2

According to a post on the Veracrypt forum, it is recommended that new hard drives are fully formatted. It does not appear to make a distinction between internal and/or external hard drives or USB drives.

Assuming this is the recommended approach, what are the benefits and/or risks of a full format versus a quick format?

For example, does a fully formatted hard drive reduce information leakage? If yes, how?

The scenario is that no sensitive data has been stored on the drive before.

Are there scenarios in which a quick format is acceptable? If yes, what would these be?

For example, is it acceptable to quick format a hard drive that has been previously encrypted? If yes, why? If no, why?

| improve this question | |
  • Is this format done in addition to a single-pass overwrite from VeraCrypt? – forest Dec 22 '18 at 9:38
  • @forest - There wasn't the option to specify the number of overwrites when using the Veracrypt GUI. I can only assume that it would be a single-pass overwrite. I am assuming that the format is the overwrite – Motivated Dec 22 '18 at 23:06
2

According to the documentation

Quick format is much faster but may be less secure because until the whole volume has been filled with files, it may be possible to tell how much data it contains (if the space was not filled with random data beforehand)

Apparently the authors of the document wanted you to know that knowledge of the size of the data would be detectable, even without decrypting the contents. That is a small side channel leak, I suppose. This could allow a criminal team to go through all of your hard drives and figure out which ones have the most data on them, for example.

| improve this answer | |
  • 1
    Actually, it could also be used to leak certain metadata like the size and layouts of new files you create. It's similar to the issue caused by TRIM on disks using FDE, though not as serious. – forest Dec 22 '18 at 10:43
  • @forest - Why does the size of the files matter? Secondly, when you say layouts do you mean sectors and/or blocks of data? If yes, why would this matter if files are created within a secure encrypted volume? – Motivated Dec 22 '18 at 23:07
  • @John Wu - Assuming that a threat actor is able to determine the size of the data, is the assumption that it is represents the sensitivity of the data? I imagine no. Also why would a quick format matter if no data previously existed on the drive? – Motivated Dec 22 '18 at 23:09
  • I believe what they are saying is that a hacker could tell the difference between a drive full of all zeroes and a drives full of encrypted data. By using a full format, you fill the drive full of random numbers, which a hacker could not distinguish from encrypted data. A quick format just leaves zeroes everywhere. – John Wu Dec 22 '18 at 23:45
  • @Motivated It depends on your threat model. There have been people convicted exclusively based on metadata like size. It reveals the filesystem layout. – forest Dec 23 '18 at 2:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.