Assuming the hard drive is encrypted with BitLocker and it is on a laptop with a TPM module. Then the hard drive is formatted and Windows is completely reinstalled. Is it still possible to recover the previously encrypted data now?
-
2Does this answer your question? Selling HDD - wiping– mentallurgOct 4, 2021 at 16:39
-
I think these are different questions and the linked answer doesn't apply directly (full disclosure: I wrote the linked answer). Mia seems to be selling the entire laptop (including the TPM and the hard drive), not just the hard drive (as in the linked question).– hftOct 4, 2021 at 17:07
2 Answers
The data on a BitLocker encrypted drive is not encrypted with the key in the TPM. Instead, the key in the TPM unlocks the volume header, which contains the bulk encryption key. This is a common construction in full-disk encryption (FDE) schemes. If the BitLocker volume header has been erased from the disk, the key used to encrypt/decrypt the bulk data has been destroyed, so the data is completely unrecoverable.
Whether or not the volume header was wiped from the disk depends on the type of disk and what type of format you did.
If the disk is a modern SSD (i.e. not one of the first generations from the early 2000s) it will support Secure Erase and TRIM, which Windows will have used. You can usually tell because the format operation takes only a few seconds instead of tens of minutes or a few hours. The data written to the flash on the SSD is transparently encrypted during normal operation. The erase command simply throws away the key and mapping table, then generates a new key. Since the old key is gone, the data on the disk is rendered unreadable. This is helpful since SSDs are prone to write wear, so overwriting all the flash cells reduces their operating lifetime. In addition, SSDs use overprovisioning (i.e. more flash cells than the advertised capacity) to help aid with wear-levelling, so if the OS tries to just overwrite the logical blocks it can see, it won't actually clear the data on those extra cells. In short: if it's an SSD, the format will have wiped the volume header.
If the disk is a mechanical hard disk, a quick format may not have removed the volume header. A quick format on a hard disk works by just writing a new filesystem header and table to the start of the disk, without actually erasing any data. The first sector(s) of the disk will likely have been overwritten by the new filesystem, but (if I recall correctly) the BitLocker volume header is also backup up in another sector later in the disk, in case the primary header becomes corrupted. As such, a quick format might not do it. In this case you'd want to have performed a "normal" format, which writes zeroes to the disk. This is sufficient - you don't need any fancy multi-pass stuff. That said, if you enabled BitLocker again after re-installing, it almost certainly overwrote the original volume headers.
Something you may wish to do is clear the TPM. This removes all keys that have been stored in the TPM and resets it to a fresh state. If you have enabled BitLocker on the new OS install, clearing the TPM will render the data unreadable and you'll have to do another re-install.
The NSA says "Physical destruction is the only secure way to ensure your data is gone."
US-CERT says that "Overwriting is effective on all computing devices. It puts random data in place of your information, which cannot be retrieved because it has been obliterated."
Which is correct? It depends on your threat model and how valuable the data on these drives is. Are you keeping Top Secret nuclear design plans on these drives? You should probably physically destroy the drive. Was it just your personal laptop? I'd feel comfortable wiping it a few times with DBAN before reselling it.
-
2It depends on the value calculation: If (Damage if data is recovered by the new owner) * (Likelihood that data is recovered) greater than (Re-sell value of the hard drive) then destroy the HDD, else sell it.– user163495Oct 4, 2021 at 20:25
-
2In other words, if all you had on your HDD was a backup of your music collection, then there is no harm in selling it. You could even be a bro and keep it there. If your HDD contained possibly top secret documents of your federal government, then destroy it through any means necessary.– user163495Oct 4, 2021 at 20:26
-
4The NSA page you linked is for EPs used by the NSA and its contractors, not private businesses or regular people. Destruction of storage devices is wasteful. Please do not promote the use of multi-pass wipe methods; they are pointless at best and insecure at worst. NIST SP 800-88 r1 is an excellent standard on media sanitisation that explains exactly why this is a problem. I have also written about this extensively. Oct 5, 2021 at 4:18
-
3If they're a government contractor storing classified secrets they aren't asking questions on StackExchange. They'd be restricted to evaluated products. Multi-pass methods are insecure because they assume that the media they're sanitising exposes the full underlying set of storage to the logical block device, and that a sequential write over the disk actually performs a sequential write to each physical storage cell. This isn't the case on SSDs or USB flash drives due to wear-levelling space and remapping. Oct 6, 2021 at 13:52
-
2The downvote is not an insult - please don't take it personally. I didn't click that button to annoy or disparage you, I clicked it because following your answer could be dangerous for a user. The use of a typical multi-pass wipe at the logical level would fail to properly erase data on an SSD or flash drive. Your summary of the linked NSA page is far too simplistic and jumps to the most extreme option with no nuance or reasonable justification, which has negative security impacts (as described in the answer I linked). Oct 6, 2021 at 14:01