When installing Linux, most distros offer or force full disk encryption with LUKS. Some distros, such as Debian, by default wipe data before conducting the encryption. Is this effective on SSDs, and if not, what are the alternatives?
It may not be fully effective due to the disk levelling that takes place. This distributes writes across the whole address space of the disk to reduce wear.
However, there is a standard process called "ATA Secure Erase". I also think that SSD's with NVMe interfaces have a command to securely wipe as well. Microsoft have a tool for their Surface Pro devices that use this. I don't know whether those are good enough for really sensitive data though.
But, you should note that the US DoD do not accept any methods for secure erasure other than physical destruction of the drive I think. Though Blancco offer a product that suggests otherwise so I may be mistaken. If the SSD contains sensitive information, you should look for a certified product. Check the DoD and NIST web sites for the latest information.
There are two scenarios when you wipe the disk:
- Get rid of old data. Here its important to consider wear leveling.
- Wipe a fresh disk to hide how much space is used
The second part is why installers offer a wipe even for new disks. The advantage depends on your threat model, usually it has little advantage but does little damage (except for a long waiting time). When a fresh disk is filled with random data, it hides how much disk space is used even with a SSD.
Keep in mind, that the spare blocks still contain zeros, so somebody could notice that you did not use the disk very much. But they won't see if you used 50% or 80% of the disk, they only see that you did not yet write more than 100% (after which the first spare block should be used).