1

I'm going to encrypt external hard drive. HDD is wiped three times using the command shred --verbose --random-source=/dev/urandom --iterations=3 /dev/sdc but after it I was accidentally executed command dd if=/dev/sdb of=/dev/sdc bs=4M status=progress and I've stopped it. /dev/sdb is an encrypted hard drive. Should I worry about possible leakage of metadata during forensic analysis?

Improve this question

2 Answers 2

Reset to default
1

You should elaborate on what you mean by "leakage of metadata during forensic analysis". Whether or not there is a risk of leaking confidential information, it depends on what you had on /dev/sdb. If you had sensitive, unencrypted data there, then writing it to the beginning of /dev/sdc would result in that data being retrievable unless otherwise overwritten. You should just initiate an erasure once more and limit it to only overwrite however much data you were shown by the results of status=progress.

Improve this answer
1

Someone performing forensics on your drive would see that /dev/sdb and /dev/sdc started with the same data. This would indicate to them that the contents of /dev/sdb are almost certainly not random noise, but are in fact encrypted disk contents.

This would give them more confidence in spending time on attempting to recover the contents of that encrypted drive. Additionally, because when I think "forensics" I think "court", this would most likely eliminate any plausible deniability on your part if you were brought before a court and asked to divulge the encryption key - that is, you wouldn't have the opportunity to say "that's just an unitialized drive, there's nothing to decrypt."

Improve this answer

You must log in to answer this question.