5

Perhaps this question has been asked before, but I couldn't find anything specifically.

I want to fully encrypt my ultrabook's SSD with VeraCrypt, TrueCrypt, or BitLocker (haven't decided yet) and I don't want to format or securely wipe the drive before hand. (I understand that securely wiping SSDs is a thing of its own that I won't go into here).

Since I have an ultrabook with a special form factor SSD I can't really take it out and wipe it on another machine. I suppose I could wipe it with another program before Windows boots but I want to avoid actually wiping my data.

So the simple question is: if I take my machine, which currently has an SSD which is completely unencrypted, and I fully encrypt the drive, is my data still secure? Or does the data still remain on the drive from when it wasn't encrypted?

Sultan of Swing
  • 151
  • 1
  • 3

2 Answers2

4

SSD are almost always manufactured to actually have more memory cells than the advertised capacity. This extra capacity is used to replace failed memory cells so the drive maintains the advertised capacity during the expected lifetime of the drive. This is handled automatically by the drive's controller and normally isn't visible to the operating system.

What this all means is that unless you do an ATA Secure Erase and the ATA Secure Erase is implemented correctly (many SSD drives didn't implement ATA Secure Erase correctly), there's a chance that some remnants of the data may remain on the drive even if you overwrite the entire visible area of the disk with full disk encryption. Specialised forensic tool may thus be able to recover data from this spare capacity.

Whether or not this is a practical concern, really depends on the sensitivity of the data and what you're going to do with the drive afterwards. If you are going to immediately hand over the drive to a competent, malicious adversary, they'd be able to recover data from the spare areas. If you are going to actively use the drive for a while, chances are the write balancer would overwrite any remaining data after a while.

Lie Ryan
  • 31,459
  • 6
  • 70
  • 94
  • If a non-SSD drive has been encrypted, is it sufficient to delete the partitions and format it with mkfs.vfat for example? – Motivated Jan 11 '19 at 06:00
  • @Motivated: Maybe. Non-SSD drives covers a lot of different technologies, so you'll have to be more specific on that. If you have hybrid drives (hard disk with a small flash storage), then some remnants of data may remain on the cache. On HDD, if a sector is marked as bad sector, whatever used to be in that sector may remain there indefinitely. The sector may be corrupted, but it's possible some data may still be readable using specialised tool even if incomplete/unreliable. – Lie Ryan Jan 11 '19 at 06:49
  • However, it's true that HDD is much less prone to sector corruption than SSD, so the problem is much more excarbated. – Lie Ryan Jan 11 '19 at 06:50
  • Do you mean to say there is no reliable way to secure destroy information in a bad sector? – Motivated Jan 11 '19 at 06:53
  • If it's a maybe it suggests that the problem of secure destruction is magnified with the use of flash based storage. – Motivated Jan 11 '19 at 06:56
0

This depends on the encryption implementation. A proper implementation would wipe the unused area of the disk during encryption. If it does not do this, and your encrypted content does not occupy the whole hard drive, some original content might remain unencrypted in the currently unallocated disk areas.

If you really need to be sure there's nothing left unencrypted (i.e. will be held personally responsible for failure), the proper way would be the following:

  • Copy your data somewhere (like a USB stick);
  • Wipe the hard drive with random data;
  • Install the OS back (or install disk encryption software if you don't encrypt the OS itself);
  • Copy the data from the USB stick to the encrypted storage;
  • Wipe the USB stick (and hammer it afterward if you're truly paranoid)
George Y.
  • 3,534
  • 2
  • 11
  • 15