for unattended data destruction scenarios. DBAN exists for Intel x86 and PowerPC systems.

DBAN, like other methods of data erasure, is suitable for use prior to computer recycling for personal or commercial situations, such as donating or selling a computer[2]. In the case of malware infection, DBAN can be used before returning a disk to production.


Use lsblk to get the disk name.

CAUTION: Don't zero-fill an SSD, ever. Find more details here.

In case of HDD, you can use the following commands.

sudo dd if=/dev/zero of=/dev/sdX bs=4096 count=2013054 status=progress


sudo dd if=/dev/urandom of=/dev/sdX bs=4096 count=2013054 status=progress


sudo dd if=/dev/random of=/dev/sdX bs=4096 count=2013054 status=progress

Replace X with appropriate letter.

Please note that you need to use count= otherwise you will get dd: error writing '/dev/sdX': No space left on device

To calculate count=, you can use the following command.

echo $(($(df --output=size -B1 /dev/sda | tail -1)/4096))

Please replace 4096 with your bs= value.

For NVMe or SATA SSD, read on. From now on the following CAUTION will be applicable.

CAUTION: Do not proceed with this if the target drive is not connected directly to a SATA/NVMe interface. Issuing the Secure Erase/Format/Sanitize command on a drive connected via USB or a SAS/RAID card could potentially brick the drive!

For SATA SSD drive check SATA SSD.

For NVMe drive check NVMe Drive.

  • @user68186 without status=progress it is very hard to track changes. It was not mentioned anywhere else. That is why I added this answer. Commented Jun 7, 2022 at 19:30
  • You should say that up front in the beginning of your answer. You may also say something about SSDs. This is not 2010 any more, In 2022 SSDs are more common in many places than HDDs. Using dd on SSDs is not a great idea, I think.
    – user68186
    Commented Jun 7, 2022 at 21:49
  • Read the second answer which says "Don't zero-fill an SSD, ever.."
    – user68186
    Commented Jun 7, 2022 at 21:56
  • 1
    @user68186 please review my answer and let me know if anything needs to be changed. Thank you very much for raising the SSD specific issues (I did not know that earlier). By putting my note as a answer here, I learned a lot from you. Commented Jun 8, 2022 at 6:43

Go root and

dd if=/dev/random of=/dev/(your usb drive device here); dd if=/dev/zero of=/dev/(your usb drive device here)

Be certain you've got the right drive!

  • 10
    Never use /dev/random for such operations. /dev/random generates random data using an entropy pool and blocks the operation if this entropy pool is empty. So if you don't do anything with your computer to generate new randomness, the operation will take forever. Use /dev/urandom instead. Also see man random
    – htorque
    Commented Dec 15, 2010 at 22:06
  • 3
    You probably would need to prefix the command with sudo. Also, dd tends to complete sooner when a block size larger than the default is used. So I would suggest very carefully using: sudo dd if=/dev/random bs=1m of=/dev/sdX Commented May 3, 2012 at 18:07
  • ah, meant that to be sudo dd if=/dev/urandom bs=1m of=/dev/sdX Oh, well. Commented May 3, 2012 at 18:29

DBAN is an open source Boot CD to wipe the hard disk.

Down load from


burn it and boot the machine from CD, that's all.


Easiest way to do that is use :

sudo shred -fv /dev/xxx

where xxx is device, to ensure what device you have, type :

sudo fdisk -l

The device are indicated after disk word and to the colon char :, like this :

Disk /dev/sde: 500.1 GB etc...

Don't mount file systems of your disk you want wipe etc. Shred will do what you want in part of time. -z option is for last run with 0 to hide wipe and is not necessary to wipe data.

Best way is to use dd like wrote previous users:

sudo dd if=/dev/urandom of=/dev/xxx bs=1M

use urandom device as it is more modern and better way to obtain random pattern.

Other tools at this moment can be older and by less people develop. Shred is in core application of Linux.

Look at this example: wipe 2009 http://lambda-diode.com/software/wipe/. But it is known app. It is possible to use bleachbit but as I tried it took long time.


If the dd cmd is not working, you can use the redirection method to wipe out the data.


cat /dev/urandom > /dev/sd**a**   # depends on your hdd location 


alternatively you can use cp (copy cmd) to overwrite the previous data.

cp /dev/urandom /dev/sd**a**      # depends on your hdd location 

Use nwipe, it's command line or ncurses GUI. Has multiple wipe methods. Can wipe many devices simultaneously. It's the more up to date version of DBAN and is currently maintained. Nwipe can be found in most Linux distros and is available as a bootable USB version called Shredos

Nwipe https://github.com/martijnvanbrummelen/nwipe

Shredos https://github.com/PartialVolume/shredos.2020.02


You can use pv to zero-fill it and you'll even get a nice progress bar:

pv < /dev/zero > /dev/sdX

where sdX is the device of the drive to delete; you can get that from this command:


Taken from pv(1)

You can also one-fill it with pv:

tr '\0' '\377' < /dev/zero | pv > /dev/sdX

Partially taken from monkeybus's answer


Those recommending to use shred are giving bad advice. Shred's own man page says it's effectively useless on journaled filesystems, which Ubuntu is almost guaranteed to be using if you don't change its filesystem defaults (ext3 and ext4 are journaled. As is resierfs and Reiser4 as well as many MANY other common Linux filesystems.).

Not to mention shred is completely useless for completely blanking or randomizing a disk, as it only works on individual files or sets of files (On the filesystem level, not a raw data level.). If you want to securely wipe a disk, you gotta use dd on the drive's main device node (For example: /dev/sdc instead of /dev/sdc1) while nothing is mounted on it.

It WILL take a while, but unlike shred it will completely and IRREVERSIBLY wipe a hard disk from MBR to final sector. Also, BIG WARNING on dd, make sure you are using it on the correct device or you'll at least PARTIALLY wipe the wrong disk. This could be disastrous if you accidentally use dd on a system drive, which will not only make it unbootable, but may irreversibly corrupt any given partition on the drive. This has given it the nickname "disk destroyer."

Shred is NOT a reliable tool for securely wiping a drive. If you're selling or giving your computer away the CORRECT way to empty the drive is to zero or randomize it with dd and never, ever use shred, as filesystem journals will effectively restore shredded files with no effort at all.

  • 9
    You don't point shred at a file. You point it at the entire device. The filesystem is irrelevant. Commented Jan 29, 2014 at 14:42
  • 1
    @DavidGiven Well technically you can shred just a file inside a filesystem, and that's what shred manpage talks about for the most part. Yaro's warnings would be sort-of valid in that case. But yes, shredding a whole partition is a completely different thing; in that case the filesystem indeed does not matter. Commented Oct 11, 2016 at 19:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .