On Fri, Jun 26, 2020 at 08:25:49AM -0500, David Wright wrote:
If encrypting an entire disk, scramble the disk first, then partition. If only encrypting a partition, partition the disk first. Alignments should be at least 2M (4096 x 512B sectors). Scramble any sensitive pre-existing contents: # dd bs=1M if=/dev/urandom of=/dev/sdz[9]
I personally wouldn't do this. It's slow and doesn't gain much. I definitely wouldn't do it on an SSD.
# cryptsetup --align-payload 2048 luksFormat /dev/sdz9
I also would not add this align-payload option. (If you don't, cryptsetup will query the kernel for optimal parameters.)