Skip to content 
Crypto Erase
Classic overwriting reaches its limits on SSDs and encrypted drives. An alternative is Crypto Erase: instead of rewriting every memory block, the key with which all data is encrypted is destroyed. Here you can find out how this works, where the method is used and when it is not sufficient on its own.
In brief
Crypto Erase (cryptographic erasure) makes data unreadable by deleting or replacing the key with which a drive encrypts all data. The encrypted data remains physically present but can no longer be decrypted without the key. The method usually takes only seconds and is especially common with self-encrypting SSDs (SED).
How Crypto Erase works
A self-encrypting drive automatically encrypts every write operation with an internal key, often called the Media Encryption Key. This key does not leave the drive. With Crypto Erase, the firmware deletes the key and generates a new one. All data stored so far is then nothing but a jumble of characters, because the matching key no longer exists.
Because no block has to be overwritten, the method is fast regardless of capacity. It also covers areas that software can hardly reach from the outside, such as the spare blocks of an SSD, provided only encrypted data is stored there as well.
Where Crypto Erase is used
| Environment | Typical implementation |
|---|---|
| SATA SSDs | ATA Sanitize command with Crypto Scramble function |
| NVMe SSDs | NVMe Sanitize with Crypto Erase action or NVMe Format with cryptographic erasure |
| Self-encrypting drives (SED, TCG Opal) | Reset or regeneration of the key via the Opal functions |
| Smartphones and tablets | With current device encryption, a reset removes the keys, in essence a Crypto Erase |
The US guideline NIST SP 800-88 classifies Cryptographic Erase under certain conditions in the "Purge" category, that is, methods that are meant to withstand laboratory attacks as well. The IEEE 2883 standard also describes the method.
Limits and risks
- Encryption from the start: Crypto Erase affects only data that was encrypted with the deleted key. If a drive was encrypted only later, older data may lie unencrypted in free areas.
- Software encryption: With BitLocker using the option "encrypt used disk space only", previously erased content remains unencrypted in the free area. Deleting the BitLocker key then does not replace a complete erasure.
- Firmware quality: Whether the key is really destroyed securely depends on the manufacturer’s implementation. It can only be verified to a limited extent from the outside.
- Evidence: A command alone is not proof. For accountability you need a report for each data carrier with method, result and serial number.
Rule of thumb: Crypto Erase does not delete the data but the key. That is secure if everything was really encrypted, and only then.
Crypto Erase in IT decommissioning
In practice, Crypto Erase is often combined with further steps, such as an overwrite pass and a check of the result. Which method suits which drive is described in our guide Securely erasing hard drives and SSDs.
At Second IT, HDDs, SSDs and mobile devices are erased with Blancco software, including hidden areas such as HPA and DCO. For every device there is a digitally signed erasure certificate with the serial number. Data carriers that cannot be erased are destroyed in-house in accordance with DIN 66399 (up to security level H-5 and E-5). More on certified data deletion.
Frequently asked questions about Crypto Erase
Is Crypto Erase more secure than overwriting?
Not across the board. On SSDs, Crypto Erase also reaches spare blocks that can remain hidden during overwriting. However, it is only secure if all data was encrypted with the deleted key from the start and the firmware works correctly. Many methods therefore combine both and verify the result.
Does Crypto Erase also work on normal hard drives?
Only if the hard drive is self-encrypting. Classic HDDs without hardware encryption store data in plain text. There is no key there that could be deleted. These drives are overwritten or physically destroyed.
Is resetting a company phone enough?
On current, encrypted smartphones, a reset removes the keys and thus acts like a Crypto Erase. For companies, however, the proof for each device is missing, and locks such as the activation lock may remain active. Details are explained in our guide on company phones.
Is it enough to delete the BitLocker key?
Not always. With BitLocker using the option "encrypt used disk space only", previously erased content remains unencrypted in the free area. Deleting the key then does not replace a complete erasure of the drive.
How long does a Crypto Erase take?
Usually only seconds. No memory block has to be overwritten; only the key is deleted or replaced. The duration is therefore independent of the drive’s capacity. A report for each data carrier is still needed.
Erase SSDs, HDDs and mobile devices verifiably, with a certificate for each device.
Send us your device list. You will receive your offer in 48 hours on average.