Erasure Speed:
Overwrite vs. Crypto Erase.

Analysis: Physical Speed vs. Logical Certainty

In high-volume IT asset disposition, a large share of processing time is spent waiting for drives to finish writing patterns. Choosing the right method for each drive type matters more than any single speed figure.

An overwrite has to physically write every addressable sector, so its duration is roughly the drive's capacity divided by its sustained write speed, multiplied by the number of passes. As an illustration of the arithmetic only (not a measured result): writing 4 TB at an average of 200 MB/s takes about 20,000 seconds, or roughly 5.5 hours, for a single pass. A three-pass method triples that, and a verification pass that reads the drive back adds more.

Cryptographic erase works differently. Self-encrypting drives and most modern SSDs store data encrypted with a media encryption key held inside the drive. Replacing or destroying that key leaves the stored ciphertext unreadable, and the drive can do this without rewriting the data. That is why cryptographic erase usually completes in a fraction of the time an overwrite needs, and why its duration hardly depends on capacity. Block erase on flash media is also handled by the controller and is generally much faster than a host-side overwrite, though drives differ.

Understanding the 'Purge' Delta

NIST SP 800-88 recognizes three levels of sanitization: Clear, Purge and Destroy. The current revision, Rev. 2 (2025), keeps those categories from Rev. 1 (2014) and refers to industry standards such as IEEE 2883-2022 for the commands that achieve them on each type of media.

Legacy tools operate at the 'Clear' level, writing patterns across the entire media. D-Secure applies Purge methods, using the drive's own sanitize or cryptographic erase commands where the drive supports them. On drives that support cryptographic erase, destroying the encryption keys makes the stored data unreadable much faster than overwriting. The report records the method actually used. A macOS edition of Drive Eraser is coming soon and is not yet available.

Speed is not the only reason to prefer Purge on flash media. Because an SSD remaps writes through its flash translation layer and keeps spare blocks the host cannot address, a host-side overwrite can finish without ever touching some cells that held data. Controller-level sanitize commands are designed to cover those areas. On magnetic hard drives the trade-off is different: an overwrite with verification is a sound Clear method, and the main cost is time.

Cryptographic erase is only as strong as the drive's encryption and key handling, which NIST's guidance has long cautioned about. A sensible process therefore confirms that the command completed, verifies the result, and keeps a signed record. Every D-Secure erasure produces a report with a certificate on page 1 and a summary from page 2, signed with SHA-256 and 2048-bit keys.

Planning an Erasure Batch

• Sort by media type. Group HDDs, SATA SSDs and NVMe drives, because the fastest valid method differs for each.
• Prefer Purge commands on flash. Use sanitize or cryptographic erase where the drive supports them; reserve overwriting for drives that do not.
• Budget time for large HDDs. Use the capacity-divided-by-write-speed estimate above, and remember that extra passes multiply it.
• Check failures separately. A drive that rejects every software method, or is physically damaged, should go to physical destruction.
• Keep the report with the asset record. The signed report is what proves the erasure happened, whatever the method took.

Read more about the method in our cryptographic erase guide, compare the standards in the media sanitization comparison, or see how results are checked in the verification methods guide.