Arch Linux

daankata

Member

Registered: 2017-05-21

Posts: 47

Wiping SSD before dm-crypt

Hello!
I am using Thinkpad and Samsung EVO 850. I want to create a dm-crypt encrypted partition on my SSD. On the Wiki it says I should do wiping of the SSD first, but I have read that it isn't recommended to do wiping of SSD's. Instead I have used Lenovo's "Drive Erase Utility for the Resetting the Cryptographic Key and the Erasing the Solid State Drive - ThinkPad" (http://support.lenovo.com/bg/en/downloads/ds019026). So after I "reseted" the SSD to it's factory condition with this tool, should I wipe it with zero bytes or random bytes or there isn't any point afterwards?

****On the Wiki it says I should do a SSD memory cell cleaning, but my drive is "frozen" and there isn't a way to make it "not frozen". So I used Lenovo's utility to erase it.

Ropid

Member

Registered: 2015-03-09

Posts: 1,069

Re: Wiping SSD before dm-crypt

Samsung basically promises that it will have wiped everything in the actual chips where data is saved. You have to trust that.

Writing zeroes or random data to the drive is a bit pointless in the sense that the drive that the PC sees is not the real drive. The PC sees a fake drive and everything to that fake drive is translated by the SSD controller into a different internal structure. You don't know what the SSD controller actually does with what you write to it. In the real drive, there's more chips than are needed to save the data of the fake drive that is presented to the PC. You can't make sure to have wiped that extra space from the outside, only the SSD controller can wipe everything (that's what you asked it to do with Lenovo's tool).

There's also this here:

blkdiscard /dev/sda

That's sending TRIM commands to the whole (fake) drive. After this, the SSD controller should decide to wipe the chips in the drive, though you can't know for sure when exactly it will do that.

daankata

Member

Registered: 2017-05-21

Posts: 47

Re: Wiping SSD before dm-crypt

Thank you for the response!
So did the Lenovo's tool worked? Is there any need of doing anything else?
Is there any difference between the Lenovo's tool and SSD memory cell cleaning with hdparm? When I bought the SSD I had to see are there any firmware upgrades for the drive, so I installed quickly Windows 10, insalled Samsung Magician, and then uninstalled Windows. Then I "erased" the drive with Lenovo's tool. Is there anything else I should do before installing Arch on it?
And in the Lenovo's tool there was 2 options. Erasing the drive and resseting the Cryptographic key. What does "resseting the Cryptographic key" means? And when I did the erasing with the tool, it took about 2seconds to completly erase it, but the tools said it should take about 2minutes?

Thank you!

Last edited by daankata (2017-06-22 05:54:02)

Tétrapyle

Member

Registered: 2014-01-03

Posts: 61

Re: Wiping SSD before dm-crypt

Hi. I'm no expert but here's what I understand.

I suppose that all data in your drive is already encrypted by some dedicated hardware (please you should check that by Samsung's). You could choose to be prompted for a password before boot: in that case, this password would be used to decrypt the internal cryptographic key. If you don't do so, your data is encrypted as well but you don't know it because the drive itself does encrypt/decrypt everything on-the-fly.

So, if you use dm-crypt, your data will be encrypted twice. I'm not sure it's worth. Well, with dm-crypt, you have more control.

By telling the drive to reset the internal cryptographic key, your prevent anyone, even you, from finding out a meaning in the drive's data.