I am planning on selling my laptop. So I formatted my disk using the Disk Utility and chose to overwrite the disk with zeroes.

Two questions:

Is this the same as overwriting the disk using dd?

sudo dd if=/dev/zero of=/dev/sda

And is this method secure enough so that buyers can't easily recover the previous data? Or should I take additional measures (like encrypting the disk, destroying the headers, etc.)?


4 Answers 4


Yes, the disk utility uses a method similar to the one with dd you describe, or a faster and more secure one more like:

dd if=/dev/urandom of=/dev/sda bs=1M

This introduces a lot more fuzz to the overwriting pattern than zeros only, which should be more difficult to restore but not noticeably slower to perform.

Some people claim, this is not enough and one should overwrite hard disks multiple times and with more elaborate patterns (scrub(1) can do both of that as per the other answer), but most will say once is enough, if an attacker wants to restore more than a few bits with a significant chance.

Edit: Apparently /dev/urandom peaks at ~13 MiB/s on at least two systems including mine. Therefore simonp suggested a different approach using openssl(1):

head -c 32 /dev/urandom | sudo openssl enc -rc4 -nosalt -pass stdin -in /dev/zero -out /dev/sda
  • 2
    There are so many methods, I was just wondering if the Disk Utility is safe enough. I don't want to drag this thing out, just want to make it clean enough for a sale, and make sure no-one can easily to my data. Thanks for answering. Commented Oct 15, 2013 at 20:15
  • If you want to be sure, you need to either read the documentation or even the code of the disk utility (though I don't know why they would do something stupid over something so trivial), or do it yourself with dd or scrub. Commented Oct 15, 2013 at 20:20
  • 1
    Even if you simply overwrite the drive with zeros once, you wouldn't be able to recover any data with software or home tools alone. Commented Oct 15, 2013 at 20:25
  • 2
    Using /dev/urandom is much slower than /dev/zero (reaches a peak of 13MB/s vs ~0.5GB/s on my laptop). For a faster way of generating random numbers in Linux, see serverfault.com/a/415962. E.g. openssl enc -aes-256-ctr -pass pass:"$(dd if=/dev/urandom bs=128 count=1 2>/dev/null | base64)" -nosalt < /dev/zero | pv -pterb -s $(sudo blockdev --getsize64 /dev/sdb) | sudo dd of=/dev/sdb bs=1M
    – simonp
    Commented Dec 21, 2014 at 7:50
  • 1
    @J'e You can pipe the output through pv(1): head -c 32 < /dev/urandom | openssl enc -rc4 -nosalt -pass stdin -in /dev/zero | pv [options...] > /dev/sdX. The manual claims that pv will use the size of the output block device if the input has no size (like a pipe/FIFO) to calculate the relative progress. Commented Jan 25, 2023 at 0:32

The "bootom line" AFIK is that the data has to be over written or it can be retrieved. There are many tools / methods to do this.

The consensus is that you only have to make one pass, so additional passes take additional time and put excessive wear and tear on the hard drive.

While there are many solutions, I prefer scrub.

scrub /dev/sda

Or if you prefer

scrub -p dod /dev/sda

See also

  • 1
    Like I said in the comment on my question, I prefer using a GUI if there is one readily available, like in the Disk Utility. (I don't really like staring at my Terminal, wondering if it's doing something. I know there are ways to show progress with dd, but still.) Besides for me it's important that the process takes hours, not days, so overwriting everything with zeroes seems like my best bet? Commented Oct 15, 2013 at 20:22
  • 1
    Actually, one of the best ways to forever lose contents doesn't involve overwriting the data at all. Essentially, use "Full-Disk Encryption" from day 1, then when you want to wipe it, lose the original encryption key. Much faster than overwriting, AND it also makes unreachable copies of data (remapped sectors, etc) undecodable.
    – Ben Voigt
    Commented Jan 22, 2016 at 16:13
  • I'm not sure there are any complete wipes at all, given enough time and resource that is. I guess the take away here is, if the data is more valuable than the cost to recover it. If you believe that it is or may be, destroy the drive. why even take the risk. Commented Mar 22, 2017 at 6:44
  • 1
    @Chris - nber.org/sys-admin/overwritten-data-gutmann.html The Gutmann theory has been debunked and a single pass of zeros is sufficient, let alone scrub. Please do not spread FUD or present clear data to support you FUD.
    – Panther
    Commented Mar 23, 2017 at 15:57
  • I wrestled with this. Drop Ubuntu live for this purpose. Get DBAN (dban.org), a linux bootable that has single purpose program--to erase hard disks. Has choice of 5 algorithms. I tried many of the tools in Ubuntu live this weekend and on Dell workstations that were 3 years old, the drives would not allow hdparm to do the work. The drives were reported as "frozen" and none of the many cures worked. OTOH, DBAN success first time.
    – pauljohn32
    Commented Mar 4, 2018 at 20:24

Another option for reference is to use the ATA Secure Erase method using hdparm.

The problem with using OS level commands such sa DD is that they will only erase blocks seen by the OS. Any spare blocks (especially reserved cells on SSDs) will not be erased.


To reiterate: (2017-Jul)

The ONLY plausible method (for HDD, SSHD and SSD) is to use the ATA 'Enhanced Secure Erase' (ESE) command to 'remove' all stored and residual data.

If this command can NOT be used, the media needs to be 'destructed' (converted to <2mm size fragments, or melted in a furnace).


  • This advice ignores older magnetic-media (from pre-2001 and/or less then 15GB in capacity).
  • Some PC BIOS (or OS) block the ATA command(s) from being run, and some (much older) brand/models (of drive) are problematic, due to poor implementation of ESE.
  • The lesser ATA 'Secure Erase' command is faster but only overwrites with 'zeros', rather than a random pattern.
  • The only truly better method than using ESE is NOT having data on the drive in the first place. This can be achieved by using full-disk encryption (FDE) or self-encrypting drives (SED).

Nwipe, it's a fork of DBAN but unlike DBAN is actively in development. It can run as a command line tool or it's default mode is ncurses GUI. It's in the debian, ubuntu, Fedora repositories. Or if you want to run from a USB stick shredOS, which uses nwipe.


https://github.com/martijnvanbrummelen/nwipeenter image description here

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .