Why is ATA Secure Erase strongly discouraged for USB SATA adapters?

Posted by koreth@reddit | linuxadmin | View on Reddit | 10 comments

I was looking for the best way to zero out some external SSDs. They're all SATA SSDs in enclosures with USB 3.1 adapters that support the UASP spec.

There is a quick way to zero out an SSD using the ATA Secure Erase command, but several of the resources I found advised very strongly against ever using it on a USB-connected SSD. Usually in red, just to make it more emphatic.

But none of the web pages I've found so far say why it doesn't work. I can't tell whether the warning is, "It can never work properly because of some fundamental, unavoidable aspect of bridging SATA to USB," or, "It should work, but some adapters have firmware bugs that cause it to blow up, so we are going to just give a blanket warning to keep people out of trouble."

What's the story here?

[-]

RipperTux@reddit

I found a technical answer here linking here. The text is copied below:

The Secure Erase command disconnects the drive from the system andoffloads all erase commands to the drive controller. The drivecontroller will not communicate with the host system until the erasecommand has been completed. The drive must be left alone for theduration of the erasure. SATA/PATA ports have no problem doing this(they're designed with it in mind), the ATA-USB bridge used by externalenclosures is not. If the hard disk controller stops responding (whichit will during the erase command) the USB host controller will not beexpecting the device to timeout and disconnect. The host controller mayattempt to disconnect or reset the bridge device, which can interferewith the hard disk controller while it is performing the secure erase.This can cause undefined behaviour on the drive, including unrecoverablefailure.If you want to erase an external drive connected over aUSB or Firewire bridge you must use a software method of erasing thedrive. If the drive is an SSD it must be connected to a SATA port anderased using the secure erase command.

[-]

rizsamron@reddit

So my SSD is totally gone? The first time I tried secure erase because I was curious and it broke my SSD. Luckily it's just a 120GB SSD 😄
I used an enclosure when I did it. The thing is, after it failed, I was still able to copy partitions to it via gparted but then trying to boot from it, the drive is broken LOL

[-]

devilschocolate@reddit

dude you got the right answer. should be on top

[-]

hwertz10@reddit

Two notes here --

1) Interestingly, the 5TB external I have (once I got it passing commands -- see next point), the secure erase is supposed to take 818 minutes, the "extended" secure erase lists 2 minutes and really finishes in a second or two. It's spinning rust, but with SMR drives (which have to read in like 256MB, modify it, and write it back out to write out some blocks), to avoid the "read/modify" part they support TRIM, so apparently the extended erase is just doing a full-disk trim (like it would do on SSDs for the secure erase that just takes a second or two.)

2) usb-storage supports passing through SATA commands and such (this was used in USB 1 and 2); uas (used for USB 3 drives) does not. In Linux, you must blacklist your drive from uas (so it uses usb-storage). usb-storage is a bit slower than uas but doesn't drop it to USB2 speeds or anything; it does let smart, hdparm, etc. work to mess with the drive.

In my case, I didn't feel like waiting 15 hours to do a secure erase, the extended secure erase "zeroed" the disk in like 2 seconds. Very nice!

[-]

vegansgetsick@reddit

Very old post but it's just for confirmation and tips : it's because the Secure Erase command takes HOURS and the disk will not respond to anything during that time. The USB controller will think the drive is Kaputt and will reset the link, interrupting the Secure Erase and setting the drive in locked mode, unusable... (until unlock command is sent).

People recommend to do it with SATA, but this timeout can ALSO occur with sata ! It happened to me twice, and after 20min exactly 🙄

That's why the SAFE way to do a secure erase is to FIRST lock the drive manually (then maybe disconnect/reconnect the drive). Once the drive is locked, the OS, controller, or whatever, wont try to reset it (or cant). And then you can execute the secure erase on it for hours. No more timeout.

[-]