If I encrypt a whole partition with AES, is it secure to just overwrite the first few bytes of the partition in order to make it completly unreadable even if an attacker knows the passphrase to access it?
Some FDE schemes, such as BitLocker, store their metadata (plain-text information about how to decrypt the volume, plus things like the encrypted master key and how it is protected) in multiple places, scattered across the volume. This is done for redundancy against minor disk corruption causing 100% data loss. You would need to wipe all of the metadata to prevent somebody who would otherwise be able to decrypt the master key from decrypting the volume.
Even aside from that, though, wiping the first few bytes won't do anything at all unless you did something like use
openssl to encrypt the whole volume directly, instead of using an actual full-volume encryption tool. The reason is that the first few (hundreds of) bytes of the volume is metadata about stuff like what file system is on the volume (or what full-volume encryption scheme was used and where to find its metadata). The first few bytes of this is almost always either irrelevant, predictable, or both. Wiping it won't save you anything.
Finally, even if you did something like the "
openssl the whole block device" idea, nulling "the first few bytes" doesn't add nearly enough entropy to prevent somebody from just brute-forcing the encryption, assuming they know the key. Let's say you wiped three bytes. Three bytes is 24 bits, or roughly 16 million possible values. Assuming the attacker has a way to test any given possible value for those three bytes (to see if it's what they were before being wiped) in less than 1000 AES decryption operations (realistically it'd probably be much less). Given modern hardware-accelerated AES speeds, your typical desktop CPU could find the original value of those 3 wiped bytes in under a minute.
It depends on the FDE scheme.
In the case where you've just encrypted the disk directly (e.g. using a command such as
openssl aes-256-cbc with
dd), perhaps with a backup disk, this will not prevent data from being recovered. Deleting or corrupting parts of the disk will not prevent other parts of the disk from being read if the attacker knows the key. This is because the decryption process for most block cipher modes relies only on the adjacent block of ciphertext being correct.
In the case where you're using a competent FDE scheme, you can most probably destroy all data on the disk by wiping the first few hundred (or thousand) sectors. This is because FDE tends to use a randomly generated master key to encrypt the data, which is then in turn encrypted with your password. This encrypted master key record is placed somewhere on the disk, usually at the very start or very end of the partition or volume. By wiping this record all data is then lost, assuming that the attacker has not imaged the disk ahead of time. If they have a copy of the encrypted header and then later learn your password, they can still recover your files from the remaining encrypted data.