How to Securely Wipe and Reclaim Unused SSD Blocks Using blkdiscard in Linux

Managing Solid-State Drives (SSDs), NVMe storage modules, and thin-provisioned virtual machine disks under Linux requires fundamentally different maintenance strategies than traditional mechanical hard disk drives (HDDs). On legacy magnetic platters, securely wiping data or preparing a disk for re-partitioning typically involved writing random bytes or zeroes across the entire surface using utilities like dd or shred. On NAND flash storage, overwriting cells with zeroes causes severe write amplification, consumes finite flash write endurance cycles, and degrades future write performance. The blkdiscard command-line utility provides the correct, flash-optimised solution: it issues native hardware-level TRIM and DISCARD commands to erase blocks and restore factory write speeds.

Understanding TRIM, DISCARD, and Flash Memory Management

Solid-State Drives cannot overwrite existing data in place; NAND flash cells must be erased in large blocks before individual pages can be written to. When files are deleted from a file system, the operating system normally unlinks the inode entries but leaves the underlying storage blocks marked as containing valid data from the SSD controller’s perspective:

• Write Amplification: When the drive eventually needs to write new data to those dirty blocks, it must execute a slow read-erase-modify-write cycle, halving sustained write throughput.
• Hardware DISCARD: The blkdiscard utility sends an IOCTL request directly to the underlying block device, notifying the SSD flash translation layer (FTL) that entire ranges of sectors contain no valid data. The controller immediately marks those flash blocks as unallocated and schedules background garbage collection, restoring peak read/write IOPS.

Verifying DISCARD Support on Storage Drives

Before issuing discard commands, verify that your SSD controller and storage bus support TRIM/DISCARD requests:

lsblk --discard /dev/nvme0n1

Inspect the DISC-GRAN (discard granularity) and DISC-MAX (maximum discard size) columns:

• If the values are non-zero (such as 512B or 2G), the drive supports hardware-level discards.
• If the values return 0B, the drive or intermediate storage controller (e.g., legacy hardware RAID card or unsupported USB enclosure) does not pass DISCARD commands down to the flash silicon.

Completely Sanitising and Resetting an Entire SSD

Severe Data Loss Warning: blkdiscard operates directly on raw block devices. It does not prompt for confirmation and erases all partitions, file system superblocks, and partition tables immediately. Verify target drive identifiers with lsblk before proceeding.

To discard every single logical block across an entire unmounted solid-state drive:

sudo blkdiscard /dev/nvme0n1

Unlike dd if=/dev/zero, which can take hours to write gigabytes of zeroes across a high-capacity drive, blkdiscard completes across a 2 TB NVMe SSD in a matter of seconds. The controller simply updates its internal lookup tables, instantly unmapping all physical flash blocks.

Secure Discard Operations with –secure

For high-security enterprise decommission procedures, some SSD controllers support cryptographic or physical erase routines exposed via the secure discard flag:

sudo blkdiscard --secure /dev/nvme0n1

If the device firmware supports cryptographically discarding blocks (often resetting the drive’s internal AES hardware encryption key), blkdiscard -s performs this enhanced sanitisation. If unsupported by the hardware controller, the command cleanly falls back or returns an unsupported hardware error.

Discarding Specific Sector Ranges with Offset and Length

If you wish to sanitize a specific retired partition without erasing the entire physical drive, specify byte offsets and lengths:

sudo blkdiscard --offset 1073741824 --length 107374182400 /dev/sdb

This command starts discarding at the 1 GB boundary (1073741824 bytes) and trims exactly 100 GB (107374182400 bytes) forward, leaving surrounding partition tables and neighbouring partitions completely unaffected.

Performance Recovery Benchmarking

After executing blkdiscard on an SSD that previously suffered from degraded, dirty write performance, the drive’s garbage collection system immediately operates with maximum free block availability. Formatting a fresh file system on the device (e.g., mkfs.ext4 /dev/nvme0n1) achieves sustained factory-fresh sequential and random write IOPS.