MX Linux Forum

Hi there,

I've installed Linux distros several times before, but only dual boot, and this time it's a little different. For some reasons I want to replace Windows with MX (no dual boot this time, only Linux).

To make a long story short, before I turn this professional laptop into a personal one, I must ensure the SSD keeps nothing of what was previously on it. Which means that once MX is installed on it, no one must be able to recover any of the files it used to contain in its Windows days. I know wiping an entire SSD is not necessary for a linux install, but this is not my point.

What do you think would be the best thing to do ?

Thank you all!

For starters, give us the make and model of the laptop.

j2mcgreg wrote: Thu Jun 20, 2024 8:13 am For starters, give us the make and model of the laptop.

sure, here it is:
HP EliteBook 830 G6 x64 UEFI (Bios version HP R70 Ver. 01.26.00, 02/10/2023)

Here's what I think you should do since the SSD has to be unreadable by world plus dog:
1) Launch Win 11 and disable BitLocker and Fast Start Up
2) Enter the bios and disable Secure Boot
3) Remove the existing NVME and destroy it, or return it to the organization that was the original owner
4) Install a new NVME

This video shows you how to access and replace the NVME:
https://www.youtube.com/watch?v=oTrDteU0j2Q

j2mcgreg wrote: Thu Jun 20, 2024 8:50 am Here's what I think you should do since the SSD has to be unreadable by world plus dog:
1) Launch Win 11 and disable BitLocker and Fast Start Up
2) Enter the bios and disable Secure Boot
3) Remove the existing NVME and destroy it, or return it to the organization that was the original owner
4) Install a new NVME

This video shows you how to access and replace the NVME:
https://www.youtube.com/watch?v=oTrDteU0j2Q

Thank you, I think it would be better. The only trouble is, I had to do this once (replacing one Win SSD with another), and I just couldn't install Linux on the new one, so I put back the old SSD, and then this old SSD didn't work properly anymore). What I mean is I'm afraid that after replacing the old SSD with a new one, the bios says "what the heck is that ? I don't want new SSD, gimme back the old one!"

@mixmax wrote:

Thank you, I think it would be better. The only trouble is, I had to do this once (replacing one Win SSD with another), and I just couldn't install Linux on the new one, so I put back the old SSD, and then this old SSD didn't work properly anymore). What I mean is I'm afraid that after replacing the old SSD with a new one, the bios says "what the heck is that ? I don't want new SSD, gimme back the old one!"

It used to be that computer manufacturers like Compaq, Dell and a few others insisted that replacement parts be solely sourced from them. However this practice disappeared because the cost of carrying the necessary inventory greatly outpaced the revenue generated IE it wasn't a fiscally responsible practice. For this to still be an issue for you, your machine would have to have been built in 2013 or earlier. HP terminated the Compaq brand in 2013 and Compaq was the last brand to maintain this practice.

j2mcgreg wrote: Thu Jun 20, 2024 9:22 am It used to be that computer manufacturers like Compaq, Dell and a few others insisted that replacement parts be solely sourced from them. However this practice disappeared because the cost of carrying the necessary inventory greatly outpaced the revenue generated IE it wasn't a fiscally responsible practice. For this to still be an issue for you, your machine would have to have been built in 2013 or earlier. HP terminated the Compaq brand in 2013 and Compaq was the last brand to maintain this practice.

OK I guess the issue aforementioned was just due to the laptop itself rather than the two SSDs, then.

Anyway, what you're basically telling me is that all I have to do is to put some brand new internal SSD then boot my EliteBook from LiveUSB key to do the install, right ?
My second question: what about encryption during the install process ? What are the benefits of it ?
Oh, I forgot the third one: if I only format a usb key (without wiping it) before using it as a Live usb key, will the Linux install still be clean or is there any risk that some old data of the key might be transfered to the target SSD ?

Just a thought - wouldn't it be easier (and cheaper) to use a program like Parted Magic to securely erase the current drive? Then a bootable thumb drive can be created and away you go.

I think Parted Magic used to be freeware but the last time I looked it costs only $11.

https://partedmagic.com/nvme-secure-erase/

Question #1 --> Yes
Question #2 --> It really depends on your personal circumstances. If you are in a profession that requires confidentiality or if you are a road warrior or student where your laptop will be exposed in a variety of locations, you should definitely encrypt. However, if you are a sedentary, retired person like myself, where my main laptop does not travel (ever), I don't bother encrypting it. When I do travel, I take my spare laptop which contains no personal information and it's not encrypted either.
Question #3 I reuse usb drives quite frequently for this purpose because as part of the write process they are completely reformatted.

LU344928 wrote: Thu Jun 20, 2024 10:08 am Just a thought - wouldn't it be easier (and cheaper) to use a program like Parted Magic to securely erase the current drive? Then a bootable thumb drive can be created and away you go.

I think Parted Magic used to be freeware but the last time I looked it costs only $11.

https://partedmagic.com/nvme-secure-erase/

Thank you.
Wouldn't ATA Secure Erase https://archive.kernel.org/oldwiki/ata. ... Erase.html do the job as well ?

Can gparted on the liveusb not securely erase everything?

I mean.. if it held windows it is likely all NTFS. Format the whole dealie in ext4, one would have to put quite some effort in, I'd say, to get stuff back from that.

LU344928 wrote: Thu Jun 20, 2024 10:08 am Just a thought - wouldn't it be easier (and cheaper) to use a program like Parted Magic to securely erase the current drive? Then a bootable thumb drive can be created and away you go.

I think Parted Magic used to be freeware but the last time I looked it costs only $11.

https://partedmagic.com/nvme-secure-erase/

It depends on whether it may be necessary to prove (at a later date) that the drive has been rendered inaccessible by the current user of the machine. If the drive has been physically destroyed, you can produce the remnants and if the drive has been surrendered to the original owner you can produce the receipt for that transaction.

Yes, when proof is needed, definitely bring it back to where it came from and go from there.

j2mcgreg wrote: Thu Jun 20, 2024 10:21 am It depends on whether it may be necessary to prove (at a later date) that the drive has been rendered inaccessible by the current user of the machine. If the drive has been physically destroyed, you can produce the remnants and if the drive has been surrendered to the original owner you can produce the receipt for that transaction.

Basically the deal is : I can make it my personal computer only if old data is proved to be unrecoverable. I tried to explain that I could encrypt the whole thing and stuff but it seems like even I am not supposed to access the old data (some other people used this laptop before me).

Eadwine Rose wrote: Thu Jun 20, 2024 10:18 am Can gparted on the liveusb not securely erase everything?

I mean.. if it held windows it is likely all NTFS. Format the whole dealie in ext4, one would have to put quite some effort in, I'd say, to get stuff back from that.

Can it be that by simply formatting the whole SSD in ext4 the effect would be the same (the old data being unrecoverable because 1/ its NTFS partition was replaced with a ext4 one and 2/ the whole partition is populated either by linux system or really clean empty space) ?

@mixmax wrote:

Basically the deal is : I can make it my personal computer only if old data is proved to be unrecoverable. I tried to explain that I could encrypt the whole thing and stuff but it seems like even I am not supposed to access the old data (some other people used this laptop before me).

In that case I would remove the NVME in front of them ( after having disabled BitLocker and Fast Start Up) and then give it to them on the spot. Be sure to get a receipt.
Edited to add that it might be better all round to have them disable BitLocker, Fast Start Up, and remove the NVME before they surrender it to you, Get a receipt that shows these actions have taken place.

OK I'll go with that. As long as I can get back the rest (RAM and stuff) I'm fine. Thank you guys!

@mixmax

It depends on exactly how SURE you need to be about it being non-recoverable, and what type of data recovery threat you need to protect against. Non-volatile chip storage is kind of a beech in this regard. You can address the PHYSICAL space on a spinning disk to overwrite the data, but not on a chip. On NVM chips, it's up to the secret-sauce of its controller. For chips, you could write over all of the existing data, but file fragments, and maybe some complete files, might remain somewhere in the chips until the controller happens to write over the Actual physical space they are using.

One advantage of using pretty good disk encryption with SSDs is that lingering file traces would be encrypted and unreadable under such circumstances.

Some SSDs have erase utilities available from the manufacturer. How secure they Actually are would be a guess. So you have to ask yourself what the threat level is, and if its worth the money or effort to replace the SSD, or to try other things.

Good luck.

I'll follow your recommendations and j2mcgreg's on this one, I'll make a clean MX Install on a brand new SSD in replacement of the old one. In other words : I'll lancun Windows, disable bitlocker, fast start up and secure boot, turn off the beast, replace the NVME, turn on the laptop and boot from the live usb key then make an encrypted install. LEt's hope it will work....

Yet one last thing, though. As I said above, last time I did an SSD replacement, it ended with a double failure. First I failed at installing Linux on the new SSD, then after I put the first SSD back (with Win on it) I failed at using it normally (window wouldn't boot correctly and when it did, then it wouldn't work correctly). In the end of the day, nothing worked and I could use neither Windows (on the old SSD) nor Linux (on the new one).

Now I'm afraid that it might happen again. If for any reason there's something wrong with the new SSD, will I be able to go back to the old one before I try again with another SSD ?

Personally.. if you are physically removing the drive from the system and inserting a new one, I see no need to use encryption.

Eadwine Rose wrote: Thu Jun 20, 2024 11:55 am Personally.. if you are physically removing the drive from the system and inserting a new one, I see no need to use encryption.

The encryption is in case I'd have to give or sell the new SSD to someone on day.

Oh if you are forced to give up the computer? I'd format it before that. :)

Currently writing from my new 100% MX Linux SSD. Installation time : less than 10 minutes. It works like a charm! Thank you!

Great!! Have fun with it :)

mixmax wrote: Thu Jun 20, 2024 2:37 pm Currently writing from my new 100% MX Linux SSD. Installation time : less than 10 minutes. It works like a charm! Thank you!

Great stuff!!!