Is an encrypted partition significantly less secure than full drive encryption?

Question

The question

Do I lose security by merely encrypting a partition of a drive instead of doing full drive encryption (FDE)?

My concern arises because using an encrypted file container for a volume can be problematic. For example, a VeraCrypt encrypted file container volume on an unencrypted drive with an NTFS file system will, at a minimum, leak meta data. Citations: this VeraCrypt documentation page and Palancar's first response in this discussion.

So, I am asking if encrypted partitions are similarly vulnerable to information leakage, or have some other kind of vulnerability that FDE would stop.

And, would your answer change if the drive is an SSD? An SSD will surely have wear leveling, so data is actually written throughout the drive's physical sectors (see: https://superuser.com/questions/635145/possibility-of-data-loss-due-to-encryption-on-a-flash-disk).

---

My current thinking

My guess for a non-SSD is that you lose little security by merely encrypting a partition instead of FDE. That is because the sole exposed data is the partion layout (e.g. MBR or GPT), and that data is mostly static and mostly useless for an attacker.

SSD's wear leveling, which will write data from any partition all over the physical blocks of the SSD, complicates matters.

I think that if you encrypt your SSD's partition once (i.e. never subsequently change its password/keyfiles(s)) then all subsequent data written to that partition should be OK; it does not matter what physical sectors get written to because the data is encrypted. On the other had, if you re-encrypt that partition (e.g. with a stronger password), that is definitely a danger: the old weakly encryped data may still exist for a long time in various physical sectors.

The first paragraph of this VeraCrypt documentation page (https://veracrypt.codeplex.com/wikipage?title=Wear-Leveling) discusses wear leveling drives, and warns:

we recommend that VeraCrypt volumes are not created/stored on devices (or in file systems) that utilize a wear-leveling mechanism (and that VeraCrypt is not used to encrypt any portions of such devices or filesystems)

tho its second paragraph backs off and notes

If you...use in-place encryption on a drive that utilizes wear-leveling mechanisms, make sure the partition/drive does not contain any sensitive data before you fully encrypt it...after the partition/drive has been fully encrypted, any new data that will be saved to it will be reliably encrypted on the fly

I found a brief followup in this reddit discussion (https://www.reddit.com/r/VeraCrypt/comments/58dznl/is_vc_safe_at_all_for_solid_state_drives/).

An indirect endorsement that encrypted partitions should be OK, even on wear leveling drives like USB flas drives, is the existence of this TAILS tutorial on creating them (https://tails.boum.org/doc/encryption_and_privacy/encrypted_volumes/index.en.html). If the uber paranoid TAILS people are OK with encrypted partitions, that says something.

I also note this earlier superuser question (https://superuser.com/questions/635145/possibility-of-data-loss-due-to-encryption-on-a-flash-disk) which is concerned with data loss on encrypted partitions on wear leveling drives, but that is distinct from my concern with data leakage.

---

Background

If you want to know more details about my particular situation, and why I am now considering encrypting only a partition instead of the full drive, read on...

My main drive for my operating system, programs, and critical data is a Samsung 840 EVO. That drive is FDE using Samsung's built in FDE hardware. So, my BIOS prompts me to enter a password for that drive upon every boot.

(Aside: FDE on Samsung SSDs has many issues, for example, WP/arstechnica.com/civis/viewtopic.php?f=11&t=1243475 or WP/superuser.com/questions/692172/how-do-i-encrypt-a-samsung-evo-840-ssd?rq=1. You guys trust Samsung'S FDE?)

I used to have another internal drive, a 2 TB WD mechanical drive, that was for a wider range of data (e.g. backups, media, lots of other stuff). I full disk encrypted that drive with TrueCrypt.

Unfortunately, that 2 TB WD mechanical drive needed to be replaced, and I now have a Sandisk Ultra 3D 2 TB SSD.

---

Why I now want to encrypt a partition

I initially used VeraCrypt to FDE that Sandisk SSD, because that SSD does not support encryption (unlike most Samsung SSDs), but I ran into 2 distinct problems.

The first problem, which always plagues a FDE drive if the encryption is done with 3rd party software like VeraCrypt, is that other software on your machine thinks that the drive is a raw unformatted drive. Consequently, you run the danger of some program or user accidentally deciding to format it, which will be a disaster. Citation:

If you choose to use the unpartitioned drive, various tools that expect to see a partitioned drive may report the entire drive as unallocated space, which increases the liklihood of disasterous errors. Also, using a partition gives you more flexibility for the future should you later desire to subdivide that space.

(See: https://www.linuxquestions.org/questions/linux-security-4/encryption-of-the-whole-disk-vs-a-partition-filling-the-whole-disk-4175589667/)

I endured this danger without incident for years with my FDE WD mechanical drive, but I wish I never faced it in the first place.

The second problem that I face with my Sandisk SSD is that I really want to use its monitoring program, SanDisk SSD Dashboard (e.g. for firmware updates, to monitor drive health, etc). Unfortunately, that program does not play well with a drive fully encrypted by 3rd party software like VeraCrypt. I face the same issue described by Toby Byron in https://sourceforge.net/p/veracrypt/discussion/general/thread/3c5d0f52/.

The suggestion in that last link is to try encrypting just a partition on that drive, instead of the whole drive.

Indeed, I may create 2 partitions on that drive, the first big one being encrypted with Veracrypt followed by a tiny one that is unencrypted. I got that idea from this link:

I recommend using your favorite partition tool to re-partition the drive as follows. This avoids Windows and MacOS prompts offering to “format” and “initialize” the drive every time you insert it.

If you add a minuscule partition at the end of the drive, with a filesystem, all Operating Systems recognize (exFat/FAT32) you will not get prompted.

(See https://medium.com/@securitystreak/veracrypt-full-disk-drive-encryption-fde-157eacbf0b61)

That should probably cure both problems.

But I do not want to do this if I am jeopardizing my security.

Answer 1

You did not specify the essential: what are you trying to accomplish ?

Personally, I use the following setup: FDE on main boot drive, big file container on the storage volume (which is one drive made of a multi-HDD RAID).

That way everything in the operating system is safe and there is no danger of accidental formats since you see the data drive normally, with a large file (or more) on it. You can even let some junk/unimportant data reside there.

Also, there is no problem if the boot drive is an SSD. I have used EVOs with TC-FDE and had no problems whatsoever.

I think your upgrade approach may be wrong. Instead of the Sandisk Ultra 3D 2 TB SSD, you could get way more capacity for the same $ at almost the same r/w speed. Get 2 big drives like WD Red Pro and RAID0 them. But again, it really depends on what you want to accomplish. You want to beat the SSD at r/w ? Use 3 drives.