How to secure erase your SSD's on a Mac

UPDATE: with TRIM now available for those SSDs that support it (as most do nowadays) this procedure is no longer required. If you have an early drive (eg Intel G1) then you will want to do this secure erase perhaps once a year to keep your SSD at top performance.

For those not familiar, secure-erase is an ATA command that most SSD controllers will recognize (i.e. Intel) that will mark all NAND blocks as free, thus returning the drive to the "factory" state and maximum performance.

Unfortunately, executing this command can be extremely troublesome as it turns out. HDDErase is the most common utility, but requires a BIOS equipped computer to run (aka a PC). Even then, SATA controller and BIOS support for this utility is spotty at best... it wouldn't work on my friends Dell PC and there are numerous reports across a variety of forums of all kinds of motherboards failing to work with this utility.

Fortunately, I was able to piece a couple of nuggets together from a couple of different sources that actually allowed me to execute the secure-erase on my 2009 Mac Pro. (BTW, I can't see why this won't work on any Intel Mac from laptops to workstations).

Here's what's required:

To keep things simple, I would recommend you pull all your other SSD's and HDD's from your Mac Pro... only use the optical drive and the target drive (one at a time if you have multiple).

#1 Prep your SSD's by ensuring their firmware is up to date. For Intel SSD's this thread may help in that regard (post #11)... https://forums.macrumors.com/threads/686672/

#2 Unfreeze your SSD: This is required because the firmware for the on-board SATA connectors "freezes the drive" (to use the ATA nomenclature) making it unable to accept the secure-erase command. There are at at least 3 reported ways to solve this...

Option A: Attaching the target drive via a USB enclosure eliminates this issue. This is the method I used. Get A USB enclosure or dock for your SSD. Apparently eSATA enclosures may also work if that's more convenient for you.

Option B: Use the Disconnect/Reconnect method. There are a few people reporting success with unfreezing their drives using the technique of disconnecting and reconnecting them to the Sata connection during boot... Here's the process in detail from post #69:

Well the process takes 2 min, I have vertex 2 in my macpro and successfully did it using the method described by OP, except to get the disk to be in a not frozen state, you need to take it out when the machine is booting, and insert it right after you select to boot from CD (you need to insert it during boot of the cd so the linux picks it up, inserting it when gparted has already booted wont work).

Click to expand...

Option C: Sleep the computer to unfreeze the drive? This hasn't been verified with the Linux disk recommended below but people have reported success with this method using Ubuntu 10.04 LTS (see post #100 and post #142 and post #168 and post #169)

To unfreeze the drive I simply closed the lid until the MBP was asleep and then reopened it. Sure enough it said "not frozen" when I issued the hdparm command after that, and away I went with the rest of the commands.

Obviously if you reboot it'll re-freeze the drive as part of the POST process (or whatever they call it in EFI). So for the sleep method you need a distro that supports sleep/wake on your Mac model... I've not tested gparted, but I knew that Ubuntu supports it on mine which is why I went straight for that instead. YMMV as sleep support on Linux can be a bit hit and miss.

Click to expand...

#3 Prep a GParted Live bootable Linux CD. Burn the following ISO to a blank CD or DVD to boot with (using either Disk Utility or your favorite burning utility)...
http://sourceforge.net/projects/gparted/files/gparted-live-stable/

Of course, to boot this you have to hold the "Option" key during startup to invoke the startup disk options... select the CD. At the end of the boot sequence, you have the option to use the X GUI or command line. The GUI mode does not support widescreen display resolutions. So unless you have an old-school 4:3 monitor around (like I did), or your display supports 4:3 resolutions (the 24" ACD does not), you will have to use the command line.

If you get to the GUI, you will get a screen that looks like this...



The key benefit of the GUI is getting the device ID for the drive as circled above. However, if you don't get the GUI, and you only have one drive (the target SSD) connected as I recommended, then it will always assign the device ID of "/dev/sda" so you don't really need the GUI.

#4 Command Line Steps. Armed with the device ID or assuming "/dev/sda" if you never got to the GUI, you then follow these instructions exactly... (you can get to the command line from the GUI by double-clicking the "Terminal" icon)
http://peter.membrey.hk/2011/09/11/...structions-on-how-to-securely-erase-your-ssd/

Notes on the command line steps:
- These steps will wipe all your data... be sure you have backed up or don't care about loosing the contents of your drive
- Step 1: the first time I entered the hdparm command at the command line, I got an error. Try again. For some reason, it always gave me an error the first time but then worked properly for all subsequent commands.
- Step 1A: This is enabled by using the USB enclosure mentioned above. If you try to do this operation with the SSD connected to your main board SATA ports, you will find the drive "frozen"
- Step 2: This password assignment step is left out of most tutorials on this subject which is odd, because it won't work without it. Simply follow the instructions exactly as shown and it will work fine.

I think that covers it... of course, YMMV and I'm not responsible if you blow up your computer and all that crap!

bugout said:

That article doesn't explain anything.. Of course just erasing the drive won't do anything, but zeroing out the data has the same effect as writing a 73g file. It overwrites the entire drive exactly the same way his terminal command creates a 73GB file.

Maybe I don't have enough coffee in me yet, but am I missing something?

Click to expand...

In essence, conventional HD erase programs are doing the opposite of what you want to do with an SSD. Zeroing out an SSD effectively writes a "0" to every cell. What you want to actually do is "unwrite" to all cells, which can only be done with the secure-erase feature built into the drives controller which effectively free's up all written NAND blocks. By doing this, you remove any write-erase block penalty going forward, at least until usage has resulted in writing once to all NAND blocks.

rtrt said:

right at the bottom of the article he says that disk utility - erase free space would be equivalent but suggests it'd take longer

Click to expand...

The HDDErase utility is the most common method for PC users to do a secure-erase, and in fact, this is what Intel recommends. However, this utility will NOT work on a Mac due to the EFI firmware. It requires a BIOS to work and even then, support is spotty from one motherboard to the next.

The approach I outlined above, will work equally as well on Mac's or PC's as it completely ignores the firmware/bios and simply instructs the drive's controller to issue the secure-erase command directly.

Nice... I had read that some people were successful exploiting the hot-swap capabilities of SATA to do this... looks like you've confirmed it.

ncc1701d said:

Hi VR. just wondering... If your boot and apps are on your SSD, I'm guessing your home folder is on another HDD, how long before you started to see a decrease in speed form the SSD?

Click to expand...

I have 3x80GB SSD's in a SW RAID0 array... so I have 240GB of SSD storage. Thus I have everything on my SSD array... OS, Apps, home directory, iTunes, etc. I even have enough space to put the source files for a 5 min HD video project (about 50GB worth of files) and still have 20% spare space.

I archive my projects to a 1TB WD Black and also back everything up to a 1TB Time Capsule.

I didn't perceive any degradation in performance of the SSD's... the reason I decided to do a secure erase was just because it was an appropriate opportunity when I added a 3rd SSD to the array at Christmas time. I will probably do a secure erase and reinstall the latest OSX version from scratch once a year or so just to ensure everythings running optimally.

skiffx said:

Sounds like a lot of pain in the ass tbh, Apple needs to step up and come up with a decent solution already ffs.

Click to expand...

Agreed... support for TRIM would go a long way and should be relatively easy to add.

ti479 said:

Could someone use the CCleaner secure delete option to function like trim?
it is a 3 pass process.

Click to expand...

This kind of secure erase is completely different to that used to return SSDs to "new" and unutilized condition. Most disk utilities that secure erase the data do so by over writing data bits with 0 or 1's. This is exactly the opposite of what we are talking about here which is marking all storage locations in flash as unutilzed.

EDIT: @Skiffx... I have no experience with OCZ drives, but my understanding is that without TRIM, you would be facing the same issues of degraded performance over time and need to use the secure erase solution described here to restore full performance periodically.