title: "DoD-Standard File Deletion: What It Actually Does on an SSD" date: "2025-08-29" updated: "2026-09-09" excerpt: "Seven-pass 'military-grade' deletion was built for spinning platters. On an SSD, most of those passes never touch your data. VaultSort identifies exactly what it is writing to and delivers the strongest guarantee that storage can give — which on a modern Mac is total." coverImage: "/images/blog/dod-ssd-deletion.png" categories: ["security", "file-deletion", "privacy"]
DoD-Standard File Deletion: What It Actually Does on an SSD
Open almost any secure-deletion tool and you will be offered passes. Three passes. Seven. Thirty-five, if it is feeling dramatic. The number is usually attached to a standard — DoD 5220.22-M, most often — and the implication is that more passes means more security.
On a hard disk, that is broadly true. On an SSD, the passes are mostly writing to somewhere the data isn't.
This matters because almost nothing ships with a spinning disk any more. If you are using a tool that treats your MacBook the way it would treat a 2005 desktop, you are paying for write cycles and getting a progress bar.
Why the passes miss
An SSD does not let software choose where a byte lands. Between your file and the physical NAND sits the Flash Translation Layer, and it is the FTL — not your operating system, and certainly not your deletion tool — that decides which physical cell receives a write.
Two design features guarantee your overwrite lands somewhere new:
Wear-levelling. Flash cells wear out after a finite number of writes, so the controller deliberately spreads writes across the whole device. Writing to the same logical block ten times will land on ten different physical pages. The original page holding your data is simply marked stale — its contents intact, waiting to be garbage collected whenever the controller feels like it.
Over-provisioning. Between 7% and 28% of an SSD's capacity is hidden from you entirely. It exists so the controller has room to work. Software cannot address it, so software cannot overwrite it, and stale copies of your file may be sitting in it.
So the seventh pass of a "military-grade" wipe is not reinforcing the first. It is writing new data to new cells while the old cells sit untouched, and spending a measurable slice of your drive's lifespan doing it.
The distinction the standards actually draw
NIST SP 800-88r1 — the document that superseded the DoD standard people still quote — splits sanitization into Clear and Purge.
Clear is a logical overwrite. On magnetic media it is sufficient. On flash it is explicitly not, for the reasons above.
Purge means the data is gone at a level software cannot undo. For flash there are exactly two ways to get there:
- Cryptographic erase — the data was stored encrypted, and the key is destroyed. Whatever residue remains in remapped or over-provisioned cells is ciphertext without a key.
- Device sanitize — the ATA
SECURITY ERASEor NVMeSanitizecommand, run by the drive's own firmware across all NAND including the parts you cannot see.
Neither is available for a single file on a mounted volume. Any tool claiming to Purge one file on your running system is describing something the hardware does not offer.
What this means for your Mac, specifically
Here is the part most tools never tell you, and it is good news.
Every Apple Silicon and T2 Mac encrypts its internal SSD at rest, unconditionally. Not as a FileVault feature — as a property of the hardware. FileVault adds a layer by wrapping the volume key with your password, but the data on those internal drives is already ciphertext before FileVault is switched on.
Which means the strongest available guarantee is already yours. A single overwrite that breaks the live logical mapping, followed by an unlink, is cryptographically sufficient: any residue the controller retains is encrypted, and the key that would make it readable is gone.
That is not a compromise. It is a stronger outcome than a thirty-five pass wipe on an unencrypted drive, and it takes a fraction of a second. Additional passes on that hardware buy exactly nothing and cost write endurance you paid for.
What VaultSort does
This is the part we built properly. VaultSort identifies the storage before it writes a single byte, and delivers the strongest guarantee that medium is capable of. Not a fixed ritual applied to everything — the right operation, chosen per target:
| Storage | What VaultSort does | The real guarantee |
|---|---|---|
| Magnetic HDD | Single-pass overwrite, then unlink | Overwriting reliably destroys the data |
| Encrypted at rest (Apple Silicon, T2, FileVault) | Overwrite the live mapping, then unlink | Cryptographically sufficient — residue is ciphertext with no key |
| Unencrypted flash (older or external SSDs) | Cryptographic-random overwrite, plus targeted free-space work that drives the controller to reclaim stale blocks | Everything software can reach — and a clear account of what it did |
That last row is where VaultSort pulls ahead. On a plaintext external SSD, the cells holding old copies are not addressable by any application — that is a property of the hardware, and it binds every tool equally. The difference is what happens next. VaultSort runs the operations that genuinely move the controller toward reclaiming those blocks, and then reports precisely what it accomplished. A tool that prints "securely deleted" on the same drive has not done more work. It has just declined to tell you what it did.
There is a way to make it absolute, and it is worth knowing. Turn on FileVault before you put anything on the drive — BitLocker on Windows — and its contents are ciphertext from the first byte. Every deletion on it afterwards is cryptographic, because there is no plaintext left anywhere for a controller to hold onto. That encryption comes from the operating system and costs nothing; VaultSort's part is recognising it and switching to the stronger path automatically, which is the difference between a tool that knows where it is writing and one that does not.
For individual files, VaultSort closes the gap itself. A file encrypted with VaultSort — or kept in the Vault, where everything is encrypted individually and never sits unlocked on disk — exists as ciphertext the whole time it is stored, bound to your YubiKey or Touch ID. Whatever the controller retained was never readable to begin with.
Three ways deletion silently fails — all of which VaultSort catches
Passes are the wrong thing to compete on. Correctness is where deletion actually goes wrong, and it goes wrong quietly: the tool reports success, the progress bar fills, and the data is still on disk. VaultSort checks for all three before it writes.
Hard links. If a file has more than one directory entry, overwriting its contents corrupts what every other link sees — and the blocks are not freed until the last link is removed. VaultSort detects the extra links and tells you, instead of reporting a clean success over data that is still live.
APFS clones and shared extents. macOS deduplicates aggressively. Overwrite a cloned file in place and copy-on-write allocates fresh blocks for your zeros while the shared original sits untouched — a wipe that achieves nothing at all. VaultSort spots the shared extents and surfaces them.
Symlinks. A link pointing at a directory must be removed as a link. Follow it and you
recursively destroy the target's contents — data the user never selected and cannot get
back. VaultSort resolves with lstat semantics and never follows a symlink.
None of these are exotic. Hard links and APFS clones are everywhere on a working Mac, which is exactly why a deletion tool that ignores them will eventually report a success it did not earn.
Passes measure effort. Ask about outcome.
A tool that leads with how many times it overwrites is telling you how hard it worked, not what it achieved. Three questions separate the two:
- Does it know what kind of storage it is writing to?
- Does it perform the operation that actually works on that storage?
- Does it tell you what it accomplished?
VaultSort answers yes to all three, and the classification driving it is a pure function with exhaustive tests, so the behaviour is pinned down rather than left to whatever the drive happens to report. On the Mac you are most likely reading this on, it delivers the strongest sanitization the hardware can provide — and it does it in a fraction of a second, without spending a thousand write cycles to look busy.
"Secure deletion on SSD — nowhere have I found a software that uses such an advanced deletion protocol — that was the reason I bought it. […] I am so happy."
— VaultSort customer, September 2026
VaultSort handles secure deletion, file encryption bound to a hardware key, and disk-level erase on macOS and Windows. Try it free — the encryption and secure-delete features are a one-time purchase, with no subscription.
