7

Say I have a storage device that I want to use with my Windows 10 machine. I have some sensitive data on the drive and I would like to wipe the drive before using it. Normally I just use dd to fill the drive with /dev/zero or /dev/urandom from a Linux machine. I know that's not the most secure, especially for flash storage, but it should be enough in my case.

But if I am planning to encrypt it with BitLocker in Windows anyway, and select the "encrypt entire drive" option instead of "encrypt used space only", is it necessary to wipe it with dd beforehand? Or does BitLocker essentially secure-wipe it when it encrypts the whole drive?

Does the same answer apply to other full drive encryption methods such as LUKS?

Improve this question

1 Answer 1

Reset to default
8

Yes, encrypt entire drive with Bitlocker should be between as secure as doing a dd with /dev/zero and /dev/urandom. (using /dev/urandom is theoretically a little more secure then /dev/zero, but not a practical concern here).

Like with dd, the parts of the disk that are overprovisioned won't be wiped/encrypted initially - so there may be fragments that can be read unless/until those are overwritten.

The important part is the "encrypt entire drive" which will encrypt everything.

Doing a standard luksformat /dev/devname will not encrypt the entire drive. (I just tried this). You would want to "zero out" the empty space on the mounted drive after formatting it.

For that matter, if you did not encrypt the entire partition it would likely be better to dd /dev/zero to a file on the encrypted drive and then delete that file (even under bitlocker) - so that the underlying disk is filled with randomish data, rather then straight zero's.

Improve this answer
2
  • I'd go for dd /dev/random, just out of paranoia. It's unlikely that assuming the blank areas are full of zeroes will let someone crack the encryption key (not with modern encryption algorithms, at least), but it's happened before.
    – wizzwizz4
    Commented Mar 24 at 18:41
  • 1
    @wizzwizz4: On the systems where there is a difference between /dev/random and /dev/urandom, /dev/random will not be appropriate for that purpose, given it would block whenever it decided entropy had fallen too low, and randomizing hundreds of GB or TB of data would involve you sitting there jiggling the mouse for hours just to let it finish.
    – ShadowRanger
    Commented Mar 24 at 21:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .