0

The question

Do I lose security by merely encrypting a partition of a drive instead of doing full drive encryption (FDE)?

My concern arises because using an encrypted file container for a volume can be problematic. For example, a VeraCrypt encrypted file container volume on an unencrypted drive with an NTFS file system will, at a minimum, leak meta data. Citations: this VeraCrypt documentation page and Palancar's first response in this discussion.

So, I am asking if encrypted partitions are similarly vulnerable to information leakage, or have some other kind of vulnerability that FDE would stop.

And, would your answer change if the drive is an SSD? An SSD will surely have wear leveling, so data is actually written throughout the drive's physical sectors (see: WP/superuser.com/questions/635145/possibility-of-data-loss-due-to-encryption-on-a-flash-disk).

(Sorry, all future links will have to look like the last one above, instead of being easy reading hyperlinks, because I lack enough of a reputation on this particular stack exchange site to have more than 2 hyperlinks in a post. Wherever you see "WP", please replace that with "https:/" and you should have the URL.)


My current thinking

My guess for a non-SSD is that you lose little security by merely encrypting a partition instead of FDE. That is because the sole exposed data is the partion layout (e.g. MBR or GPT), and that data is mostly static and mostly useless for an attacker.

SSD's wear leveling, which will write data from any partition all over the physical blocks of the SSD, complicates matters.

I think that if you encrypt your SSD's partition once (i.e. never subsequently change its password/keyfiles(s)) then all subsequent data written to that partition should be OK; it does not matter what physical sectors get written to because the data is encrypted. On the other had, if you re-encrypt that partition (e.g. with a stronger password), that is definitely a danger: the old weakly encryped data may still exist for a long time in various physical sectors.

The first paragraph of this VeraCrypt documentation page (WP/veracrypt.codeplex.com/wikipage?title=Wear-Leveling) discusses wear leveling drives, and warns:

we recommend that VeraCrypt volumes are not created/stored on devices (or in file systems) that utilize a wear-leveling mechanism (and that VeraCrypt is not used to encrypt any portions of such devices or filesystems)

tho its second paragraph backs off and notes

If you...use in-place encryption on a drive that utilizes wear-leveling mechanisms, make sure the partition/drive does not contain any sensitive data before you fully encrypt it...after the partition/drive has been fully encrypted, any new data that will be saved to it will be reliably encrypted on the fly

I found a brief followup in this reddit discussion (WP/www.reddit.com/r/VeraCrypt/comments/58dznl/is_vc_safe_at_all_for_solid_state_drives/).

An indirect endorsement that encrypted partitions should be OK, even on wear leveling drives like USB flas drives, is the existence of this TAILS tutorial on creating them (WP/tails.boum.org/doc/encryption_and_privacy/encrypted_volumes/index.en.html). If the uber paranoid TAILS people are OK with encrypted partitions, that says something.

I also note this earlier superuser question (WP/superuser.com/questions/635145/possibility-of-data-loss-due-to-encryption-on-a-flash-disk) which is concerned with data loss on encrypted partitions on wear leveling drives, but that is distinct from my concern with data leakage.


Background

If you want to know more details about my particular situation, and why I am now considering encrypting only a partition instead of the full drive, read on...

My main drive for my operating system, programs, and critical data is a Samsung 840 EVO. That drive is FDE using Samsung's built in FDE hardware. So, my BIOS prompts me to enter a password for that drive upon every boot.

(Aside: FDE on Samsung SSDs has many issues, for example, WP/arstechnica.com/civis/viewtopic.php?f=11&t=1243475 or WP/superuser.com/questions/692172/how-do-i-encrypt-a-samsung-evo-840-ssd?rq=1. You guys trust Samsung'S FDE?)

I used to have another internal drive, a 2 TB WD mechanical drive, that was for a wider range of data (e.g. backups, media, lots of other stuff). I full disk encrypted that drive with TrueCrypt.

Unfortunately, that 2 TB WD mechanical drive needed to be replaced, and I now have a Sandisk Ultra 3D 2 TB SSD.


Why I now want to encrypt a partition

I initially used VeraCrypt to FDE that Sandisk SSD, because that SSD does not support encryption (unlike most Samsung SSDs), but I ran into 2 distinct problems.

The first problem, which always plagues a FDE drive if the encryption is done with 3rd party software like VeraCrypt, is that other software on your machine thinks that the drive is a raw unformatted drive. Consequently, you run the danger of some program or user accidentally deciding to format it, which will be a disaster. Citation:

If you choose to use the unpartitioned drive, various tools that expect to see a partitioned drive may report the entire drive as unallocated space, which increases the liklihood of disasterous errors. Also, using a partition gives you more flexibility for the future should you later desire to subdivide that space.

(See: WP/www.linuxquestions.org/questions/linux-security-4/encryption-of-the-whole-disk-vs-a-partition-filling-the-whole-disk-4175589667/)

I endured this danger without incident for years with my FDE WD mechanical drive, but I wish I never faced it in the first place.

The second problem that I face with my Sandisk SSD is that I really want to use its monitoring program, SanDisk SSD Dashboard (e.g. for firmware updates, to monitor drive health, etc). Unfortunately, that program does not play well with a drive fully encrypted by 3rd party software like VeraCrypt. I face the same issue described by Toby Byron in WP/sourceforge.net/p/veracrypt/discussion/general/thread/3c5d0f52/.

The suggestion in that last link is to try encrypting just a partition on that drive, instead of the whole drive.

Indeed, I may create 2 partitions on that drive, the first big one being encrypted with Veracrypt followed by a tiny one that is unencrypted. I got that idea from this link:

I recommend using your favorite partition tool to re-partition the drive as follows. This avoids Windows and MacOS prompts offering to “format” and “initialize” the drive every time you insert it.

If you add a minuscule partition at the end of the drive, with a filesystem, all Operating Systems recognize (exFat/FAT32) you will not get prompted.

(See WP/medium.com/@securitystreak/veracrypt-full-disk-drive-encryption-fde-157eacbf0b61)

That should probably cure both problems.

But I do not want to do this if I am jeopardizing my security.

  • 1
    i thought the main advantage of FDE on an OS volume is to protect inadvertent copies of data: caches, spool folders, folder revisions, temp files, etc... – dandavis Oct 8 '17 at 20:35
  • @dandavis My original post noted that my OS drive is a FDE Samsung (see the Background section). So in my case, that particular vulnerability is ruled out. – HaroldFinch Oct 8 '17 at 21:05
1

You did not specify the essential: what are you trying to accomplish ?

Personally, I use the following setup: FDE on main boot drive, big file container on the storage volume (which is one drive made of a multi-HDD RAID).

That way everything in the operating system is safe and there is no danger of accidental formats since you see the data drive normally, with a large file (or more) on it. You can even let some junk/unimportant data reside there.

Also, there is no problem if the boot drive is an SSD. I have used EVOs with TC-FDE and had no problems whatsoever.

I think your upgrade approach may be wrong. Instead of the Sandisk Ultra 3D 2 TB SSD, you could get way more capacity for the same $ at almost the same r/w speed. Get 2 big drives like WD Red Pro and RAID0 them. But again, it really depends on what you want to accomplish. You want to beat the SSD at r/w ? Use 3 drives.

  • What am I trying to accomplish in terms of threat model? I am concerned with protecting myself both against a thief stealing my computer and having full access to my data, as well as, say, over zealous police. I am not looking to protect myself against a national intelligence agency. – HaroldFinch Oct 9 '17 at 12:32
  • When you write "I have used EVOs with TC-FDE" does "TC-FDE" stand for "TrueCrypt Full Drive Encrypted"? – HaroldFinch Oct 9 '17 at 12:33
  • The setup that I am thinking of using is very similar to what you do except for the drive type for the secondary one. I fully realize the tradeoffs between cheap mechanical drives, even when RAIDed, and SSDs. My choice to buy an SSD was thought out. – HaroldFinch Oct 9 '17 at 12:35
  • Yes, True Crypt Full Drive Encryption. No matter if you use an SSD or HDD, the main drive fully encrypted + big encrypted file container on the data drive is very safe and easy to use. – Overmind Oct 10 '17 at 5:54
  • No dispute on the main drive being fully encrypted. But as for using only an encrypted file container on the secondary drive, beware that certain file systems on that secondary drive (not inside the container) like NTFS will at a minimum leak meta data about the container file. See the 2nd paragraph of my original posting. Is NTFS the main offender here, or are other modern sophisticated file systems also problematic? What about relatively simple ones like exFAT? – HaroldFinch Oct 12 '17 at 2:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.