tinyapps.org / docs / NVMe Secure Erase

(Also in this series: ATA Sanitize Device and hdparm, ATA Secure Erase (SE) and hdparm, and NVMe Sanitize.)


nvme-format, part of nvme-cli (NVMe management command line interface), offers two Secure Erase options:

Secure Erase Settings: This field specifies whether a secure erase should be performed as part of the format and the type of the secure erase operation. The erase applies to all user data, regardless of location (e.g., within an exposed LBA, within a cache, within deallocated LBAs, etc). Defaults to 0.

Value Definition
0 No secure erase operation requested
1 User Data Erase: All user data shall be erased, contents of the user data after the erase is indeterminate (e.g., the user data may be zero filled, one filled, etc). The controller may perform a cryptographic erase when a User Data Erase is requested if all user data is encrypted.
2 Cryptographic Erase: All user data shall be erased cryptographically. This is accomplished by deleting the encryption key.
3-7 Reserved

NVM Express Base Specification Revision 1.3c May 24, 2018 states:

As part of the Format NVM command, the host may request a secure erase of the contents of the NVM. There are two types of secure erase. The User Data Erase erases all user content present in the NVM subsystem. The Cryptographic Erase erases all user content present in the NVM subsystem by deleting the encryption key with which the user data was previously encrypted.


0. Install nvme-cli

The nvme-cli README.md includes installation instructions for a number of Linux distributions, though building is as simple as make && make install.

1. List NVMe devices

# nvme list

Node             SN                   Model                                    Namespace Usage                      Format           FW Rev  
---------------- -------------------- ---------------------------------------- --------- -------------------------- ---------------- --------
/dev/nvme0n1     XXXXXXXXXXXX         WDS250G2X0C-00L350                       1         250.06  GB / 250.06  GB    512   B +  0 B   101110WD

2. Verify Secure Erase support

# nvme id-ctrl -H /dev/nvme0
NVME Identify Controller:
vid     : 0x15b7
ssvid   : 0x15b7
sn      : XXXXXXXXXXXX        
mn      : WDS250G2X0C-00L350                      
fr      : 101110WD
oacs    : 0x17
  [1:1] : 0x1 Format NVM Supported
fna     : 0
  [2:2] : 0 Crypto Erase Not Supported as part of Secure Erase

This device supports User Data Erase (value 1 in above table), but not Cryptographic Erase (value 2 in above table).

3. Issue Secure Erase command

# nvme format /dev/nvme0 --ses=1
Success formatting namespace:ffffffff

4. If errors were encountered, suspend and resume computer then re-run

# nvme format /dev/nvme0 --ses=1
NVME Admin command error:INVALID_FORMAT(410a)
# systemctl -i suspend
# nvme format /dev/nvme0 --ses=1
Success formatting namespace:ffffffff

5. Verify

# hexdump /dev/nvme0n1
0000000 0000 0000 0000 0000 0000 0000 0000 0000



created: 2018.06.30, updated: 2021.05.05