When trying to securely wipe SSDs, we have several problems:
- SSDs wear out after a limited amount of erase cycles
- SSDs have a controller that dynamically maps LBAs (logical block addresses used by the system to access the disk) to NVRAM cells (the actual flash memory cells) to balance the wear, which means telling the disk to overwrite the blocks that formerly stored a specific file may result in overwriting any other spare blocks.
- SSDs have a notable percentage of reserve capacity that is used to compensate dying storage cells and reduce wearing. They are not visible to the system and might hold old data fragments.
Now what options do we have from inside Ubuntu to securely wipe SSDs?
I've heard that some newer SSDs should be able to securely wipe themselves, but how do I find out whether my SSD is capable of this and how would I trigger it?
There should also be an ATA secure erase command, how do I find out if that is supported and how would I trigger that?
Are there also ways to securely wipe only a given file or only unused space?
I guess making a backup of all partitions, securely wiping the entire disk and then restoring the backup would be possible but sounds too complicated and would take too long to be practical. Are there other alternatives? If not, what tools can I use to backup partitions without also backing up already deleted files?
Of course the standard tools like
wipe are not usable here for the points described above. They simply overwrite a a file (by overwriting its file system clusters which are bound to LBAs which are not constantly pointing on the same flash cells due to the wear levelling controller).