I have been using an SSD with no system-level encryption. If I now switch to full disk encryption using LUKS + LVM, do I effectively wipe the old data, or is it still hanging around until overwritten?
No, the data is not wiped. It is trivial to make all data "disappear" by TRIMing the whole drive, but all the data are still on the flash chips and are only slowly wiped in a background process.
Fortunately, most SSDs are already encrypted in hardware precisely to avoid costly full disk wipes. Many consumer SSD brands provide utilities to reset the key which effectively wipes the disk. You can probably also send direct ATA commands using something like hdparm.
You need to enable TRIM on LUKS and possibly LVM and then trim the SSD with
fstrim. This will zero unused blocks of your SSD.
To enable TRIM on LVM, edit /etc/lvm/lvm.conf and enable
To enable TRIM on LUKS, edit /etc/crypttab. On some distros like Fedora, it's enough to add
discard to options. On some other distros it's
Ideally, before placing LUKS, you could use ATA Secure Erase https://ata.wiki.kernel.org/index.php/ATA_Secure_Erase
It completely depends on your implementation (we don't even know which OS/tools/filesystem you are using).
During encryption configuration, you may see "erase options". For example:
- OSX disk utility lets you select how many times to overwrite existing data under "Security Options"
- gnome disk utility also has "erase options"
- Windows BitLocker has a "encrypt entire drive" which sounds like it overwrites previous data first
With that said, overwriting was somewhat effective in the HDD days. SSDs have been notoriously resistant to sanitizing. You can find a much more in-depth discussion in Can wiped SSD data be recovered?