SSDs and Bitlocker Encryption

kevvyb · 01 Feb 2022

NavyLCDR said:

Samsung Magician says my 970 EVO Plus does:

Attachment 358663

I think the point of some of those articles is that it may be lying to you, you think the disk is safely encrypted, but in fact it is not? Sounds like there was a period where it was not apparent that the disks were defaulting to 'bitlocker encryption" but the key used was "", so no effective encryption at all...? Sounds like a complete cock up, or a couldn't care less' by disk manufacturers. Or did they not want to be held responsible for providing hardware that supported nefarious activities and a collective 'decision' was taken?

Compumind · 01 Feb 2022

NavyLCDR said:

Samsung Magician says my 970 EVO Plus does:

Attachment 358663

It just says "Encrypted Drive," so you would have to confirm built-in hardware encryption with Samsung.
My SSD is a Toshiba Enterprise SSD and the model specs and number clearly state hardware encryption.

Then again, your SSD is on the higher end, though a consumer drive and a Samsung at that.

It's like RAM. Nearly all consumer PC's do not come with ECC RAM.
You would need to specify it at time of order, if available, or buy it on your own.

FWIW.

kevvyb · 20 Feb 2022

Compumind said:

@kevvyb @NavyLCDR
...
Now, BitLocker on W10 may not actually encrypt your data even if you enable it.
This is because many SSDs physically cannot perform the BitLocker encryption properly.
Ask the vendor of you SSD if their drive truly supports it in hardware.
You might be very surprised to learn that the low end ones don't.

Thanks, I think from what I have read I understood that the implementation of hardware encryption on SSDs (in conjunction with Bitlocker) cannot be relied upon. I think Samsung itself recommends software encryption!

So I had already realised the need to encrypt in software. But I am still not yet sure I have identified the GP edits that I need to have all my drives encrypted and mount with the boot drive apart from one partition that I want to mount manually only when needed.

win10freak · 20 Feb 2022

Just so you know, ALWAYS enable BitLocker or any other encryption for SSDs BEFORE adding any data onto it. Because SSDs are very easy to recover data off of them if you add the data BEFORE encrypting them.

Always add the data AFTER encryption fully completes.

Another thing to keep in mind, always choose the option to encrypt the ENTIRE drive when turning On BitLocker encryption.

The encrypt used space only option just gives me the freaks….

MaloK · 20 Feb 2022

Samsung's are not Low-End

win10freak · 20 Feb 2022

Which is better to use if you need true encryption? Software based or hardware based encryption?

kevvyb · 20 Feb 2022

win10freak said:

Just so you know, ALWAYS enable BitLocker or any other encryption for SSDs BEFORE adding any data onto it. Because SSDs are very easy to recover data off of them if you add the data BEFORE encrypting them.
Always add the data AFTER encryption fully completes.

Need to ask if you are able to back up those assertions. In all the stuff I have been reading and also getting from replies on this forum over the past few days, no-one has mentioned this and I have nto read it anywhere else either.

win10freak said:

The encrypt used space only option just gives me the freaks….

Or is the reasoning that is just freaks you out?

SSDs and Bitlocker Encryption

Request for Corroboration on BitLocker assertions