This project has moved. For the latest updates, please go here.

Full drive encryption / wiping, when?

Topics: Technical Issues
Mar 28, 2016 at 9:41 AM
Okay, so if you have a Windows installation, for instance, then you decide to encrypt it with full drive encryption. You get wipe options, but they make no sense to me; will it not wipe the installation or does it take in to account the data that exists and is still wanted?

How do you wipe all the unused data areas so that there is no data leak risk situation.
Mar 28, 2016 at 3:05 PM
From the FAQ:
Do I have to "wipe" free space and/or files on a VeraCrypt volume?

Remark: to "wipe" = to securely erase; to overwrite sensitive data in order to render them unrecoverable.

If you believe that an adversary will be able to decrypt the volume (for example that he will make you reveal the password), then the answer is yes. Otherwise, it is not necessary, because the volume is entirely encrypted.
.
Using specialized equipment, it is possible to read the before/after state of the drive's data for a given byte/bit due to the gap between the bits. The wipe option will write random data N times you specify before writing the encrypted data back to the drive. Also, the free space is written with random data N times that you specify during the wipe. With modern HDDs, one-pass wipe will prevent recovery.

http://www.howtogeek.com/115573/htg-explains-why-you-only-have-to-wipe-a-disk-once-to-erase-it/
Mar 28, 2016 at 4:04 PM
Yes, I get it for a non system partition new container (volume), but how exactly will the wipe work if I choose anything other than non-wipe when encrypting a system drive that has data that I want to preserve?
Mar 28, 2016 at 6:26 PM
Edited Mar 28, 2016 at 7:29 PM
Per the FAQ that I quoted in my original reply, you do not have to use wipe since the entire volume, including free space will be encrypted. Use the wipe option if you feel someone will attempt to determine the bit change state when you originally encrypted the volume.

PS: VeraCrypt terminology of the word volume means system encryption, non-system encryption or file containers.
Mar 28, 2016 at 8:20 PM
Okay, thank you. It wasn't clear to me before.

Perhaps the following can make it clearer in the FAQ:

System encryption ...
  • encrypts EVERY block of the entire system partition [DO NOT CHOOSE ANY WIPE METHOD as it is NOT REQUIRED],
  • whatever data was there before is encrypted regardless of whether it is an "in-use" block or a "free" block of the file system.
  • due to how each block is encrypted, zero or null characters will appear differently throughout the volume.
That is, empty [or free] data blocks are not skipped during the system partition encryption process, therefore there is nothing available to detect file system structures for analysis whilst the partition is not unlocked. The entire disk, apart from the headers, appears completely random irregardless of what was there before the start of the system partition encryption process.


Is that clearer to everyone? Also, when choosing to do system/partition encryption, I believe that VC should NOT allow the user to choose ANY wipe method as it is an invalid option.
Mar 28, 2016 at 9:01 PM
Edited Mar 28, 2016 at 9:02 PM
affinity wrote:
Is that clearer to everyone? Also, when choosing to do system/partition encryption, I believe that VC should NOT allow the user to choose ANY wipe method as it is an invalid option.
.
Incorrect. The wipe option is valid. You are confusing encrypting the volume with the wipe feature.

Per the FAQ that I quoted:
Remark: to "wipe" = to securely erase; to overwrite sensitive data in order to render them unrecoverable.
.
It may be possible to determine the before encrypted data of the drive that has been encrypted. The wipe feature prevents that type of attack.

https://en.wikipedia.org/wiki/Magnetic_force_microscope#Scanning_procedure

SSDs create other security risks when encrypting existing sensitive data already on the SSDs.

https://veracrypt.codeplex.com/wikipage?title=Wear-Leveling
Mar 28, 2016 at 9:07 PM
Yes, but the wipe option isn't valid for the system drive encryption; it is for a non-system drive. If you do wipe the system partition, then it will destroy the installation won't it?
Mar 28, 2016 at 9:27 PM
Edited Mar 28, 2016 at 9:32 PM
The wipe function is valid for both system encryption and non-system encryption except file containers.

A high level explanation of how the wipe works is shown below:
  1. VeraCrypt reads a data block into memory for encrypting.
  2. For wipe modes, VeraCrypt writes random data to the same data block on the target device N times depending on which option the user selected for the wipe mode.
  3. After all wipe operations are completed, VeraCrypt writes the encrypted data block back to the target device.
Mar 28, 2016 at 9:29 PM
Great, that is NOW clear.... perhaps the FAQ could be updated. Thanks.