Can I ask a Bitlocker question?

[Todd Godchaux]

As I understand it, an SSD is built with wear leveling and the actual space is double of the advertised available space to the OS. If an SSD has been in use for an unknown period of time and is later Bitlocked, does all of the drive become protected, even the dormant bits that can't be seen and are "resting"?

[#2]

It would appear that you have a choice:

• Encrypt used disk space only
• Encrypt entire drive (slower) - for drives already in use

[#3]

Right, but is the "entire contents" of the drive just what the application sees, or every bit/cell on the SSD that's controlled by the firmware. Maybe this is a deeper question for the hardware vendor.

[#4]

My understanding is that the full disk encryption would be for the entire volume.

[#5]

Just what the is shown to the OS by the SSD, but in the moment a new, never used before cell is activated it will be encrypted, so no need to encrypt 'everything' upfront, exept for a very small performance impact

[#6]

That's along the lines of what I was thinking. My worry though is a machine that has already been in use, then full-drive encrypted... is there a chance that a file deleted in the shell (marked for deletion by the OS) but later goes dormant by the firmware for wear leveling?

Meaning the data is still there, but not seen by the OS, but could be activated at a later time. A bit "tin-foil-hat" I know, but if there's valuable corporate assets (HR, Credit cards, PII) on the drive, it's a real concern. For instance on a tablet that needs warranty repair by a 3rd party, we can't remove the drive so we must rely on encryption alone.

[#7 · Accepted solution]

Wear levelling algorithms are proprietary per drive manufacturer. An attacker would have to work around the firmware to even check out spare blocks, and then hope to understand how data is scattered to piece something meaningful together. Attacking data that way is likely quite difficult, but theoretically possible. The risk to any data present prior to encryption would go down over time after encryption as the drive is used, and spare blocks get reused for wear levelling but of course you’ll never know for sure if everything is encrypted. 

Your best bet is to always to encrypt from the start, regardless of the encryption solution which all share the same issue, before any sensitive data is on the drive, so you can achive the assurance you're looking for.