The Dual-Technology Challenge
Hybrid drives, also known as SSHDs (Solid-State Hybrid Drives), combine traditional magnetic hard drive technology with a smaller amount of NAND flash storage in a single device. The flash component acts as a cache, storing frequently accessed data for faster retrieval while the magnetic platters provide bulk capacity. While hybrid drives have become less common as SSD prices have dropped, they remain in service in many laptops and desktops deployed during the 2013-2018 period.
The combination of two storage technologies in a single drive means that data destruction must address both components, and the methods that work for each are different.
How SSHDs Store Data
An SSHD uses a built-in controller to automatically identify frequently accessed data and cache it on the NAND flash portion of the drive. The controller manages this process transparently, without input from the operating system or user. From the host system’s perspective, the SSHD appears as a single standard hard drive.
The flash cache is typically between 8GB and 32GB, a small fraction of the drive’s total capacity. However, the data cached in this flash component is by definition the most frequently accessed data on the drive, which often includes operating system files, application executables, and frequently used user files. This means the flash cache may contain a concentrated collection of the most sensitive data on the drive.
Why Standard HDD Wiping Is Not Sufficient
A standard overwrite of an SSHD targets the drive’s logical address space, which maps primarily to the magnetic platters. The flash cache component operates behind the drive’s controller, and a logical-level overwrite may not fully address the flash storage for the same reasons that standard overwrites are insufficient for SSDs: the controller manages the flash independently, with its own wear levelling and data placement logic.
Data remnants could survive in the flash cache even after the magnetic platters have been thoroughly overwritten. While the amount of data in the flash cache is relatively small, it may include sensitive files that were cached for performance reasons.
Effective SSHD Sanitisation Methods
ATA Secure Erase: The most reliable software-based approach is to use the drive’s firmware-level ATA Secure Erase command. This command instructs the drive’s controller to sanitise both the magnetic and flash components of the drive. Most SSHD manufacturers implement Secure Erase to address the flash cache as well as the platters. Under NIST 800-88, a properly implemented ATA Secure Erase on an SSHD is classified at the Purge level.
Enhanced Secure Erase: If the drive supports Enhanced Secure Erase, this command may use a vendor-specific pattern and provides additional assurance that the flash cache has been fully sanitised. Check the drive’s specifications or query the drive using a compatible wiping tool to determine which Secure Erase variants are supported.
Degaussing: Degaussing is effective for the magnetic platter component of an SSHD but does not affect the NAND flash cache. Since the flash cache uses electrical charges rather than magnetic domains to store data, a magnetic field has no impact on it. Degaussing an SSHD leaves the flash cache data intact, which is a significant gap.
If degaussing is the chosen method, it must be followed by physical destruction of the drive to address the flash component. Degaussing alone is not sufficient for SSHDs.
Physical destruction: Shredding or crushing an SSHD destroys both the magnetic platters and the flash components simultaneously. This is the most definitive approach and provides the highest assurance. Physical destruction should reduce the drive to particles small enough that neither platter fragments nor flash chips can be recovered and read.
Identifying SSHDs in Your Fleet
SSHDs are not always easily identified by their external appearance, as they use the same 2.5-inch or 3.5-inch form factors as standard HDDs. The drive’s model number and specifications must be checked to determine whether it contains a flash cache component.
Common SSHD models include Seagate’s FireCuda and Laptop SSHD series, Western Digital’s Black SSHD series, and Toshiba’s MQ02ABD series. If you are unsure whether a drive is an SSHD, check the model number against the manufacturer’s specifications.
Including a drive identification step in your disposal process, where each drive’s type (HDD, SSD, SSHD) is confirmed before sanitisation, ensures that the correct method is applied. Treating an SSHD as a standard HDD during wiping may leave the flash cache unsanitised.
The Declining Prevalence of SSHDs
SSHDs were most popular during a period when SSDs were expensive and small-capacity. As SSD prices dropped and capacities increased, the market for hybrid drives diminished. Most new computers now use pure SSDs, and few manufacturers continue to produce SSHDs.
However, SSHDs remain in service in older equipment that is now reaching end of life. The 5-8 year lifecycle of business IT equipment means that laptops and desktops deployed during the SSHD era are now prime candidates for decommissioning. IT disposal teams are likely to encounter SSHDs in their workflow for several more years.
SSHDs may be a niche product category, but the data they hold is no less important. Proper identification and appropriate sanitisation ensure that these dual-technology drives do not become a gap in your data destruction coverage.