An overwrite works on a hard disk because there is a fixed relationship between the address your software writes to and the physical place the bits land. Write to sector nine hundred and the platter position that held the old sector nine hundred is now magnetised differently. Solid state storage does not work like that, and the difference is not a detail.
What the controller does instead
Flash cells wear out after a finite number of erase cycles, so an SSD controller spreads writes across the whole array to keep any one block from dying early. When your software writes to logical sector nine hundred, the controller writes to whichever physical page is convenient and updates a translation table. The page that held the previous contents is marked stale and left alone until garbage collection gets to it.
So an overwrite of the whole logical address space does not necessarily touch every physical cell. Drives also hold over-provisioned capacity — often seven to twenty-eight per cent of the total — that is never addressable from the host at all, and any data that was written there before remains.
What works
- ATA Secure Erase or NVMe Sanitize — the drive erases itself at the controller level, including the over-provisioned area the host cannot reach.
- Cryptographic erase on a self-encrypting drive: the controller discards the media encryption key, which renders every cell unreadable in one operation regardless of where the data physically sits.
- Verification afterwards, because a drive can accept the command and fail to complete it — a frozen drive is the common case, and it reports success on the write side either way.
- Physical destruction where the drive refuses the command or fails verification, which is the honest fallback rather than running an overwrite and calling it done.
On flash, the question is not how many times you wrote. It is whether the controller did what you asked.
This is why the software chooses the method from the media type rather than applying whatever the operator picked last time, and why a drive that will not verify is reported as failed and routed to destruction instead of being passed as complete.
