4

Does erasing and then encrypting a previously unencrypted HDD secure all data previously written to it?

Improve this question
2
  • 2
    Overwriting the sectors once is usually enough to make recovering the previous data very very very hard (if not impossible). SSDs have a wear leveling mechanism that you need to be aware of: it's like the disk had some extra sectors to clear and you need to avoid TRIM. Encryption has nothing to do with this. Commented Jun 8 at 12:50
  • Are you asking about HDD specifically, or SDD? The answer to that will affect potential answers (As you can see) Commented Jun 9 at 13:01

3 Answers 3

Reset to default
3

It depends on whether or not the erase method leaves data that might be recovered. For concrete recommendations, see Table A-5 of NIST Special Publication 800-88 (Guidelines for Media Sanitization) which lists – among others – the following methods for magnetic (S-)ATA drives:

  • Using the ATA OVERWRITE EXT command to overwrite the entire disk with a specific pattern (like all zeroes).
  • Alternatively, using the SECURE ERASE UNIT command.
  • If the disk is self-encrypting, it's enough to change all keys.

Note that if the external HDD is connected via USB, you shouldn't issue the above ATA commands. Either attach the disk to an internal S-ATA cable or use software to overwrite the disk (e.g., the dd tool).

In the case of SSDs, erasing data is a bit more tricky, as Margaret Bloom already pointed out (see Table A-8 in the NIST document for details). However, as you specifically asked about HDDs, just make sure the disk tool uses any of the methods listed above.

Improve this answer
0

If you buy a new 1TB SSD drive in the store, you actually get a drive with 1TB of logical blocks, and for example 1.1TB of physical blocks. Due to the way SSD drives work, the extra 100GB of physical blocks make your drive faster. (You will have more or less extra physical blocks. More is more expensive but faster).

You can easily fill the 1TB of logical blocks with zeroes, or with random data. The extra physical blocks will contain data that was previously used. There is no good reason to allow access to this data. I have no idea how to read it, so your data would be safe from me. If I designed SSD drives there would be no way to access that data, so it would be safe from anyone. And since the extra physical blocks are of no legitimate use, your drive might have instructions to explicitly erase them.

So doing nothing clever, your data is safe from me. Possibly from a reasonably sophisticated hacker. Possibly depending on the drive design it’s safe from very sophisticated hackers. And if the drive supports completely erasing physical data and you use that feature it is safe from anyone.

“Erasing then encrypting” doesnt specifically help. It just writes the logical drive twice, reducing the chances that a physical block contains any useful information.

Improve this answer
1
  • 1
    The OP specifically asked about HDDs, not SSDs. Commented Jun 9 at 9:05
0

Absolutely all data? No.

A used HDD is likely to have one or more "Bad Sectors" which the firmware considers too unreliable to use any more. A few VERY specialised tools will still be able to read some or all of those sectors (depending on how badly damaged they are) which MAY reveal usable data, depending on how the disc was written.

For most use cases, this involves so much effort, and such low odds that it can be ignored.

Improve this answer

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.