nvme-cli has both a format and sanitize command that can be used to securely erase an NVMe SSD. Both of these commands offer a cryptographic approach, where the drive’s encryption key is changed/deleted, making the data inaccessible.
Sanitize device /dev/nvme0n1 using Crypto Erase sanitize operation
nvme sanitize /dev/nvme0n1 -a 4
Securely erase /dev/nvme0n1 via Cryptigraphic erase
nvme format /dev/nvme0n1 -s 2
Questions:
-
Do you need to explicitly set a password/encryption key prior to issuing either of these commands. If so, how?
-
How to verify the encryption key has been set prior to issuing the command, and verify it’s been successfully removed, after the command has completed?
