PowerEdge: how to securely erase M.2 SSDs installed on the BOSS adapter.

Instructions on how to securely erase all the data that is ever written to the M.2 SSDs installed on the BOSS adapter.

 

The BOSS User Guide

https://dl.dell.com/topicspdf/boss-s2_ug_en-us.pdf

States the following: Cryptographic Erase (Sanitize) is only supported if the drive supports it. No other encryption support from controller or drive

Based on the iDRAC User Guide, hard drives on the server are grouped into two categories:
1. Secure erase drives—Includes drives that provide cryptographic erase such as ISE and SED SAS and SATA drives, and PCIe SSDs.
2. Overwrite erase drives—Includes all drives that do not support cryptographic erase.

ISE - Instant Scramble Erase
ISE is a new cryptographic feature for hard drive and SSD that is standard within the next generation of PowerEdge.

ISE is known as instant erase, instant scramble erase, instant secure erase, or crypto erase.

When retiring or repurposing a system or array the Next-Generation PowerEdge servers can help you to permanently erase content (optionally) from hard drive or SSDs.

With ISE, you can use a standard command that triggers the drive to discard its hidden internal media encryption key, to self-generate a new, unrelated key, and then to start using the new key with its internal encryption or decryption engine.

From that point forward the data already on the media is useless ("scrambled").

Even physical locations of reassigned logical blocks are scrambled (in the rare chance that data can be somehow recovered from these "bad" locations).

The drive now uses the new internal media encryption key for its transparent encryption and decryption. Regardless of the drive size, ISE operates consistently to help you repurpose drives quickly. 

Cryptographic erasure is a media sanitization technique based on erasing or replacing the Media Encryption Key (MEK) of a Self-Encrypting Drive (SED), including modern SSDs that store data in an encrypted form. While the encrypted data remains on the storage device itself, it is impossible to decrypt, rendering the data unrecoverable.

The customer must be made aware of the following details:

1. Physical erase deletes only the metadata on the M.2 SSDs. Not the data blocks written to the drives.
2. The secure erase option provided in HII, is similar to physical erase. It is NOT the same as cryptographic erase/sanitize.

Dell provides supports for Cryptographic erase/Sanitize only as part of Lifecycle Controller's system wipe or system erase. During system erase operation, iDRAC sends the sanitize command to the M.2 drives connected behind the BOSS adapter.
 

DELL recommends that the customer uses only life cycle controller's System Wipe/System Erase/RACADM tools in-order to SANITIZE the M.2 SSDs.