Secure deletion on BTRFS in LVM

Question

I have a BTRFS filesystem in an LVM logical volume, which exists inside of a LUKS disk. For reference's sake, let's call the LV lvm-root, and the LUKS disk crypt-root, and the BTRFS filesystem fs-root. It looks like this:

/dev/sda3: crypt-root
/dev/mapper/crypt-root: LVM physical volume
/dev/mapper/lvm-root: LVM logical volume lvm-root, which contains fs-root

My understanding is that on encrypted disks running LUKS, all deletes securely delete the underlying data, leaving nothing behind.

Does this work properly when running BTRFS in an LVM logical volume on a LUKS disk? I understand that BTRFS also stores data and metadata redundantly. Do I have a guarantee of deletion?

Answer 1

It isn't that disk encryption causes all deletes to be secure deletes, but that under disk encryption, the data was always encrypted in the first place, and so without decrypting the volume, you can't try to retrieve deleted files any more than you can do anything else.

How this affects your situation depends on your threat model. If you're worried about someone pulling your hard disk while it's unmounted, then they could only even attempt a recovery if they had the disk's encryption key. If they did, then it would be subject to the same questions as ever — has the relevant space been garbage-collected yet, mostly. But the solution here is to be careful with your disk keys. Assuming no one has the keys available, and they aren't root on your system and can't dump the cleartext block device while it's running, no one should be able to see any files you've deleted. (This applies even if they have non-root access on the system while the volume is mounted, since if a file has been deleted, it isn't accessible through the filesystem, and non-root shouldn't be able to look at the block device directly.)