0

If a rotational SAS drive (non-SSD) is encrypted after it has been in use for some time e.g. several years, is there a danger of a data leak? For example, if the drive is encrypted and subsequently formatted e.g. dd, can data be recovered?

Update

The suggested post by @vidarlo although helpful does not answer the question. @Rory McCune mentions that ATA secure erase support for SAS is unknown.

It also mentions that destroying the encryption is an option. The answers however do not cover the following.

  • If SAS drive was previously unencrypted and is subsequently encrypted, is there a data remanence a risk?
  • If not, is dd sufficient?
5
  • @vidarlo - Unfortunately no. The topic discusses wiping & the destruction of a hard drive but doesn't touch the steps of encrypting a drive after use followed by a wipe.
    – Motivated
    Commented Sep 11, 2021 at 21:18
  • 1
    It discusses how you can stop data recovery, which is what you are asking as well. This answer mentions Secure Erase which would generally be considered secure.
    – vidarlo
    Commented Sep 11, 2021 at 21:31
  • @vidarlo - Thanks. Although it discusses Secure Erase, it doesn't cover alternatives if the drive is already encrypted. For example, should secure erase still be used if the drive is already encrypted? Why is dd not sufficient?
    – Motivated
    Commented Sep 11, 2021 at 21:49
  • 1
    I would suggest you read the question and all the answers. They mention reasons why either of those may not be sufficient.
    – vidarlo
    Commented Sep 11, 2021 at 21:55
  • @vidarlo - I did read through answers. For example @Rory McCune cites that the effectiveness of secure erase for SAS is unknown. Further down the various posts, he mentions that dd is sufficient. Secondly, the answer from @gowenfawr notes that destroying the key a viable option. The answers (unless I have missed something obvious and I'm happy to be corrected), none of them touch on the scenario that there is a drive that is unencrypted, which is then encrypted and subsequently wiped via dd.
    – Motivated
    Commented Sep 11, 2021 at 22:34

1 Answer 1

1

First, there are two main ways to encrypt a hard drive:

  • Fast encryption, which leaves the free space untouched until overwritten from normal disk use. This free space can contain old data left unencrypted.
  • Full encryption, that can either uses a first pass to fill the unused space with random noise, or it can encrypt the unused space.

Since you want to erase data after the encryption, I think you are thinking about the second method. However, please note that encrypting before wiping a disk is equivalent* to overwriting it with random (from /dev/urandom) data before overwriting it with zeros, but it is less efficient because encrypting will perform the extra useless step of reading the data before overwriting it.

Then, would that be enough to be sure that no data remains? That depends on your threat model. That is, what are the resources at the disposable of those likely to get your disk? If they can only read data using the standard drive interface, then one pass of a full overwrite is enough. If, however, they can spend a lot of resource on specialized and expensive equipment to attempt to recover traces left from old data, then please refer to this question.


* Because properly encrypted data cannot be distinguished from random data without knowing the encryption key.

6
  • Thanks. Have I understood you correctly that there is no additional value in encrypting the drive if the purpose is to dispose of it? If not i.e. if the drive (non-SSD) continues to be used, encrypting the drive (full disk encryption) will prevent any data remanence?
    – Motivated
    Commented Sep 12, 2021 at 3:50
  • @Motivated - As A. Hersean said, no additional value in encrypting before wiping. Your last sentence tosses a whole other discussion into the mix. An SSD has its own issues and there is no comparison here. Edit - I see you removed the references to SSD. Commented Sep 12, 2021 at 3:54
  • @user10216038 - I updated it to be clear that the question is for a non-SSD drive. Having said that, does it make a difference i.e. if the drive (non-SSD) continues to be used, encrypting the drive (full disk encryption) will prevent any data remanence?
    – Motivated
    Commented Sep 12, 2021 at 7:29
  • @Motivated - As A. Hersean said, it depends upon style, fast vs full. It may also depend upon the exact encryption tool used, but the main stream tools work this way. There are technical gotcha possibilities involving unreachable portions of the drive, but generally they would only have significant content if you went out of your way to create and use such unreachable disk portions in which case you would certainly know. Commented Sep 12, 2021 at 15:38
  • @user10216038, the tool of choice at the moment is veracrypt and the method is full disk encryption i.e. all partitions/volumes. I'm assuming you are referring to HPA and DCO?
    – Motivated
    Commented Sep 12, 2021 at 18:53

Not the answer you're looking for? Browse other questions tagged .