Estimate secure delete overwrite passes for SSD or HDD

Secure deletion advice is often reduced to a contest over overwrite-pass counts, but the storage medium matters more than the number. This estimator distinguishes a modern magnetic hard disk drive from a solid-state drive and returns practical, media-specific guidance. It explains when one overwrite pass is meaningful, when overwriting cannot reliably reach old physical data, and which device-level alternatives deserve consideration. The result is educational guidance for planning and review; it does not operate a drive, verify erasure, or certify compliance with a particular sanitization standard.

For a modern HDD, one complete pass is meaningful

On a functioning modern magnetic hard disk drive, one complete overwrite of every addressable user sector meaningfully replaces the recorded data. Repeating the process with elaborate patterns or many rounds does not add a meaningful practical recovery-resistance benefit for ordinary modern drives. That is why the estimator returns one pass for HDD rather than preserving historical multi-pass folklore.

Completion and scope still matter. Overwriting one file is not the same as overwriting the whole addressable device: a filesystem may have old copies, deleted space, snapshots, journals, or temporary data elsewhere. The drive may also have remapped an unhealthy sector, putting it outside normal logical access.

When an organizational policy requires device-level sanitization, use a supported sanitize command and record its result instead of assuming a file-deletion utility covered every location. If the drive is damaged, intermittently readable, or leaving organizational control under a strict policy, an approved physical-destruction path may be required. The answer therefore describes a meaningful overwrite count, not an unconditional certificate that every possible copy has disappeared.

For an SSD, overwrite passes are not a reliable measure

A solid-state drive translates logical addresses into physical flash locations through its controller. Wear leveling deliberately moves writes around so the same cells are not exhausted, while garbage collection, spare capacity, and bad-block remapping can leave older physical pages beyond ordinary host access. Consequently, writing once to every visible logical address does not prove that each previous physical copy was overwritten.

Writing the same logical range again can reach still more new locations, consume endurance, and yet leave the core assurance problem unresolved. The estimator reports zero meaningfully reliable overwrite passes for SSD: this does not mean doing nothing, and it does not claim that a single logical overwrite has no effect. It means no pass count can supply the guarantee people usually seek from secure erasure.

Prefer the device's supported sanitize or secure-erase operation, or a cryptographic erase when data was protected by suitable encryption and the relevant keys can be destroyed correctly. Confirm that the command applies to the exact device and interface, let it complete, and retain the status evidence required by your procedure.

Turn the estimate into a defensible deletion procedure

Start by identifying the actual media rather than guessing from a volume name or enclosure. A virtual disk, storage array, USB bridge, or cloud volume can hide the physical medium and may expose snapshots or replicas that a guest overwrite cannot reach. Choose SSD or HDD only when that classification is known.

Then treat the returned recommendation as an input to your process: check the device manufacturer's supported commands, your threat model, retention obligations, encryption design, and the sanitization policy that governs the data. Verify completion rather than counting attempts, and keep whatever record your audit process requires. Backups, replicas, filesystem snapshots, controller caches, and remote copies need separate lifecycle handling because erasing the local device does not erase them.

Escalate uncertain or high-impact cases to the person responsible for security and compliance.