About ssd encryption

[Andrei Matanache]

Hello, i have searched everywhere but couldnt find some exact answers , as it it states everywhere the ssd needs to be new in order to securly encrypt it and prevent data leaks due to the nature of how ssds work, my questions are :
1. If you have sensitve data on it before fully encrypting it with vc , how it is possible to recover that data, even if is moved by the wear mechanism when the drive is fully encrypted 100%, isnt vc encrypting the free space too?
2. Lets say the ssd is filled completly with sensitive data and i encrypt that ssd entirely with vc, in a real life situation how much data could someone actually recover from it(approximately) ? 5%?,10%?
thank you

[Mounir IDRASSI]

Hi,

1. I guess you are talking about encrypting the full SSD disk and not a partition. In this case, VeraCrypt encrypts free space only if the user doesn't choose "None" a wipe method for In-Place encryption or doesn't check "Quick Format" in the encryption wizard for new volume. And even in this case, sensitive data could be leaked because most SSDs come with hidden extra storage capacity that is not declared and which is used to perform wear-leveling: so, existing sensitive data will be copied to this hidden space and it can be extracted by forensic engineers. Such SSD weakness is well known (e.g. https://www.elcomsoft.com/PR/SSD_Evidence_Crypto.pdf) and that's why it is strongly advised to use empty SSD drives.
2. The size of the hidden SSD storage used by wear-leveling is different depending on the model used but it can be sometimes 50% of the declared size of the SSD disk. In this case, it is possible to recover 50% of the existing sensitive data. Often, the hidden storage is around 10% so I would say that at minimum 10% of sensitive data can be recovered forensically.

[Andrei Matanache]

thank you for your answer but i can tell from my experience that his wear leveling is not such a big deal as it looks like, yes it may have some leaks but from my experience it never had, let me share my experience on this, i had some sensitive information on my ssd,i used a forensic tool that analyizes the drive as a hole and not only partitions so that should include any hidden path too, as i tought it found my sensitive deleted data,i have run eraser to wipe the free space with 3 passes, as eraser was working i could see the info dissapearing from my forensic tool, i re-runed the search to be sure and not even 1 word from my sensisive data couldnt be recovered after the wipe,(i have made this tests over 5 times with different data and always had flawless results)i have a ocz vertex 4, maybe on other ssds i wouldnt have the same results but the best way to check for the leaks is to actually use a forensic tool and see with your own eyes what it can be found so probably vera crypt wiping when encrypting has same results as eraser, bottom line wiping your ssd should erase all or almost all of the data and in my case even recovering a partial data wouldnt be enough since it will corrupt my sensitive data.

I have 1 more question for you about the ecryption benchmark, is not clear in my mind, does it show the speed of the cpu that can keep up with the drive speed? If my logic is correct, if in the benchmark i see a speed of over 500mb/s on a 3 encryption layer and my ssd have 300-400 mb/s r/rw, does that mean i wouldnt feel any performance lose?
So more exactly if i can copy now something to my uncrypted ssd with 300-400mb/s and vera crypt benchmark shows me over 500 mb on any type of encryption will i be able to get the same performances as being uncrypted? thank you

[YosemitieSam]

Ive looked into a bunch of posts about this but I am not sure I am grasping it completely so I appologize for the redundency...
On Fri. I am recieving a new Thinkpad with a SSD. I assume it will come with a Windows disk and I will have to go through the motions of installing a brand new OS.
So would the propper way to go about this be to install the OS and then the absolute first thing would be to install VC and then encrypt the entire SSD?
Any comments, assistance, or advice here would be greatly appreciated and thank in advance if anyone has any thoughts.
I am not sure Im understanding how or if I have to encypt the drive before installing the OS?