I am giving away a shitty 128GB SSD, which was used with LUKS 2 for most of it’s lifetime. As far as I know, it’s good practice to secure-erase it, but I’m too lazy to reinstall the OS on it (I already did it once). Is it really needed?
You must log in or # to comment.
cat /dev/urandom > /dev/your-diskshould do it in your case. And in 99% of cases.Everything that was luks encrypted is unrecoverable once you overwrite the luks header. Trying to guess the master key takes longer than the lifetime of the universe.
Just make sure that is gone and you are good. If you deleted all partitions and installed another (unencrypted) OS on the drive there is a very good chance the luks headers are gone for good.
Secure erase just drops the ssd controllers table of where logical blocks are in the physical memory and trims the disk. Which is good and you should do.
That means a person would have to address the memory directly with flying leads or a bed of nails or something. Or have special software that makes the controller tell them what’s on each physical block and then put that data together into a bunch of files.
If that worries you, do dd if=/dev/urandom of=/dev/<disk> before you secure erase.
Then everything on the drive will be random static before the secure erase drops the block table and trims, so even if someone uses magic power to read the block contents directly they just get to see static.
That has the benefit of speeding up the drive by resetting read fatigue at the expense of one layer of writes which is always worth it.
Useless use of dd. cat or cp are better suited in this case.
Ah, fun fact, dd won’t actually cover all the blocks since SSDs have reserve blocks and IIRC they do rotate which ones are in use vs which are not, to even out wear
@JamesBoeing737MAX Overwrite your LUKS-Header and you’re good. After this just format in in ext4 and all is gone.
You don’t have to install anything on it, just connect it to a running PC and do a dd if=/dev/zero, that should be enough to get rid of any remnants directly accessible.
Unless you are part of a drug distribution organization, in that case just use a hammer, a microwave and a blowtorch.Not really great on SSDs, though. It’ll likely make them slower because now the controller thinks 100% of the memory is allocated. And some small percentage of the data will still be around, because they do overprovisioning.
Shouldn’t matter for OP, though. If they set up LUKS properly, there’s no way to decrypt the data.
But I mean secure wipe isn’t hard… It’s copy-pasting 2 more commands from the Arch wiki, compared to the dd command.
some small percentage of the data will still be around, because they do overprovisioning.
That’s why I wrote “directly accessible data”. You are certainly right that safely erasing all data on SSDs is hard to impossible to achieve, but so is the read access to it.
That means if we disregard the drug distribution or similar scenarios, should be enough for the normal person.But I mean secure wipe isn’t hard… It’s copy-pasting 2 more commands from the Arch wiki, compared to the dd command.
But it will take significantly longer (typically using /dev/random and multiple passes) without noticably increasing security for SSDs.
It will have also have the same possible write-speed-penalty issue as the zero-overwriting, but this won’t be OPs problem any more because he is selling the SSD.
You said that:
I am giving away a shitty 128GB SSD, which was used with LUKS 2 for most of it’s lifetime.
This leads me to assume that it is not now? Is this the case? If it still has LUK2 on it, you can run cryptsetup-erase on the luks2 container. This won’t wipe any unencrypted data, though.
One needs to be careful and avoid block level wipes wherever possible for SSD as this will wear it out quicker. Obviously, if you have sensitive data unencrypted, you may have to. Shred is your friend, here. It works on entire devices as well as individual files. The individual files option is preferable if you the sensitive data is at known locations.
Does shred work on journaling file systems?
I’m assuming when you “reinstalled the OS” you just repartitioned the drive and installed normally without encryption for the person? If that’s the case then all your old data is encrypted and will be unrecoverable without your password and the LUKS header.
If however you reinstalled the OS within the already made LUKS partition and are giving them the password (for some reason) then yeah, you wanna secure erase it.
If you were selling on eBay or something I would still recommend a secure erase (they’re really quick on SSDs)
Most likely not. Did you have anything on it that you would even be concerned about someone else finding? Is anyone even likely to be curious enough to look?
Is anyone even likely to be curious enough to look?
Well, can only speak for me, but first thing I do.
I mean, you can never know which administrative scandal you might uncover…
I stop the moment I find private stuff, though.
Had that three or four times already, the only case I was considering doing something about it was a completely unsecured and unerased phone still containing a bunch of business emails that clearly were sensitive or even confidential stuff.
I just told the seller how he screwed up here, instead of making a bigger fuss out of it.Sure, but are you pulling out forensic analysis tools, or just checking what didn’t even get erased in the first place?
