0

My question is regarding SSD sanitization.

As far as I understand, the generally accepted procedure for making SSD data unrecoverable is this:

  1. Full disk encryption
  2. Standard Format
  3. Second full disk encryption
  4. Second Format

My question is, would doing a secure erase prior to encryption affect the recoverability of the data:

  1. Manufacturers Secure Erase
  2. Full-Disk Encryption (Bitlocker)
  3. Manufacturers Secure Erase
  4. Second Full-Disk Encryption (Bitlocker)
  5. Manufacturers Secure Erase

If the answer is that the data is more likely to be recovered, can you please explain why encrypting the drive first would make a difference.

Thank you

8
  • It’s unnecessary to encrypt a SSD twice. Encrypt the data (must be full disk encryption) then simply delete the partitions. Without the password to decrypt the data it won’t be possible to restore the data.
    – Ramhound
    Dec 23, 2020 at 4:30
  • @Ramhound that was my initial thought as well - but on reflection - unless FDE has been used since day 1 - this would be flawed because of overpartitioning and dead cells. By doing more then 1 encryption pass you are likely getting to more of the hidden overprovisioned data.
    – davidgo
    Dec 23, 2020 at 4:35
  • @davidgo you are saying that multiple encryption passes would be more effective, correct? Dec 23, 2020 at 17:08
  • @quickquestion Potentially yes - but with major caveats - 1. Multiple passes doesn't guarantee anything and 2. It puts strain on the disk. Really though unless you do full disk encryption from day 1 you should look at physical destruction if your data is highly valuable - otherwise 1 pass of random data is sufficient.
    – davidgo
    Dec 23, 2020 at 18:20
  • @davidgo last question, thank you very much for the help so far. If the drive was encrypted from day 1 and I had the key, if I followed the first erasure protocol encrypt/format/encrypt/format, could I recover any data? Or would the first key be useless after the protocol is executed? Thank you Dec 23, 2020 at 18:36

1 Answer 1

2

(I don't know that the stated procedure is a generally accepted one, and its likely overkill, but not a bad solution. Unfortunately its not a panacea)

There are a few things to understand about SSD storage and erasure -

  1. If you want to do it right, you need to ensure that encryption happens before the disk is used. Encrypting the data after the disk is in use can leave residual traces of it (see below)

  2. A Manufacturers secure erase is a good idea if its available to you, and can somewhat achieve (1) above if you did not use bitlocker or equivalent from the get-go. The problem is that some Manufacturers encryption and secure erase functions are/were known broken. Still, its worth doing if you can.

  3. There is a non-obvious problems with erasing data from SSD's - SSD's present have a significant hidden area of space which can't be accessed directly through the SATA interface - and in some cases could once be accessed but can't without special tools. (This has to do with overprovisioning because cells eventually die. Wear leveling distributes data "behind the scenes" - thus making drives last longer but also allowing data to hide outside the control of the OS. Multiple full disk overwrites can help reach these remapped areas, but its entirely likely that some cells are marked bad but can still be read/partially read if someone wants the data badly enough.

I put to you that if you are trying to protect data worth less then tens of thousands of dollars to an adversary, a manufacturers erase and/or writing a single pass of random data to the disk is more then adequate. If the data is worth a lot of money you should follow up a the above processes with physical secure destruction. (ie at some point someone could come and cut you a check/cheque for enough money you would sell them the data - the cost of recovering data should balanced against them doing this)

3
  • I don’t trust the secure erase function of these devices. There are many reports that feature is basically broken. Cannot seem to find those reports at this moment. I do know that secure erase doesn’t touch the wear leveling area of the disks, and just writing random data, is a waste of perfectly fine cells. Encryption from the start really is the only solution. Most people don’t have the tools necessary to restore data from those wear leveling cells since it’s left to the firmware to handle
    – Ramhound
    Dec 23, 2020 at 4:50
  • @ramhound I agree that secure erase is questionable - but in the implementations I'm aware of it works similarly to LUKS/Bitlocker - ie the disk is encrypted and the key stored somewhere. When you do a secure erase it replaces the encryption key so all cells - even those unaccessible because of wear levelling are -in effect - scrambled.
    – davidgo
    Dec 23, 2020 at 4:54
  • I just realized I was actually thinking of the device encryption built-into devices not Secure Erase.
    – Ramhound
    Dec 23, 2020 at 5:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .