How to securely erase Apple NVME SSD?

I just got one of the new 12-inch MacBooks and would like to wipe the storage drive. With a conventional SATA drive I'd use the "ATA Secure Erase" command which can be sent from a Linux environment using the hdparm utility.

With the new NVME drive this does not work. I found a Linux utility called nvme-cli but even with its format option it fails with an error INVALID_OPCODE(1) (looks like the NVME controller rejects the command).

I've tried multiple permutations of the command and options, including targeting the raw NVME controller /dev/nvme0 or one of its namespaces instead /dev/nvme0n1, different parameters to the -s option, etc. I also bought Parted Magic which claims to be able to secure-erase NVME drives and unfortunately that fails as well.

I'm currently just doing it the old-school way with shred which writes random data to the drive but obviously this isn't ideal as it's slow and shortens the live of the drive, so I'd love to know the proper method to use in the future.

Regards.

Solution 1:

The proper / official / thorough way to sanitize an Apple SSD is to enable FileVault before you copy any data to it. When you shred the encryption keys - the data is cryptographically erased instantly.

Note: With a solid-state drive (SSD), secure erase options are not available in Disk Utility. For more security, consider turning on FileVault encryption when you start using your SSD drive.

Apple’s terse recommendation requires you to read between the lines or know about cryptographic sanitization of data and read up on FIPS / etc...

https://support.apple.com/en-us/HT207497

That being said, I would just install a new OS and then enable FileVault which will then encrypt each block on the drive with the new keys - a one time erase pass.

Then you can decide if you want to put it back in service or destroy those keys without decrypting the contents of the drive.