Do I lose security by merely encrypting a partition of a drive instead of doing full drive encryption (FDE)?
My concern arises because using an encrypted file container for a volume can be problematic. For example, a VeraCrypt encrypted file container volume on an unencrypted drive with an NTFS file system will, at a minimum, leak meta data. Citations: this VeraCrypt documentation page and Palancar's first response in this discussion.
So, I am asking if encrypted partitions are similarly vulnerable to information leakage, or have some other kind of vulnerability that FDE would stop.
And, would your answer change if the drive is an SSD? An SSD will surely have wear leveling, so data is actually written throughout the drive's physical sectors (see: https://superuser.com/questions/635145/possibility-of-data-loss-due-to-encryption-on-a-flash-disk).
My current thinking
My guess for a non-SSD is that you lose little security by merely encrypting a partition instead of FDE. That is because the sole exposed data is the partion layout (e.g. MBR or GPT), and that data is mostly static and mostly useless for an attacker.
SSD's wear leveling, which will write data from any partition all over the physical blocks of the SSD, complicates matters.
I think that if you encrypt your SSD's partition once (i.e. never subsequently change its password/keyfiles(s)) then all subsequent data written to that partition should be OK; it does not matter what physical sectors get written to because the data is encrypted. On the other had, if you re-encrypt that partition (e.g. with a stronger password), that is definitely a danger: the old weakly encryped data may still exist for a long time in various physical sectors.
The first paragraph of this VeraCrypt documentation page (https://veracrypt.codeplex.com/wikipage?title=Wear-Leveling) discusses wear leveling drives, and warns:
we recommend that VeraCrypt volumes are not created/stored on devices (or in file systems) that utilize a wear-leveling mechanism (and that VeraCrypt is not used to encrypt any portions of such devices or filesystems)
tho its second paragraph backs off and notes
If you...use in-place encryption on a drive that utilizes wear-leveling mechanisms, make sure the partition/drive does not contain any sensitive data before you fully encrypt it...after the partition/drive has been fully encrypted, any new data that will be saved to it will be reliably encrypted on the fly
I found a brief followup in this reddit discussion (https://www.reddit.com/r/VeraCrypt/comments/58dznl/is_vc_safe_at_all_for_solid_state_drives/).
An indirect endorsement that encrypted partitions should be OK, even on wear leveling drives like USB flas drives, is the existence of this TAILS tutorial on creating them (https://tails.boum.org/doc/encryption_and_privacy/encrypted_volumes/index.en.html). If the uber paranoid TAILS people are OK with encrypted partitions, that says something.
I also note this earlier superuser question (https://superuser.com/questions/635145/possibility-of-data-loss-due-to-encryption-on-a-flash-disk) which is concerned with data loss on encrypted partitions on wear leveling drives, but that is distinct from my concern with data leakage.
If you want to know more details about my particular situation, and why I am now considering encrypting only a partition instead of the full drive, read on...
My main drive for my operating system, programs, and critical data is a Samsung 840 EVO. That drive is FDE using Samsung's built in FDE hardware. So, my BIOS prompts me to enter a password for that drive upon every boot.
(Aside: FDE on Samsung SSDs has many issues, for example, WP/arstechnica.com/civis/viewtopic.php?f=11&t=1243475 or WP/superuser.com/questions/692172/how-do-i-encrypt-a-samsung-evo-840-ssd?rq=1. You guys trust Samsung'S FDE?)
I used to have another internal drive, a 2 TB WD mechanical drive, that was for a wider range of data (e.g. backups, media, lots of other stuff). I full disk encrypted that drive with TrueCrypt.
Unfortunately, that 2 TB WD mechanical drive needed to be replaced, and I now have a Sandisk Ultra 3D 2 TB SSD.
Why I now want to encrypt a partition
I initially used VeraCrypt to FDE that Sandisk SSD, because that SSD does not support encryption (unlike most Samsung SSDs), but I ran into 2 distinct problems.
The first problem, which always plagues a FDE drive if the encryption is done with 3rd party software like VeraCrypt, is that other software on your machine thinks that the drive is a raw unformatted drive. Consequently, you run the danger of some program or user accidentally deciding to format it, which will be a disaster. Citation:
If you choose to use the unpartitioned drive, various tools that expect to see a partitioned drive may report the entire drive as unallocated space, which increases the liklihood of disasterous errors. Also, using a partition gives you more flexibility for the future should you later desire to subdivide that space.
I endured this danger without incident for years with my FDE WD mechanical drive, but I wish I never faced it in the first place.
The second problem that I face with my Sandisk SSD is that I really want to use its monitoring program, SanDisk SSD Dashboard (e.g. for firmware updates, to monitor drive health, etc). Unfortunately, that program does not play well with a drive fully encrypted by 3rd party software like VeraCrypt. I face the same issue described by Toby Byron in https://sourceforge.net/p/veracrypt/discussion/general/thread/3c5d0f52/.
The suggestion in that last link is to try encrypting just a partition on that drive, instead of the whole drive.
Indeed, I may create 2 partitions on that drive, the first big one being encrypted with Veracrypt followed by a tiny one that is unencrypted. I got that idea from this link:
I recommend using your favorite partition tool to re-partition the drive as follows. This avoids Windows and MacOS prompts offering to “format” and “initialize” the drive every time you insert it.
If you add a minuscule partition at the end of the drive, with a filesystem, all Operating Systems recognize (exFat/FAT32) you will not get prompted.
That should probably cure both problems.
But I do not want to do this if I am jeopardizing my security.