0

I was just catching up on best practices for securely erasing data from a Mac. At one point I remember reading:

For SSD drives it is no longer recommended to fully write ones/zeroes/random bits on the disk. Use encryption instead.

Now, I am thinking of two starting points:

  1. Your disk was not encrypted
  2. Your disk was encrypted, but you are not sure if the new owner had the key

In both cases giving the laptop to the new owner would not be secure, deleting everything beforehand is a good step (and in practice strong enough for me personally) but I am not sure if that is sufficient.

Now my question:

Suppose you have one of these two starting points, THEN you erase the drive normally and format it to be encrypted, are you then secure?

The 'threat' I was worried about, is that the new owner would be able to format it back to the old way (e.g. without encryption, or with a specific encryption key) and it might be possible to use classical data retrieval techniques.

Perhaps it does not work like this (or it depends on the hardware), but I am hoping to understand if encryption of a disk means its previous contents can also not be retrieved anymore.

3

1 Answer 1

2

If you store data on an SSD and then encrypt it, some unencrypted residue may still be present in the flash chips (it's not accessible through the normal storage protocol - SATA/SAS/NVMe/USB - though). The more the SSD is written to after encryption and the more completely it is filled, the smaller that residue gets.

The exact amount depends on the flash controller's wear-leveling algorithm and the (spare) capacity of the SSD. Most often, you don't know much about that and can only guess.

So no, you're not entirely secure encrypting an SSD after sensitive data has been written to it without encryption.

Usually, you encrypt a drive right after installation and only then do you write sensitive data to it.

Some drives have a secure erase feature that allows you to kill all data at a low level.

And of course, if you want to erase a disk (HDD or SSD), all blocks need to be overwritten (multiple times for SSD as outlined above, one time for HDD is sufficient). Deleting files, quick formating, or deleting a partition all don't really remove data from the drive and can largely be undone.

12
  • 1
    There is another potential problem: When you activate encryption usually only used sectors are encrypted (unless configured otherwise, not sure about encryption on Mac). This means the sectors not being overwritten can be more than just the spare sectors currently not mapped to a logical sector.
    – Robert
    Mar 25 at 16:55
  • @Robert Good point - whether the whole drive is (pre)encrypted or just the used space depends on the actual implementation (block level vs. filesystem level encryption may make a difference).
    – Zac67
    Mar 25 at 17:10
  • Even a block level encryption can initially just encrypt the used disk space. Most file-systems have a free/used bit mask or something similar so it is easy to limit encryption to the used blocks.
    – Robert
    Mar 25 at 17:14
  • A filesystem-agnostic block-level encryption needs to encrypt the whole disk, but there are many different approaches.
    – Zac67
    Mar 26 at 12:06
  • It's not possible to access the "spare" part of the SSD disk using normal methods, so a single overwrite is enough for more intents and purposes. Mar 27 at 10:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.