Secure Erasing 840 Evo E-Drive - can it be done?

[BonzaiDuck]

I stumbled onto this thread, having described some SMART anomalies for "re-purposed" SSDs in another thread.

I had so far assumed that you would only need to delete the previous partition on an SSD (without Bitlock-ing) and create a new one -- having verified that TRIM on the new hosting OS was working.

How important is Secure Erase to "re-purposing" SSDs? I'll have to find out the procedure for Secure erasure for my own drives already mentioned, because those particular makes and models didn't come with any special utilities as I recollect.

 

[Elixer]

Secure erase is useful in a variety of ways, the main advantage is that it is done at the hardware level.
Formatting is at the software level, and isn't as thorough as a secure erase command.

So, if you want to be sure your SSD is 'reset' back to factory conditions (well, as close as possible) then you use secure erase.
If you want to be sure all data is gone, then you use secure erase.
If you have issues with a SSD, a secure erase can fix it.
So, when should you format it instead of doing a secure erase ? Well, when you have more than one partition on the SSD.

 

[Essence_of_War]

I had so far assumed that you would only need to delete the previous partition on an SSD (without Bitlock-ing) and create a new one -- having verified that TRIM on the new hosting OS was working.

How important is Secure Erase to "re-purposing" SSDs? I'll have to find out the procedure for Secure erasure for my own drives already mentioned, because those particular makes and models didn't come with any special utilities as I recollect.

Depends, how important is the data on your re-purposing SSD

You SHOULD be able to secure erase them from a live linux environment using the hdparm command from the terminal. Or alternatively, PartedMagic includes some gui's that make it very easy.

Here's a nice walkthrough of both methods:
http://techgage.com/article/securely-erasing-your-ssd-with-linux-a-how-to/

 

[guillaumedsde]

Hi all so I have a samsung 840 EVO (256GB) and I enabled eDrive encryption using this guide:

https://superuser.com/questions/692172/how-do-i-encrypt-a-samsung-evo-840-ssd

Everything worked fine, no problems whatsoever.

Now my Windows 8.1 install is getting kind of old and I need to reinstall.

How would I go about reinstalling Windows 8.1 on a eDrive enabled drive in order to still benefit from eDrive after reinstall?

I did try to follow the guide in the first post but the "encryption reset" software is telling me all my drives are not TCG Opal encrypted, which makes sense considering the drive is encrypted through eDrive and not TCG Opal, but how did you guys manage to reenable the "ready to enable" option in the thread?

 

[Jovec]

Just to be clear, Edrive requires an Edrive capable version of Bitlocker (and thus Win8.1 Pro or higher). Edrive itself offers no data encryption. There are other requirements, like a suitable EFI BIOS, a supported SSD, and a TPM (or you can change Bitlocker to use alternate authorization methods such as a passphrase if you don't have a TPM).

The main assumptions I'm making regarding Evo and EDrive are that 1) it will only work on a fresh Win 8.1 install and 2) the Evo security status for EDrive must be set to "Ready to Enable" prior to 8.1 installation.

I'm also assuming that Win 8.1 cannot be simply reinstalled on an existing EDrive Evo.

Here's what I would do:

1) Backup your data off of your existing install.

2) Download a copy of the PSID revert utility linked in this thread while you still have a working OS. Although not needed, you may wish to prepare a bootable USB/CD with Samsung's Secure Erase utility via Magician.

3) If you haven't already, update the Evo firmware using the Performance Restoration tool. Though we are not interested in running Steps 1-3 of the Performance Restoration Tool, you may need to let them run anyway. In the future if Samsung offers the new firmware standalone or through Magician I'd use that instead.

4) Use the PSID revert utility linked in this thread on your Evo to reset it's EDrive settings. This will destroy all data on your Evo. You will need the 32 character PSID printed on your Evo. This should also have the effect of performing a Secure Erase, but you could always run a separate one after the revert if you wish via standard methods.

5) Use Magician to change the EDrive security status of your Evo to "Ready to Enable" via any of the following methods. If you have an existing computer with Magician, you may just want to temporarily connect your Evo to it. If you have a single computer but have an extra HDD/SDD, you can install just Windows and Magician on that drive to change the EDrive status of your Evo. Finally, you always just install Windows and Magician on your Evo (temporarily) to change EDrive status. In the latter two cases, you don't need or want to activate Windows, patch it, or install any drivers or apps.

6) Install Win 8.1 Pro (or higher). Then install Magician and verify EDrive status is "Enabled."

7) Enable Bitlocker. You might need to disable TPM/enable passphrase if you don't have a TPM. You should not be asked to either "encrypt whole disk" or "encrypt data only." If you are, then EDrive + Bitlocker isn't working, only Bitlocker with CPU encryption (though with hardware AES-NI support in certain CPUs the performance can still be quite high). And of course, if you don't enable Bitlocker, then Edrive is not encrypting your data regardless of what Magician shows for the Evo's status.

 

[guillaumedsde]

It worked, thanks a lot for your help

 

[Mada]

Ended up in a situation where eDrive was enabled and bitlocker asked for the recovery key at every boot or hibernation. Once in windows bitlocker claimed it was turned off.

Used the PSID revert tool (Tank you!) and reinstalled Windows 8.1. I now have the situation shown i original post (class 0 - disabled, TCG - disabled, encryped drive - enabled).

It seems the drive is not encrypted. Bitlocker is not recognizing hardware acceleration (asks for all or only used disk space).

Is there a way to get the drive back to a state where edrive is activate-able through bitlocker?

Thanks

 

[WhoBeDaPlaya]

IMHO, regardless of how advanced current drives / FWs are, it's always a good idea to secure erase SSDs every once in awhile.

Just fire up your favorite live distro (I use gparted live) and :

1) Open a console
2) sudo hdparm -I /dev/sdX
3) If device is "frozen", unplug SSD power for a few seconds, plug back in and rerun #2 to confirm that it is "not frozen"
4) sudo hdparm --user-master u --security-set-pass yourpass /dev/sdX
5) sudo hdparm --user-master u --security-erase yourpass /dev/sdX

Presto

 

[Mada]

But hdparm used ATA commands. I don´t think the drive will respond to those when edrive enabled?

 

[Mada]

I used the "msed" tool to revert drive. After that I secure erased the drive. Re-installed Win 8.1.

Still no luck with bitlocker.

I have a celeron processor with lacks the AES instruction. Can that be a problem here?

Anyone knows where there might be a log or error message for me to follow up?

 

[Z15CAM]

C: \Windows\system32>cd C: \

C: \>cd temp

C: \TEMP>tcg_revert_release.exe

DOS still rules ;o)

 

[BonzaiDuck]

Originally Posted by BonzaiDuck
I had so far assumed that you would only need to delete the previous partition on an SSD (without Bitlock-ing) and create a new one -- having verified that TRIM on the new hosting OS was working.

How important is Secure Erase to "re-purposing" SSDs? I'll have to find out the procedure for Secure erasure for my own drives already mentioned, because those particular makes and models didn't come with any special utilities as I recollect.

Depends, how important is the data on your re-purposing SSD

You SHOULD be able to secure erase them from a live linux environment using the hdparm command from the terminal. Or alternatively, PartedMagic includes some gui's that make it very easy.

Here's a nice walkthrough of both methods:
http://techgage.com/article/securely-erasing-your-ssd-with-linux-a-how-to/

Gee! These posts are about a year old! It seemed that "back then" -- maybe in response to Essence's post, I downloaded PartedMagic, burned the disc and was able to secure-erase whatever SSD I needed to. An SSD will appear as "frozen," and there are features within the PM/secure-erase menu for getting around that. I think it puts your computer to sleep, and you have to patiently follow a few steps to complete the procedure, but nothing too daunting. . . . The only drawback with anything like this: you're not likely to do it frequently enough to remember the details the next time.

 

[Jovec]

But hdparm used ATA commands. I don´t think the drive will respond to those when edrive enabled?

No, it won't. Hence why a PSID revert is needed.

 

[PhIlLy ChEeSe]

I stumbled onto this thread, having described some SMART anomalies for "re-purposed" SSDs in another thread.

I had so far assumed that you would only need to delete the previous partition on an SSD (without Bitlock-ing) and create a new one -- having verified that TRIM on the new hosting OS was working.

How important is Secure Erase to "re-purposing" SSDs? I'll have to find out the procedure for Secure erasure for my own drives already mentioned, because those particular makes and models didn't come with any special utilities as I recollect.

http://www.majorgeeks.com/content/p...RID:10&ie=ISO-8859-1&q=secure+erase&sa=Search
enjoy!
PS there is tons of software at this site...

 

[BonzaiDuck]

To Philly --

Yeah, I've used that site here and there for years. Usually, if you're looking for something in particular, it's not the best place to get the latest revision.

I've been fiddling with my Primo-Cache configuration today on the 2700K system [boot-disk = Samsung 840 EVO; game program-files disk = WD Blue 500; caching SSD for WD Blue = 60GB Patriot Blaze]

I wanted to take the 840 EVO off its RAPID caching and use Primo. I'd had some screwy results just caching the HDD to the Blaze using CrystalDiskMark. The benchmark doesn't see the SSD as "part of" the HDD logical volume, so the bench results are what would be expected for a standalone HDD. Primo instructions recommend Anvil's Storage Utilities benchmarks, so I downloaded it and gave it a run. NOW I get the expected results!

What do you know about "Anvil's?"

 

[Mada]

Ok, thanks for the reply's.

My problem is that I can not get Bitlocker to work with my SED. Bitlocker reverts to software encryption.

And I have no idea why. It should work. Bitlocker is not logging anything to the event logs. Nor give any feedback.

 

[Jovec]

Ok, thanks for the reply's.

My problem is that I can not get Bitlocker to work with my SED. Bitlocker reverts to software encryption.

And I have no idea why. It should work. Bitlocker is not logging anything to the event logs. Nor give any feedback.

Hardware bitlocker needs a few things like a supported UEFI BIOS and a UEFI Win8.1 installation. It also helps to have a secondary HDD/SSD to get things going.

Getting the Evo EDrive mode to "enabled" requires a fresh install. Try this.

1) PSID revert the Evo
2) Plug the Evo into another Windows system that has Magician installed
3) Use Magician to change the EDrive mode to "Ready to enable."
4) Move the Evo into the computer you wish to use it in. For simplicity, disconnect all other drives. Change BIOS into UEFI Boot mode.
5) Install Win8.1 in UEFI mode.
6) Install Magicain. Evo Edrive should now be "Enabled"
7) Activate Bitlocker. If you are asked "data only" or "full drive" then it's still software mode. If you are not asked, then it's hardware mode.

If it's not working at this point, it's likely a BIOS/UEFI boot issue. Arguably, it's more trouble than it's worth. With a modern CPU there is very little slowdown with software Bitlocker.

 

[Mada]

Hardware bitlocker needs a few things like a supported UEFI BIOS and a UEFI Win8.1 installation. It also helps to have a secondary HDD/SSD to get things going.

Getting the Evo EDrive mode to "enabled" requires a fresh install. Try this.

1) PSID revert the Evo
2) Plug the Evo into another Windows system that has Magician installed
3) Use Magician to change the EDrive mode to "Ready to enable."
4) Move the Evo into the computer you wish to use it in. For simplicity, disconnect all other drives. Change BIOS into UEFI Boot mode.
5) Install Win8.1 in UEFI mode.
6) Install Magicain. Evo Edrive should now be "Enabled"
7) Activate Bitlocker. If you are asked "data only" or "full drive" then it's still software mode. If you are not asked, then it's hardware mode.

If it's not working at this point, it's likely a BIOS/UEFI boot issue. Arguably, it's more trouble than it's worth. With a modern CPU there is very little slowdown with software Bitlocker.

Thank you for the reply! I have a weak cpu (celeron without AES-NI) and would therefor like to us the SED.

I did all these steps except I used the same system for step 2. Will try this your suggested way.

As you say in 7, I am asked for data only.

In my last try, I disabled software encryption in the GPE. Bit-locker then gives me a pop up saying something like: "Did not revert due to group policy restriction." Yes, thank you bitlocker, I understood that. But why were you unable to use the hardware? That would have been nice to know.

Thanks,

 

[Jovec]

Thank you for the reply! I have a weak cpu (celeron without AES-NI) and would therefor like to us the SED.

I did all these steps except I used the same system for step 2. Will try this your suggested way.

As you say in 7, I am asked for data only.

In my last try, I disabled software encryption in the GPE. Bit-locker then gives me a pop up saying something like: "Did not revert due to group policy restriction." Yes, thank you bitlocker, I understood that. But why were you unable to use the hardware? That would have been nice to know.

Thanks,

Are you sure you are doing a UEFI Win8.1 installation? There are multiple ways to check - one is to look at the Evo (after install as the OS drive) in Disk Management and check for a 100MB EFI partition.

 

[Mada]

Are you sure you are doing a UEFI Win8.1 installation? There are multiple ways to check - one is to look at the Evo (after install as the OS drive) in Disk Management and check for a 100MB EFI partition.

Yes, I am sure. I have disabled all but EFI boot in bios. Had to do some work on the USB install stick in order for it to boot the win 8.1 installer.

Also checked msinfo32 and I have EFI partion (on GUID, GPT).

 

[Jovec]

Yes, I am sure. I have disabled all but EFI boot in bios. Had to do some work on the USB install stick in order for it to boot the win 8.1 installer.

Also checked msinfo32 and I have EFI partion (on GUID, GPT).

If you are configureing the Evo right, and doing a UEFI install right, then the mobo itsn't fully supporting UEFI or isn't the correct revision. I believe this is what I ran into on my attempts on my mobo.


http://www.anandtech.com/show/6891/...ndows-8-edrive-investigated-with-crucial-m500

Your platform will specifically need to support UEFI 2.3.1 (Class II no CSM/Class III). Often times UEFI boot support on motherboards can be tricky, particularly on earlier firmware revisions, so be sure you’re updated (this was the problem I ran into with my test hardware). I've had varied luck with getting DIY desktop PC hardware to behave appropriately with UEFI and BitLocker enabled, so your mileage may vary. The experience on a TPM enabled notebook should be far cleaner from what I've heard.

 

[Mada]

If you are configureing the Evo right, and doing a UEFI install right, then the mobo itsn't fully supporting UEFI or isn't the correct revision. I believe this is what I ran into on my attempts on my mobo.


http://www.anandtech.com/show/6891/...ndows-8-edrive-investigated-with-crucial-m500

This is my conclusion too. Here is the reply from ASUS:

Hi XXXX

Bitlocker encryption is based software only and not the hardware.

There are different kind of Encryption modes, such as
Transparent operation mode (TPM): that requires a chip on the motherboard itself and we do not sell any consumer motherboard with the TPM chip.

User authentication mode: that requires a PIN code when booting

USB Key Mode: here you must insert a USB device that contains a startup key, before you can boot in to the OS.

BitLocker is software based and a feature that is included in some Windows versions and have nothing to do with the UEFI.


The motherboard Q87T do support UEFI 2.3.1, as this is a standard for all Windows 8 and 8.1 ready motherboards.







Best Regards,
XXXXX
ASUS Nordic
Technical Support Department

 

[Mada]

If you are configureing the Evo right, and doing a UEFI install right, then the mobo itsn't fully supporting UEFI or isn't the correct revision. I believe this is what I ran into on my attempts on my mobo.


http://www.anandtech.com/show/6891/...ndows-8-edrive-investigated-with-crucial-m500

Asked again and now I got this answer:

Hi

Yes in theory it will work but with this hardware setup the function will be very slow. Having a TPM chip would speed it up somewhat but we cannot recommend using it with the setup defined below.


Best Regards,
XXXX
ASUS Nordic
Technical Support Department

 

[Synomenon]

I had a Samsung T1 external / portable USB3.0 SSD. Inside it is a MSATA 850 EVO. Before removing the 850 EVO from the enclosure, I made sure the password was disabled and any security on it disabled.

When I plug the SSD into any MSATA slot, no hard drive erase or secure erase utility can wipe it. They usually give an access denied error or don't see the full capacity of the drive.

Will this PSID revert utility fix my issue with this MSATA SSD?

 

[Mada]

If you are configureing the Evo right, and doing a UEFI install right, then the mobo itsn't fully supporting UEFI or isn't the correct revision. I believe this is what I ran into on my attempts on my mobo.


http://www.anandtech.com/show/6891/...ndows-8-edrive-investigated-with-crucial-m500

Success! After many hours of trial and error, I now have hardware based bitlocker. It works if activated before doing any updates. So I guess I had a driver blocking the function. Probably RST.