Truecrypt Whole Disk Encryption on SSD

Just bought an SSD and want to use WDE. Everything I've read says that the disk should be encrypted BEFORE the OS is installed because Truecrypt cannot guarantee all the data already written to the drive will be encrypted. See this post for details: https://www.wilderssecurity.com/showthread.php?t=299329

Two questions:
1) When I use WDE, I thought the entire drive was essentially encapsulated and not accessible without the password to boot. How is possible then that data will remain unencrypted (as indicated in the post above)?

2) Most importantly, what is the solution for using WDE on an SSD? I want to use this SSD but do not want to sacrifice WDE.

Thanks.

 

Everything you do after you encrypt the drive will be secured. The reason why anything on the drive _before_ you encrypt it may be accessible is the wear leveling technology built into flash-based media like SSDs and USB thumb drives. What this basically does is help extend the life of the drive by spreading write/delete cycles across all of the blocks (because they have a finite number of cycles). Unfortunately, there is no way for an application like TrueCrypt, or an erasing utility, to guarantee there is no plaintext data located on the drive after encryption/erasing because it is possible that there are blocks that did not get touched because their cycle count was already very high.

You could establish the operating system on a separate drive and then attempt to create a clone of it on the SSD. The TrueCrypt documentation on wear-leveling also mentions the following:

Another matter to consider is that, depending on what SSD you have, you will see a significant performance drop if your CPU is not capable of providing enough processing power for TrueCrypt to encrypt/decrypt data fast enough. If you're not sure how quickly TrueCrypt can do this on your system, run the benchmark [under Tools, buffer size doesn't matter much], and look at the speeds for the algorithm you intend to use. With a relatively modern CPU you should be OK with the cheaper SSDs (eg. SATA2 with a max read/write <300MB/s) but any of the higher performance SSDs may take a performance hit unless you're benchmarking at 500MB/s or higher.

If you're happy to take the performance hit, though, I don't think you need to worry about the potential for data-leaks as a result of wear-leveling when encrypting a drive that's already in use. The chances of anything significant actually being leaked are microscopically small to start with but this potential must be addressed by TrueCrypt because it implies there is no 100% guarantee that there is no plaintext data remaining. It's all a matter of assessing your threat model. Unless you realistically believe a government agency, or law enforcement, would be willing to devote hundreds of man-hours and thousands of dollars to _potentially_ recover an old encryption key (improbable) or data fragments (most likely of little consequence) then encrypting your SSD will serve you fine.

There are plenty of paranoid types that will disagree with this point of view but I believe in being realistic about security implementation It's not "all or nothing". Different levels of security apply in different situations.

 

You said you just bought the SSD disk, so it is clean, you don't need to worry about anything, just proceed as normal, install Windows, and encrypt it with WDE before any personal data other than the OS touches the disk. If it was an old SSD disk being reused it would be a different matter, you would have to wipe it all first as Truecrypt can't do that with an SSD disk.

I was reading the post you linked to and dantz there said "The danger, as explained by the TrueCrypt developers is that when you are creating the FDE your password will be written to the SSD". I believe that it is a real possibility, you should then change your initial password once full disk encryption has been achieved and that solves the problem.