How to Use Ubuntu Server hdparm to Secure Erase Solid State Drives

When decommissioning an old Ubuntu Server, you must securely erase the hard drives before recycling them or returning them to the leasing company. With older spinning Hard Disk Drives (HDDs), the standard practice was to use the dd command to overwrite the entire disk with zeros. However, Solid State Drives (SSDs) use “wear leveling” controllers that spread data writes evenly across the flash memory chips. Because of this controller, if you tell the OS to overwrite sector 1 with zeros, the SSD might actually write those zeros to sector 5 to save wear and tear, leaving the original data on sector 1 perfectly intact and recoverable. To truly erase an SSD, you must bypass the OS and send a low-level “Secure Erase” command directly to the drive’s firmware using hdparm.

What is an ATA Secure Erase?

An ATA Secure Erase instructs the SSD’s internal microcontroller to apply a massive voltage spike across all NAND flash memory cells simultaneously. This resets every single cell to its factory-default empty state in a matter of seconds, rather than the hours it takes to overwrite a drive sequentially. If the SSD is a self-encrypting drive (SED), the Secure Erase simply deletes the internal decryption key, rendering all the data instantly mathematically destroyed (crypto-erase).

Step 1: Identify the Drive

First, list the drives connected to your server to identify the exact device path of the SSD you want to wipe. Warning: Executing these commands on the wrong drive will instantly destroy your live operating system.

lsblk

Assume the drive you want to wipe is /dev/sdb.

Step 2: Check the Drive Status

Use hdparm to check the security status of the drive.

sudo hdparm -I /dev/sdb

Scroll down to the Security: section in the output. You need to see two things:

1. supported (The drive supports the Secure Erase command).
2. not frozen (The drive is ready to accept security commands).

If the drive says frozen, it is a security measure implemented by your motherboard’s BIOS to prevent malware from locking your drives. To “unfreeze” the drive, you must physically unplug the SATA power cable from the SSD while the server is running, and plug it back in. Run the hdparm -I command again, and it should now say not frozen.

Step 3: Set a Temporary Security Password

Before the firmware will accept the erase command, the ATA specification requires the drive to have a security password set. We will set a temporary, throwaway password (e.g., “password”).

sudo hdparm --user-master u --security-set-pass password /dev/sdb

If you run sudo hdparm -I /dev/sdb again, the Security section will now say enabled.

Step 4: Issue the Secure Erase Command

Now that the drive is unprotected and has a password, you can issue the kill command. This action is irreversible.

sudo hdparm --user-master u --security-erase password /dev/sdb

For most modern SSDs, the command will complete in less than 10 seconds. The terminal will simply return to the prompt.

Step 5: Verify the Erase

To confirm the erase was successful, check the security status one last time.

sudo hdparm -I /dev/sdb

The Security section should now say not enabled (the password was automatically cleared by the erase process). If you use a hex editor to look at the raw disk, you will see nothing but empty space. Your SSD is now restored to factory-fresh performance and is safe to dispose of.