NVMe Format vs Sanitize: how to erase an SSD safely

An SSD is leaving a laptop, test fixture or customer system. Someone deletes the files, performs a quick format and calls the drive “wiped.” That may make the volume look empty, but it does not prove that the previous data is infeasible to recover.

NVMe provides device-level erase mechanisms, yet their names are easy to confuse with an operating system's Format button. The safe decision starts by separating four different actions.

Four actions that do not mean the same thing

A filesystem cannot normally address retired NAND blocks, spare capacity or controller caches directly. Repeatedly writing files also creates unnecessary wear without proving that hidden physical locations were covered.

NIST defines sanitization around an outcome: access to target data must be infeasible for a stated level of effort [4]. That is broader than making a volume mount as empty.

What NVMe Format NVM can do

The NVMe Format NVM command configures the logical block format of a namespace. It also includes a Secure Erase Settings field. Depending on support, that setting can request:

• no secure erase;
• user-data erase;
• cryptographic erase.

The exact scope matters. A command may target one namespace, while a controller may indicate that formatting affects all namespaces. Some drives support only one logical block format; others expose several. Never infer behavior from the tool's short menu label.

Use the Identify data from the exact drive and the current vendor documentation to answer:

1. Which secure-erase settings are supported?
2. Does the operation apply to one namespace or the entire controller?
3. Are all attached namespaces, persistent memory regions or controller buffers covered?
4. Does the OEM firmware or platform block the command?

Format NVM is useful for namespace reconfiguration and can provide an erase mechanism. It should not be described as identical to Sanitize.

What NVMe Sanitize adds

NVM Express defines Sanitize so previous user data cannot be recovered from cache, nonvolatile media, controller memory buffers and other storage covered by the NVM subsystem [1]. Its purpose includes data that is no longer addressable through normal reads.

A supporting controller advertises one or more methods:

Support is optional. The controller's Sanitize Capabilities field is the starting point, not a generic SSD checklist. NVM Express also provides a Sanitize Status log with progress, completion status and estimated times [1][3].

Once Sanitize starts, normal reads and writes can be unavailable. A controller reset or power cycle does not cancel the operation; the device resumes it [2]. Stable power is still important because repeated interruptions delay completion and complicate evidence collection.

Choose from risk, not convenience

The same drive may require different handling when it is returned to the same employee, reassigned to another customer, sold, sent for warranty analysis or physically discarded.

NIST SP 800-88 Rev. 2 frames media sanitization as an organizational program, including policy, approved standards, trust in the implementation, validation and documentation [4]. It points organizations to current applicable standards instead of treating one copied command as a universal answer.

Define before execution:

• the sensitivity and ownership of the data;
• whether the SSD will be reused or destroyed;
• the approved Clear, Purge or Destroy outcome under the applicable policy;
• which device command and tool version meet that outcome;
• what completion and validation evidence must be retained.

Cryptographic erase can be fast, but its assurance depends on encryption and key management having covered every target-data location. A failed or untrusted device may require an approved destruction process instead of a logical command.

A controlled NVMe erasure workflow

Do not begin with the destructive command. Begin with identification and containment.

1. Authorize and inventory. Record asset ID, serial number, model, capacity, firmware, namespace layout and data owner.
2. Back up what must be retained. Format and Sanitize are destructive; assume there is no undo.
3. Isolate the target. Disconnect other removable or NVMe devices where practical. Map the tool's controller and namespace names to the physical asset twice.
4. Read capabilities. Use a read-only Identify operation to capture Format and Sanitize support, scope and available methods.
5. Select the approved method. Apply the organization's current standard, the SSD vendor's instructions and the required assurance level.
6. Provide stable power. Prevent sleep, surprise removal and maintenance shutdowns during the operation.
7. Monitor device status. For Sanitize, retain the status-log output from start through successful completion. A command returning to the prompt is not always proof that background work finished.
8. Validate. Confirm completion status and perform the validation required by policy. Re-read identity so the evidence is tied to the intended device.
9. Record disposition. Store operator, date, asset identifiers, method, tool version, results, exceptions and next destination.

The NVM Express NVMe-CLI guide demonstrates capability inspection, Sanitize initiation and status monitoring [1]. Treat its destructive examples as administrator procedures, not commands to paste before target verification.

Common failure modes

• Wiping the wrong namespace: controller and namespace identifiers can look similar, particularly through remote consoles.
• Assuming every SSD supports crypto erase: capability bits and implementation evidence are required.
• Stopping when the command is accepted: Sanitize is a background operation; collect final status.
• Relying only on a successful read test: deallocated logical blocks may return defined values without proving every hidden location was handled.
• Reusing a drive after a failed sanitize: quarantine it until the failure is resolved or an approved alternate disposition is completed.
• Forgetting power-loss behavior: erasure procedure and ordinary in-service data protection are separate concerns; review SSD power-loss protection for the latter.

After returning a drive to service, capture a fresh baseline from the NVMe SMART/Health log so later errors and wear trends are not confused with the retirement procedure.

Bottom line

Deleting files and quick-formatting a filesystem are not SSD sanitization. NVMe Format NVM can reconfigure a namespace and may request user-data or cryptographic erase; NVMe Sanitize is designed to cover all locations that have held user data and report its progress. Identify the exact device, choose an approved method from the required assurance level, preserve power, verify completion and keep an auditable record.