topic Re: Re: Re: Hardware Device Encryption and cloning in Computers & IT

Hardware Device Encryption and cloning

Paindude — Sun, 16 Mar 2025 18:08:42 GMT

SImple question: I have a secure erased Samsung 870 EVO. Booting to my currently unencrypted Samsung 870 EVO drive, I use Samsung Magician to enable Device Encryption on this securely erased SSD. The question: what happens if I use Samsung Magician to Clone from my unencrypted 870 EVO to this securely erased, no device-encrypted-enabled SSD? It is usable? Can Windows Bitlocker use hardware encryption for it? (preferred) I can do the experiment, but I'd rather find out if someone has already tried this. The goal is to enable Samsung SSD hardware encryption with Bitlocker managing it, while not having to literally reinstall not only the OS, but every single app I've got on it.

Re: Hardware Device Encryption and cloning

Paindude — Sun, 16 Mar 2025 18:10:39 GMT

Dammit, mistyped the question. Corrected below:

SImple question: I have a secure erased Samsung 870 EVO. Booting to my currently unencrypted Samsung 870 EVO drive, I use Samsung Magician to enable Device Encryption on this securely erased SSD. The question: what happens if I use Samsung Magician to Clone from my unencrypted 870 EVO to this securely erased, NOW device-encrypted-enabled SSD? It the new encrypted SSD usable? Will it boot? Can Windows Bitlocker use hardware encryption for it? (preferred) I can do the experiment, but I'd rather find out if someone has already tried this. The goal is to enable Samsung SSD hardware encryption with Bitlocker managing it, while not having to literally reinstall not only the OS, but every single app I've got on it.

Re: Hardware Device Encryption and cloning

Paindude — Sun, 16 Mar 2025 18:11:45 GMT

!@#$!! Another typo, "IS the new encrypted SSD usable?..."

Re: Hardware Device Encryption and cloning

Paindude — Sun, 16 Mar 2025 18:12:48 GMT

And I am using WIndows 11 Pro.

Re: Hardware Device Encryption and cloning

arianwen27 — Sun, 16 Mar 2025 18:43:48 GMT

So, samsung magician encryption is hardware based. So if you clone an encrypted drive to a non encrypted drive, the clone will be unencrypted.

In my experience, bit locker never actually uses hardware encryption on a device, even if you tell it to. If you clone a bitlocker drive to an unencrypted drive, that second drive will now have bitlocker encryption.

TLDR, samsung encrypted drive is hardware. Meaning once it's unlocked, it can be cloned as if there was no encryption.
Bitlocker encrypted drives will clone the encryption over to the new drive.

Hardware encrypted drives kinda act like all the data isn't encrypted, as the drive handles that stuff.
Bit locker has the kinda raw data you see as encrypted, that your PC then decrypts

You wrote a lot so if you have any direct questions, just ask in a reply

Re: Re: Hardware Device Encryption and cloning

arianwen27 — Sun, 16 Mar 2025 18:53:29 GMT

Oh also, I'd personally say bitlocker is better than samsung hardware encryption

In the past, hardware encryption has used weak algorithms and sometimes don't generate their own keys too well. I'd hope thats no longer an issue though. Plus recovery can be hard if you the user doesn't know the key within the drive. In hardware failure or recovery, you get stuck. You don't know what goes on in that chip.

Though the main factor is to unlock the drive, you usually have to run an exe file to enter your code. Work and public computers don't allow that.

Again, as a me thing, I say software encryption is just a more versatile tool that can be recovered easier. It can be slower on some systems depending on things but I personally don't see much of a difference with bitlocker set to xts aes 256 bit mode

Re: Re: Hardware Device Encryption and cloning

Paindude — Sun, 16 Mar 2025 19:11:16 GMT

Thanks for the reply. However, the question was about cloning FROM the NONENCRYPTED drive TO the device ENCRYPTED drive. Not the other way. Appreciate your thoughts on the bitlocker software encryption, though, even though it's a drag on resources

Re: Re: Re: Hardware Device Encryption and cloning

arianwen27 — Sun, 16 Mar 2025 19:20:42 GMT

Aaah, if you clone an unencrypted drive to a hardware encrypted drive, the hardware encryption should stay on. So now you have a non encrypted and encrypted copy of your data

Re: Re: Re: Hardware Device Encryption and cloning

Paindude — Sun, 16 Mar 2025 20:54:37 GMT

So, just to recap:

1. Booting from my unencrypted, win11 pro OS/data Samsung 870 EVO SSD, I secure erase and Device encrypt another Samsung 870 EVO SSD.

2. Then after encrypting the now blank and Device Encrypted SSD, I clone my current unencrypted OS/data SSD to the encrypted drive.

3. I now reboot to the encrypted drive, and after opening it, I can apply bitlocker hardware encryption, and use a USB stick instead of TPM.

Is the above right?

Re: Re: Re: Re: Hardware Device Encryption and cloning

arianwen27 — Sun, 16 Mar 2025 21:04:10 GMT

Windows won't boot from an encrypted drive unless you use bitlocker or setup something special. So hardware encrypting a drive, then cloning to it will make a clone, but your PC won't know how to unlock it to boot from it

Re: Re: Re: Re: Hardware Device Encryption and cloning

arianwen27 — Sun, 16 Mar 2025 21:10:35 GMT

Still kinda trying to work out what you're trying to do as it seems needlessly complicated.

Unencrypted drive. Clone to second drive, boot second drive, encrypt with bitlocker. You now have an encrypted and unencrypted bootable Windows drive. You can tweak it to need a pin, usb or whatever instead of the tpm if you want, after it's encrypted.

Oh and if you want to use the hardware encryption of the drive, enable it in the group policy editor under the bitlocker section. It'll try to use it, else it'll default to software encryption

Re: Re: Re: Re: Hardware Device Encryption and cloning

Paindude — Mon, 17 Mar 2025 12:32:03 GMT

Finally just gave up, turned on Device encryption on the target disc and cloned the this target SSD, turned on bitlocker on this target cloned. Then going to the gpedit.msc and turning on hardware encryption does..... Nothing. It just remains software encrypted bitlocker according to the "manage-bde.exe -status" command

Re: Re: Re: Re: Re: Hardware Device Encryption and cloning

arianwen27 — Mon, 17 Mar 2025 12:33:06 GMT

Yeah, I've never had hardware encryption ever works with bitlocker. It CAN work if the stars align and conditions are met, but it's not worth the effort

Re: Re: Re: Re: Hardware Device Encryption and cloning

Paindude — Mon, 17 Mar 2025 12:34:41 GMT

As you and others have mentioned the only way to have hardware encryption is to turn Device Encryption on with Samsung magician, secure erase the disc and then reinstall the OS and reinstall every single app. Cloning an OS and installed apps is not an option.

Re: Re: Re: Re: Re: Hardware Device Encryption and cloning

Paindude — Mon, 17 Mar 2025 12:36:24 GMT

Thanks for responding, though.