From: Arno Wagner <arno@wagner.name>
To: dm-crypt@saout.de
Subject: Re: [dm-crypt] Encrypted partitions with sectors to zero?
Date: Wed, 23 Oct 2013 20:04:21 +0200 [thread overview]
Message-ID: <20131023180421.GA31232@tansi.org> (raw)
In-Reply-To: <CAO1iXZL5gt-WbThq1L5dyuz2AJDzGni7B=JFEE6YQdwqTm2_vg@mail.gmail.com>
On Wed, Oct 23, 2013 at 04:24:56PM +0200, Thomas Martin wrote:
> Hi everyone.
>
> I was trying to verify that discard (TRIM) was disabled on my system
> (new fresh install on a SSD) when I found some weird things.
>
> Indeed it seems I have many sectors to zero; example:
> root@o9020:~# hdparm --read-sector 54003000 /dev/sda
> /dev/sda:
> reading sector 54003000: succeeded
> 0000 0000 0000 0000 0000 0000 0000 0000
> 0000 0000 0000 0000 0000 0000 0000 0000
> 0000 0000 0000 0000 0000 0000 0000 0000
> ...
> 0000 0000 0000 0000 0000 0000 0000 0000
>
>
> According to me, only my /boot partition should have zero (as this is
> the only one unencrypted):
Encryption does not overwrite your data. If you want that
with LUKS or plain dm-crypt, ypu need to do the overwrite
yyourself. Some tools, like TrueCrypt, offer you to do
this optionally during installation.
See also FAQ item 5.3.
> root@o9020:~# parted /dev/sda "unit s print"
> Model: ATA LITEONIT LCS-128 (scsi)
> Disk /dev/sda: 250069680s
> Sector size (logical/physical): 512B/512B
> Partition Table: msdos
> Number Start End Size Type File system Flags
> 1 2048s 1953791s 1951744s primary ext4 boot
> 2 1955838s 250068991s 248113154s extended
> 5 1955840s 250068991s 248113152s logical
>
> root@o9020:~# lsblk /dev/sda -f
> NAME FSTYPE LABEL MOUNTPOINT
> sda
> ├─sda1 ext4 /boot
> ├─sda2
> └─sda5 crypto_LUKS
> └─sda5_crypt (dm-0) LVM2_member
> ├─VolumeGroup1-root (dm-1) ext4 /
> ├─VolumeGroup1-swap (dm-2) swap [SWAP]
> ├─VolumeGroup1-usr (dm-3) ext4 /usr
> ├─VolumeGroup1-tmp (dm-4) ext4 /tmp
> ├─VolumeGroup1-opt (dm-5) ext4 /opt
> ├─VolumeGroup1-var (dm-6) ext4 /var
> ├─VolumeGroup1-home (dm-7) ext4 /home
> └─VolumeGroup1-backups (dm-8) ext4 /backups
>
> root@o9020:~# dmsetup table
> VolumeGroup1-home: 0 97648640 linear 254:0 83978240
> VolumeGroup1-usr: 0 19529728 linear 254:0 25389056
> VolumeGroup1-var: 0 19529728 linear 254:0 64448512
> VolumeGroup1-swap: 0 15622144 linear 254:0 9766912
> VolumeGroup1-root: 0 9764864 linear 254:0 2048
> VolumeGroup1-backups: 0 39059456 linear 254:0 181626880
> sda5_crypt: 0 248109056 crypt aes-xts-plain64
> 00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
> 0 8:5 4096
> VolumeGroup1-opt: 0 9764864 linear 254:0 54683648
> VolumeGroup1-tmp: 0 9764864 linear 254:0 44918784
>
>
> Is it expected?
> Does I have to fully fill the encrypted partition (at least once) to
> hide my datas?
Yes. See FAQ item 5.3. If you do it for an already created
filesystem, you will not reach everything though, that is
why the overwrite should be done after crypto-mapping, but
before filesystem creation.
Arno
--
Arno Wagner, Dr. sc. techn., Dipl. Inform., Email: arno@wagner.name
GnuPG: ID: CB5D9718 FP: 12D6 C03B 1B30 33BB 13CF B774 E35C 5FA1 CB5D 9718
----
There are two ways of constructing a software design: One way is to make it
so simple that there are obviously no deficiencies, and the other way is to
make it so complicated that there are no obvious deficiencies. The first
method is far more difficult. --Tony Hoare
next prev parent reply other threads:[~2013-10-23 18:04 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-10-23 14:24 [dm-crypt] Encrypted partitions with sectors to zero? Thomas Martin
2013-10-23 18:04 ` Arno Wagner [this message]
-- strict thread matches above, loose matches on Subject: below --
2013-10-24 7:33 Thomas Martin
2013-10-24 11:53 ` Arno Wagner
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20131023180421.GA31232@tansi.org \
--to=arno@wagner.name \
--cc=dm-crypt@saout.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.