I need to encrypt an SSD drive and I have opted to use dm-crypt
. This is not something I do on a regular basis.
So far I have successfully cleared the memory cells of my SSD with the ATA secure erase command. I have also filled the entire disk with random data using:
dd if=/dev/urandom of=/dev/sdx bs=4096 status=progress
.
My question is in regards to the final step, which is encrypting the devices (my partitions) with the cryptsetup
utility.
Since I’ve already filled my entire disk with random data, will I need to refill my partitions with random data after creating and encrypting them? In other words, will the random data that I generated with dd
still reside inside of the encrypted partitions that i create?
Best Answer
This command will overwrite the entire drive with random data. That random data will stay there until you write other data, or secure-erase, or TRIM.
Normally this is the case.
However, it's not always obvious when TRIM happens. For example,
mkfs
ormkswap/swapon
silently imply TRIM and you have to use additional parameters to disable it. I do not know if partitioners picked up the same idea and TRIM newly created partitions. If using LVM instead of partitions, note thatlvremove
/lvresize
/ etc. does imply TRIM if you haveissue_discards = 1
in yourlvm.conf
. Other storage layers such asmdadm
support TRIM as a simple pass-through operation.cryptsetup open
by default does not allow TRIM unless you specify--allow-discards
, however some distributions might choose to change those defaults.After all, it's very unusual to random-wipe SSD for encryption. The only use case I can think of is getting rid of old data while not trusting the hardware to do this for free when you TRIM or secure-erase.
Even with encryption, it's normal for free space to be visible on SSD. Most people will want to use TRIM weekly/monthly to avoid possible performance degradation in the long term, so distributions might follow that trend and use
allow-discards
on encrypted devices by default.Once trimmed, your overwriting with random data was for naught.
But as long as you are in control, and disable TRIM in everything you do, the random data will stay.