Secure Erase | Nvme Format

nvme security-send /dev/nvme0 --nvmsid # if PSID available Or issue nvme format with --pi=0 and --ms=0 to clear metadata protection. If you want, I can show a for NVMe that checks crypto support, falls back to SES=1, and verifies erasure via reading LBAs.

nvme id-ctrl /dev/nvme0 -H | grep -i "crypto" Unlike SATA (whole device), NVMe format can act on one namespace — leaving others untouched. That means you can secure erase a single namespace without affecting another. 4. Persistent Memory Region (PMR) and Sanitize For absolute forensic-proof erase (including metadata, caches, and possibly overprovisioning area), NVMe also has a Sanitize command ( nvme sanitize ), which is more thorough than format secure erase — but takes longer. 🔹 Comparison Table (Interesting Highlights) | Feature | SATA Secure Erase | NVMe Format (SES=2) | |---------|------------------|----------------------| | Speed | Slow (full write) | Instant (key change) | | Works on namespaces | No (whole device) | Yes (per namespace) | | Destroys encryption key | No (if no encryption) | Yes (media key regen) | | Works when frozen | No (requires unfreeze) | Yes (in most cases) | | Overprovisioned area erased? | No | No (Sanitize needed) | 🔹 Real-world interesting edge case Some NVMe drives have locked security due to TPer (Trusted Computing) — you’ll see: nvme format secure erase

| SES Value | Name | Effect | |-----------|------|--------| | 0 | No secure erase | Just change LBA format, keep data | | 1 | User Data Erase | All user-accessible LBAs set to a vendor-defined pattern (usually all zeroes) | | 2 | Cryptographic Erase | Change the media encryption key → all previously written data becomes permanently undecryptable | ✅ SES=2 (Crypto Erase) is near-instant (<1 second) regardless of drive capacity because it only changes an internal encryption key, not rewriting every LBA. 🔹 How to Issue (Linux nvme-cli ) # Quick crypto erase on namespace 1 nvme format /dev/nvme0n1 --ses=2 Full user data erase + set to 4K sector size nvme format /dev/nvme0n1 --ses=1 --lbaf=1 With force (ignore safety checks) nvme format /dev/nvme0n1 --ses=1 --force 🔹 Interesting Technical Nuances 1. Deallocation ≠ Secure Erase blkdiscard or nvme dsm (Dataset Management) only unmap logical blocks — data may still be recoverable via NAND reads. Secure erase via format works at the controller/firmware level. 2. Cryptographic Erase is Not Encryption Activation If the drive doesn’t already have a randomly generated media encryption key (most modern NVMe SSDs do internally for wear leveling), SES=2 might fall back to SES=1 or be unsupported. Check with: nvme security-send /dev/nvme0 --nvmsid # if PSID available

NVMe status: Security Violation (0x182) In that case, even nvme format --ses=1 fails. You need to: That means you can secure erase a single