[dm-crypt] Encrypted partitions with sectors to zero?

Arno Wagner arno at wagner.name
Wed Oct 23 20:04:21 CEST 2013


On Wed, Oct 23, 2013 at 04:24:56PM +0200, Thomas Martin wrote:
> Hi everyone.
> 
> I was trying to verify that discard (TRIM) was disabled on my system
> (new fresh install on a SSD) when I found some weird things.
> 
> Indeed it seems I have many sectors to zero; example:
> root at o9020:~# hdparm --read-sector 54003000 /dev/sda
> /dev/sda:
> reading sector 54003000: succeeded
> 0000 0000 0000 0000 0000 0000 0000 0000
> 0000 0000 0000 0000 0000 0000 0000 0000
> 0000 0000 0000 0000 0000 0000 0000 0000
> ...
> 0000 0000 0000 0000 0000 0000 0000 0000
> 
> 
> According to me, only my /boot partition should have zero (as this is
> the only one unencrypted):

Encryption does not overwrite your data. If you want that
with LUKS or plain dm-crypt, ypu need to do the overwrite
yyourself. Some tools, like TrueCrypt, offer you to do
this optionally during installation.

See also FAQ item 5.3.


> root at o9020:~# parted /dev/sda "unit s print"
> Model: ATA LITEONIT LCS-128 (scsi)
> Disk /dev/sda: 250069680s
> Sector size (logical/physical): 512B/512B
> Partition Table: msdos
> Number  Start     End         Size        Type      File system  Flags
>  1      2048s     1953791s    1951744s    primary   ext4         boot
>  2      1955838s  250068991s  248113154s  extended
>  5      1955840s  250068991s  248113152s  logical
> 
> root at o9020:~# lsblk /dev/sda -f
> NAME                              FSTYPE      LABEL MOUNTPOINT
> sda
> ├─sda1                            ext4              /boot
> ├─sda2
> └─sda5                            crypto_LUKS
>   └─sda5_crypt (dm-0)             LVM2_member
>     ├─VolumeGroup1-root (dm-1)    ext4              /
>     ├─VolumeGroup1-swap (dm-2)    swap              [SWAP]
>     ├─VolumeGroup1-usr (dm-3)     ext4              /usr
>     ├─VolumeGroup1-tmp (dm-4)     ext4              /tmp
>     ├─VolumeGroup1-opt (dm-5)     ext4              /opt
>     ├─VolumeGroup1-var (dm-6)     ext4              /var
>     ├─VolumeGroup1-home (dm-7)    ext4              /home
>     └─VolumeGroup1-backups (dm-8) ext4              /backups
> 
> root at o9020:~# dmsetup table
> VolumeGroup1-home: 0 97648640 linear 254:0 83978240
> VolumeGroup1-usr: 0 19529728 linear 254:0 25389056
> VolumeGroup1-var: 0 19529728 linear 254:0 64448512
> VolumeGroup1-swap: 0 15622144 linear 254:0 9766912
> VolumeGroup1-root: 0 9764864 linear 254:0 2048
> VolumeGroup1-backups: 0 39059456 linear 254:0 181626880
> sda5_crypt: 0 248109056 crypt aes-xts-plain64
> 00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
> 0 8:5 4096
> VolumeGroup1-opt: 0 9764864 linear 254:0 54683648
> VolumeGroup1-tmp: 0 9764864 linear 254:0 44918784
> 
> 
> Is it expected?
> Does I have to fully fill the encrypted partition (at least once) to
> hide my datas?

Yes. See FAQ item 5.3. If you do it for an already created
filesystem, you will not reach everything though, that is 
why the overwrite should be done after crypto-mapping, but 
before filesystem creation.

Arno

-- 
Arno Wagner,     Dr. sc. techn., Dipl. Inform.,    Email: arno at wagner.name
GnuPG: ID: CB5D9718  FP: 12D6 C03B 1B30 33BB 13CF  B774 E35C 5FA1 CB5D 9718
----
There are two ways of constructing a software design: One way is to make it
so simple that there are obviously no deficiencies, and the other way is to
make it so complicated that there are no obvious deficiencies. The first
method is far more difficult.  --Tony Hoare


More information about the dm-crypt mailing list